That's the case if you use pull_request rather than pull_request_target.