Fix perms to repo secrets for integ tests

Author: clareliguori

.github/workflows/checks.yml

@@ -12,5 +12,3 @@ jobs:
     uses: ./.github/workflows/typescript-checks.yml
   cdk:
     uses: ./.github/workflows/cdk-checks.yml
-  integ-test:
-    uses: ./.github/workflows/integ-tests.yml

.github/workflows/integ-tests.yml

@@ -3,6 +3,9 @@ name: Integ Tests
 on:
   workflow_dispatch: {}
   workflow_call:
+  push:
+    branches:
+      - main
 
 jobs:
   integ_tests:

.github/workflows/pull-request-checks.yml

@@ -1,9 +1,7 @@
 name: Pull request checks
 
 on:
-  pull_request_target:
-    types: [opened, synchronize, reopened, labeled]
-    branches: [main]
+  pull_request:
 
 jobs:
   python:
@@ -12,6 +10,3 @@ jobs:
     uses: ./.github/workflows/typescript-checks.yml
   cdk:
     uses: ./.github/workflows/cdk-checks.yml
-  integ-test:
-    if: contains(github.event.pull_request.labels.*.name, 'safe-to-test')
-    uses: ./.github/workflows/integ-tests.yml

.github/workflows/pull-request-integ-tests.yml

@@ -0,0 +1,14 @@
+name: Pull request integration tests
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened, labeled]
+    branches: [main]
+
+jobs:
+  integ-test:
+    if: contains(github.event.pull_request.labels.*.name, 'safe-to-test')
+    permissions:
+      id-token: write
+      contents: read
+    uses: ./.github/workflows/integ-tests.yml