ci: update guardian for PRs (#2043)

.github/workflows/cpu-tests.yml

@@ -25,8 +25,6 @@ env:
 
 jobs:
   testing-imports:
-    # no need to run it twice on a PR
-    if: github.event_name != 'pull_request_target'
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
@@ -35,7 +33,14 @@ jobs:
         python-version: ["3.10"]
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout generic
+        uses: actions/checkout@v4
+        if: github.event_name != 'pull_request_target'
+      - name: Checkout for `pull_request_target`
+        uses: actions/checkout@v4
+        if: github.event_name == 'pull_request_target'
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
       - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
@@ -119,7 +124,12 @@ jobs:
   testing-guardian:
     runs-on: ubuntu-latest
     needs: [pytester, testing-imports]
-    if: always()
+    if: |
+      github.event_name == 'pull_request_target' ||
+      (
+        github.event_name == 'pull_request' &&
+        contains('OWNER,MEMBER,COLLABORATOR', github.event.pull_request.author_association)
+      )
     steps:
       - run: echo "${{ needs.pytester.result }}"
       - name: failing...