diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index ee33e6a..ff4cbe6 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -5,19 +5,43 @@ on:
       - main
     paths-ignore:
       - README.md
-  pull_request:
+  pull_request_target:
+    types:
+      - labeled
+      - unlabeled
     branches:
       - main
     paths-ignore:
       - README.md
 
 jobs:
+  check-perms:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Get User Permission
+        id: checkAccess
+        uses: actions-cool/check-user-permission@v2
+        with:
+          require: write
+          username: ${{ github.triggering_actor }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Check User Permission
+        if: steps.checkAccess.outputs.require-result == 'false'
+        run: |
+          echo "${{ github.triggering_actor }} does not have permissions on this repo."
+          echo "Current permission level is ${{ steps.checkAccess.outputs.user-permission }}"
+          echo "Job originally triggered by ${{ github.actor }}"
+          exit 1
+
   test-linux:
+    needs: check-perms
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 1
+          ref: ${{  github.event.pull_request.head.sha }}
       - uses: actions/setup-go@v5
         with:
           cache: false
@@ -26,20 +50,22 @@ jobs:
         run: make validate
       - name: Install gptscript
         run: |
-          curl https://get.gptscript.ai/releases/default_linux_amd64_v1/gptscript -o gptscript
-          chmod +x gptscript
+          curl https://get.gptscript.ai/releases/default_linux_amd64_v1/gptscript -o ./gptscriptexe
+          chmod +x ./gptscriptexe
       - name: Run Tests
         env:
-          GPTSCRIPT_BIN: ./gptscript
+          GPTSCRIPT_BIN: ./gptscriptexe
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
         run: make test
 
   test-windows:
+    needs: check-perms
     runs-on: windows-latest
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 1
+          ref: ${{  github.event.pull_request.head.sha }}
       - uses: actions/setup-go@v5
         with:
           cache: false