fix: use 'e2e' label trigger for secure secrets access

[Kavirubc]

Problem

The previous fix used pull_request_review to trigger E2E tests. However, workflows triggered by reviews on forked PRs do not have access to secrets, regardless of approval status. This caused the E2E workflow to fail immediately.

Solution

Switch trigger to pull_request_target (types: labeled).

• Secret Access: Valid (runs in base repo context).
• Security Gate: Runs ONLY when the e2e label is added.
• Verification: Maintainers must review code, approve, and then add the e2e label to run the test.

Checks out PR code securely via explicit ref logic.

[gh-simili-bot]

Simili Triage Report

Note

Quality Score: 9.5/10 (Excellent)
The issue could be improved. See suggestions below.

Classification

Category	Value
Labels

Quality Improvements

• Absence of direct link to the failing workflow run
• Include a direct link to the specific workflow run that failed due to the described problem

Similar Threads

Similarity	Thread	Status
84%	#77 Bug: E2E fails on forked PRs due to missing sec...	Open
83%	#78 fix: run E2E only when review is approved (secu...	Open
77%	#74 fix: prevent bot loop & enable E2E for forks	Closed

Warning

Possible Duplicate (Confidence: 95%)
This pull request might be a duplicate of #77.
Reason: The current issue directly addresses the problem described in Issue #77: 'E2E fails on forked PRs due to missing secrets'. Both issues share the exact same root cause (lack of secret access for workflows triggered by pull_request_review on forked PRs) and the same expected outcome (E2E tests running securely with secret access on forked PRs). The solution proposed in the current issue (switching to pull_request_target with an e2e label trigger) would fully resolve Issue #77.

---

_{Generated by Simili Bot}