ci: Fix integration tests failing on fork PRs (#655)

## Summary
- Inline integration tests in the CI workflow instead of calling the
reusable workflow to avoid GitHub's compile-time secret validation for
nested reusable workflows, which fails on fork PRs where repo secrets
are not available
- Add `workflow_dispatch` to the integration tests condition
- Remove unnecessary `secrets: inherit` from unit tests

This follows the same pattern as in the Python SDK:
https://github.com/apify/apify-sdk-python/blob/master/.github/workflows/_tests.yaml

## Test plan
- [x] Verify the workflow syntax is valid
- [x] Integration tests should run on PRs from the `apify` org, pushes
to `master`, and manual triggers
- [x] Integration tests should be skipped on fork PRs

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: vdusek

.github/workflows/_tests.yaml

@@ -14,26 +14,67 @@ jobs:
   unit_tests:
     name: Unit tests
     uses: apify/workflows/.github/workflows/python_unit_tests.yaml@main
-    secrets: inherit
     with:
       python_versions: '["3.11", "3.12", "3.13", "3.14"]'
       operating_systems: '["ubuntu-latest", "windows-latest"]'
       python_version_for_codecov: "3.14"
       operating_system_for_codecov: ubuntu-latest
       tests_concurrency: "16"
 
+  # Integration tests are inlined (not calling the reusable workflow) to avoid GitHub's compile-time secret
+  # validation for nested reusable workflows, which fails on fork PRs where repo secrets are not available.
   integration_tests:
-    name: Integration tests
+    name: Integration tests (${{ matrix.python-version }}, ${{ matrix.os }})
     if: >-
       ${{
         (github.event_name == 'pull_request' && github.event.pull_request.head.repo.owner.login == 'apify') ||
-        (github.event_name == 'push' && github.ref == 'refs/heads/master')
+        (github.event_name == 'push' && github.ref == 'refs/heads/master') ||
+        github.event_name == 'workflow_dispatch'
       }}
-    uses: apify/workflows/.github/workflows/python_integration_tests.yaml@main
-    secrets: inherit
-    with:
-      python_versions: '["3.11", "3.14"]'
-      operating_systems: '["ubuntu-latest"]'
-      python_version_for_codecov: "3.14"
-      operating_system_for_codecov: ubuntu-latest
-      tests_concurrency: "16"
+
+    strategy:
+      matrix:
+        os: ["ubuntu-latest"]
+        python-version: ["3.11", "3.14"]
+
+    runs-on: ${{ matrix.os }}
+
+    env:
+      TESTS_CONCURRENCY: "16"
+      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v6
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Set up uv package manager
+        uses: astral-sh/setup-uv@v7
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install Python dependencies
+        run: uv run poe install-dev
+
+      - name: Run integration tests
+        run: uv run poe integration-tests-cov
+        env:
+          APIFY_TEST_USER_API_TOKEN: ${{ secrets.APIFY_TEST_USER_PYTHON_SDK_API_TOKEN }}
+          APIFY_TEST_USER_2_API_TOKEN: ${{ secrets.APIFY_TEST_USER_2_API_TOKEN }}
+
+      - name: Upload integration test coverage
+        if: >-
+          ${{
+            matrix.os == 'ubuntu-latest' &&
+            matrix.python-version == '3.14' &&
+            env.CODECOV_TOKEN != ''
+          }}
+        uses: codecov/codecov-action@v5
+        with:
+          token: ${{ env.CODECOV_TOKEN }}
+          files: coverage-integration.xml
+          flags: integration