Update CI jobs to support PR branches (#4189)

* fix(ci): check out correct repo+ref for PRs. Addresses #3999

* fix(ci): update a bunch of other CI jobs to specify refs. For #3999

.github/workflows/chromatic.yml

@@ -7,7 +7,7 @@ on:
   push:
     paths:
       - web/**
-  pull_request_target:
+  pull_request:
     paths:
       - web/**
 
@@ -16,7 +16,6 @@ jobs:
   chromatic-deployment:
     # Operating System
     runs-on: ubuntu-latest
-    if: github.repository == 'owncast/owncast'
 
     defaults:
       run:
@@ -28,15 +27,16 @@ jobs:
         with:
           concurrent_skipping: 'same_content_newer'
 
-      - name: Check out pull request code
-        uses: actions/checkout@v4
-        if: github.event_name == 'pull_request' || github.event_name == 'pull_request_target'
-        with:
-          repository: ${{ github.event.pull_request.head.repo.full_name }}
-
-      - name: Check out repository code
-        uses: actions/checkout@v4
+      - name: Check out repository code (Push)
         if: github.event_name == 'push'
+        uses: actions/checkout@v4
+
+      - name: Check out pull request code (PR)
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.ref }}
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
 
       - name: Get changed files
         id: changed-files-yaml