fix: external fixes pt 2

.github/workflows/ci3.yml

@@ -16,9 +16,14 @@ on:
     types: [opened, synchronize, reopened, ready_for_review, labeled]
 
 concurrency:
-  # On master (handled by push event) the group id is the unique run_id so we get parallel runs.
-  # On PR's the group id is the ref_name so only 1 can run at a time.
-  group: ci3-${{ github.event_name == 'push' && github.run_id || github.ref_name }}
+  # On master or workflow_dispatch (checked via event_name) the group id is the unique run_id so we get parallel runs.
+  # On PR's the group id is the ref_name so only 1 can run at a time. Include the repo in case it is an external PR.
+  group: |
+    ci3-${{ github.event_name }}-${{
+      (github.event_name == 'push' || github.event_name == 'workflow_dispatch') &&
+      github.run_id ||
+      format('{0}/{1}', github.event.pull_request.head.repo.full_name, github.head_ref)
+    }}
   cancel-in-progress: true
 
 jobs:
@@ -34,7 +39,7 @@ jobs:
       fail-fast: false
       matrix:
         # Only run arm64 build with arm64-ci label.
-        # Thhe way to do conditions here is to parse full strings as JSON.
+        # The way to do conditions here is to parse full strings as JSON.
         settings:  >-
           ${{ fromJson(contains(github.event.pull_request.labels.*.name, 'arm64-ci') &&
             '[{"arch":"amd64"},{"arch":"arm64"}]' ||
@@ -54,19 +59,14 @@ jobs:
         run: echo "CI is not run on drafts." && exit 1
 
       - name: External Contributor Labels and Target
-        # Run only for external PRs (pull_request_target, != github.repository)
-        # And then check if we have incorrect labels OR an incorrect base_ref.
         if: |
           github.event_name == 'pull_request_target' &&
-          github.event.pull_request.head.repo.full_name != github.repository &&
-          (
-            (contains(github.event.pull_request.labels.*.name, 'ci-external') == false &&
-             contains(github.event.pull_request.labels.*.name, 'ci-external-once') == false)
-          )
+          contains(github.event.pull_request.labels.*.name, 'ci-external') == false &&
+          contains(github.event.pull_request.labels.*.name, 'ci-external-once') == false
         run: echo "External PRs need the 'ci-external' or 'ci-external-once' labels to run." && exit 1
 
       - name: External Contributor Changes
-        if: github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository
+        if: github.event_name == 'pull_request_target'
         run: |
           set -o pipefail
           git fetch origin ${{ github.event.pull_request.base.ref }} --depth=1