We didn’t. In the end we move back to GitHub OIDC trigger from GitHub Apps trigger, enable build only on PR, and override branch trigger with [Product Launch] Override Only Build PRs Setting to match our needs.
We set GitHub token in env, grab associated PR with CIRCLE_PULL_REQUESTS env and fetch PR information from GitHub API. This solution does introduce race condition when PR information change and rerun older runs will grab wrong information on PR.
The trigger isn’t really reliable when there’s multiple PR associated to a single ref.
We just tell users about these caveats and hope they won’t step on any bug related to CircleCI setup here.