Handle external pull requests wrt. OCI image build + push well

[amotl]

Handle external pull requests wrt. OCI image build + push well

[gutzbenj]

Sorry for the late response: This was fixed with

wetterdienst/.github/workflows/docker-publish-standard.yml

Line 31 in de0b1e5

if: ${{ ! startsWith(github.head_ref, '^dependabot/*') }} && ${{ ! github.event.pull_request.head.repo.fork }}

Same for the full version

[amotl]

Hi Nico,

Skip the "push" step for Dependabot.

I've tried it on two other spots already, but haven't been successful so far.

• daq-tools/lorrystream#2
• daq-tools/lorrystream#3

With kind regards,
Andreas.

[amotl]

@gutzbenj said at #945 (comment):

This is also effecting anyone who's not part of our organization and would open a PR from their fork e.g. max-mustermann/pr-to-wetterdienst. Ignoring would be fine but will have to figure the correct filter for PR branches.

[amotl]

It does not happen so often, but it's true. I wonder how others are handling this.

One idea: Build up an allow-list of contributors who have the corresponding permissions, and add a condition to the build+push workflow step to run only if the contribution is coming from someone who is member of this allow-list, and skip it for all others?

The good thing with our OCI building workflow recipes is that the build_and_test job will already cover the building of the image thoroughly, otherwise this operation would be complete nonsense at all.

[gutzbenj]

I think the allow list wouldn't work because there's no way to leak our GCR secret to someone. This is simply not the idea organization secrets.

[amotl]

I think the allow list wouldn't work because there's no way to leak our GCR secret to someone. This is simply not the idea organization secrets.

I don't understand this comment about the GCR secret and the organization secrets. Can you clarify?

My proposal was to only run the build&upload job based on an allow-list, so that it would only run when the patch originates from some of us who have the permissions, and skip it for all others.

Do you have a different solution in mind? We can also ask GitHub support for help, if we can't discover how others are doing it.