Fix permission issue for pull request triggered GHA

.github/workflows/build.yml

@@ -2,6 +2,8 @@ name: CI
 
 on:
   push:
+  pull_request_target:
+    types: [opened, synchronize]
   workflow_dispatch:
 
 jobs:
@@ -62,6 +64,9 @@ jobs:
     runs-on: ubuntu-latest
     needs: build
 
+    # If push event triggered, it must not be a pull request
+    if: github.event_name != 'push' || !startsWith(github.ref, 'refs/pull/')
+
     env:
       VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }}
       VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }}
@@ -70,6 +75,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
       - uses: actions/download-artifact@v4
         with: