tests-forks.yaml

name: Run Test (forks & dependabot)
on:
  pull_request_target:
    types: [opened, synchronize, reopened, labeled]

# https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token
permissions:
  contents: read
  issues: read         # needed for the "labeled" event?
  pull-requests: read  # needed for the "labeled" event?

jobs:
  check-label:
    name: Check label
    runs-on: ubuntu-latest
    # sender.login is needed for runs re-triggered from GitHub UI
    if: |
      (github.event.pull_request.user.login == 'dependabot[bot]' && contains(github.event.pull_request.labels.*.name, 'ok to test'))
      || (github.event.pull_request.head.repo.fork && contains(github.event.pull_request.labels.*.name, 'ok to test'))
    permissions:
      issues: write
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - name: remove labels
        run: |
          gh pr edit ${{ github.event.pull_request.number }} --remove-label "ok to test"
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  event_file:
    needs: [check-label]
    name: "Store event file"
    runs-on: ubuntu-latest
    steps:
    - name: Upload
      uses: actions/upload-artifact@v4
      with:
        name: Event File
        path: ${{ github.event_path }}
  unit-tests:
    needs: [check-label]
    if: needs.check-label.result == 'success'
    uses: ./.github/workflows/unit-tests.yaml
    name: Unit tests
  security-tests:
    name: Security tests
    needs: [unit-tests]
    if: needs.unit-tests.result == 'success'
    uses: ./.github/workflows/security-tests.yaml
    secrets: inherit
  integration-tests:
    name: Integration tests
    needs: [unit-tests]
    if: needs.unit-tests.result == 'success'
    uses: ./.github/workflows/integration-tests.yaml
    with:
      cnspecImageTag: ""
    secrets: inherit