Apply feedback

Author: Murderlon

.github/workflows/ci.yml

@@ -20,7 +20,7 @@ on:
       - ".changeset/**"
 
 concurrency:
-  group: ${{ github.workflow }}--${{ github.ref }}
+  group: ${{ github.workflow }}--${{ github.event_name == 'pull_request_target' && format('pr#{0}', github.event.pull_request.number) || github.ref }}
   cancel-in-progress: true
 
 permissions:
@@ -42,6 +42,8 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: 20.x
+          cache: npm
+          cache-dependency-path: package-lock.json
 
       - name: Install dependencies
         run: npm ci --no-fund --no-audit
@@ -67,7 +69,8 @@ jobs:
     # For external PRs: environment protection requires manual approval
     if: |
       github.event_name == 'push' ||
-      github.event.pull_request.head.repo.full_name == github.repository
+      (github.event_name == 'pull_request_target' &&
+       github.event.pull_request.head.repo.full_name == github.repository)
 
     steps:
       - name: Checkout sources
@@ -85,6 +88,8 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: 20.x
+          cache: npm
+          cache-dependency-path: package-lock.json
 
       - name: Install dependencies
         run: npm ci --no-fund --no-audit