Fix build PR doc workflow (#1270)

* tentatively fix

* exporters gpu needs the correct label

* types required?

* starting?

* target

* i don't expect this to help

* should run

* add workflow dispatch

* revert doc change

.github/workflows/build_pr_documentation.yml

@@ -1,15 +1,30 @@
 name: Build PR documentation
 
+# WARNING: As this workflow supports the pull_request_target event, please exercise extra care when editing it.
+
 on:
-  pull_request:
+  workflow_dispatch:
+  pull_request_target:
     branches: [ main ]
+    types: [ opened, synchronize, reopened, labeled ]
+    paths:
+      - "optimum/**.py"
+      - "docs/**.mdx"
+      - "docs/**.yml"
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
 jobs:
+  authorize:
+    if: (github.event.action == 'labeled' && github.event.label.name == 'build-pr-doc') || github.event_name != 'pull_request_target' || (! github.event.pull_request.head.repo.fork)
+    runs-on: ubuntu-latest
+    steps:
+      - run: true
+
   build_documentation:
+    needs: authorize
     runs-on: ubuntu-latest
     env:
       COMMIT_SHA: ${{ github.event.pull_request.head.sha }}
@@ -27,6 +42,7 @@ jobs:
         with:
           repository: 'huggingface/optimum'
           path: optimum
+          ref: ${{ github.event.pull_request.merge_commit_sha }}
 
       - uses: actions/checkout@v2
         with:
@@ -87,6 +103,7 @@ jobs:
           sudo apt update
           sudo apt install -y ca-certificates apt-transport-https gnupg
           sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-key 5F03AFA423A751913F249259814F888B20B09A7E
+            # TODO: remove secrets and pull_request_target once archive.furiosa.ai is public
           sudo tee -a /etc/apt/auth.conf.d/furiosa.conf > /dev/null <<EOT
             machine archive.furiosa.ai
             login ${{ secrets.FURIOSA_ACCESS_KEY }}

.github/workflows/test_exporters_gpu.yml

@@ -13,6 +13,7 @@ on:
 
 jobs:
   start-runner:
+    if: ${{ (github.event_name == 'workflow_dispatch') || (github.event_name == 'schedule') || contains( github.event.pull_request.labels.*.name, 'gpu-test') }}
     name: Start self-hosted EC2 runner
     runs-on: ubuntu-latest
     env: