[WIP] Allowing Testing on External Forks

[AndrewQuijano]

Hello, (Update Feb 2, 2025)

So I have been testing running tests on external forks, and I think I got it working safely with this example
adwise-fiu/Level-Site-PPDT#14

So for set up, I did the following
1- Setup branch protection rule

2- Update Action to allow external forks

3- See the updated workflow, so essentially what happens is,
a) Someone creates a Pull Request
b) Before the option appears to even run the test cases, I need the changes approved, once I see that checkmark, then the option to run test cases appears, and I click OK and run the tests.

The security comes from needing a manual approval. The GitHub Actions will prevent ANY code being run until Step A is completed.

There is one slight issue, the reviewer can't be the same person writing the PR, which is technically more secure, but does slightly make things a bit more annoying?

[coolkingcole]

Will need to add protections provided by an environment that ensures approval from panda-re developers before running.

[AndrewQuijano]

Btw @coolkingcole, since the test workflow stores containers in GHCR, but it seems this is linked to a user account, not sure how pull_request_target would work for that. At least secure use of pull_request_target means that you can securely share secrets.

You might need to switch to storing test containers in DockerHub too. Just something to note when testing this.
https://hub.docker.com/r/pandare/panda_test