CI: required unit-tests status never reported on fork PRs (workflow is push-only)

[apermo]

Symptom

PRs opened from forks (e.g. #617) sit indefinitely with the required unit-tests status check stuck at:

Expected — Waiting for status to be reported

…and never go green, blocking merge regardless of how many runs of Plugin Check succeed.

Root cause

.github/workflows/test.yml declares the unit-tests job with a push-only trigger:

name: UnitTests and CodeCoverage
on: [push]
jobs:
  unit-tests:
    runs-on: ubuntu-latest
    …

GitHub Actions runs on: push workflows from the perspective of the repo where the push lands. For a PR from a fork (apermo:poc/... → lloc:master), the push happens on the fork — so:

• The upstream repo (lloc) doesn't run the workflow because no push event hit lloc.
• The fork doesn't run the workflow either if Actions are disabled there (which is the default for many forks).
• Branch protection on master requires a unit-tests status to be reported on the head commit, and nothing posts one.

Result: the check is "expected" forever and the PR is unmergeable through the normal flow.

Plugin Check (.github/workflows/plugin-check.yml) doesn't have this problem because it triggers on pull_request:, which runs from the upstream repo's perspective with read-only secrets.

Possible directions (decision for the maintainer)

1. Add pull_request to test.yml's triggers. Smallest fix — workflow runs from upstream on every PR, status reports correctly. Uses the merge-ref so secrets aren't exposed to fork code by default.

   on:
     push:
     pull_request:

2. Drop the requirement for unit-tests from branch protection on master, leaving Plugin Check (which already covers PRs) as the gate.
3. Combine the unit-test job into plugin-check.yml (or vice versa) so there's a single gate that runs on both push and pull_request.
4. pull_request_target if the workflow ever needs write secrets while running against a fork PR — comes with documented security caveats; mentioning for completeness, not recommending blindly.

Option 1 is the lowest-risk change and would unblock contributors immediately; the rest are scope decisions.

Reproduction

• PR feat: add post from translation (admin subpage + bulk + capability filter) #617 (apermo:poc/add-post-from-translation → master) currently shows the symptom; the head commit has only the Plugin Check / test run reported, no unit-tests.
• gh api repos/lloc/Multisite-Language-Switcher/commits/<sha>/status returns state: pending with an empty statuses array.
• gh api repos/lloc/Multisite-Language-Switcher/commits/<sha>/check-runs shows only test (Plugin Check), not unit-tests.

Happy to open a follow-up PR for whichever direction you pick.