build: skip GitHub action steps the require write perms on external PRs

... so that checks can pass when people submit PRs to the repo.
ar-io · Aug 25, 2023 · 59c9f7f · 59c9f7f
1 parent 44add3e
commit 59c9f7f
Showing 1 changed file with 6 additions and 4 deletions.
diff --git a/.github/workflows/build-core.yml b/.github/workflows/build-core.yml
@@ -39,21 +39,22 @@ jobs:
       # Test results report
       - name: Report test results
         uses: dorny/test-reporter@v1
-        if: success() || failure()
+        if: (success() || failure()) && ${{ github.event.pull_request.head.repo.full_name == github.repository }}
         with:
           name: Mocha tests
           path: test-results.json
           reporter: mocha-json
 
       - name: Report code coverage
-        if: ${{ github.event_name == 'pull_request' }}
+        if: ${{ github.event_name == 'pull_request' }} && ${{ github.event.pull_request.head.repo.full_name == github.repository }}
         uses: romeovs/lcov-reporter-action@v0.2.16
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           lcov-file: ./coverage/lcov.info
 
       - name: Check code coverage threshold
         uses: VeryGoodOpenSource/very_good_coverage@v2
+        if: ${{ github.event_name == 'pull_request' }} && ${{ github.event.pull_request.head.repo.full_name == github.repository }}
         with:
           path: ./coverage/lcov.info
           min_coverage: 50
@@ -78,6 +79,7 @@ jobs:
 
       # Build and push container image to ECR
       - name: Configure AWS credentials
+        if: ${{ github.event_name != 'pull_request' }}
         uses: aws-actions/configure-aws-credentials@v2
         with:
           role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ secrets.AWS_BUILD_INVOCATION_ROLE }}
@@ -107,15 +109,15 @@ jobs:
 
       # Success notification
       - name: Send Slack success notification
-        if: success()
+        if: success() && ${{ github.event_name != 'pull_request' }}
         env:
           SLACK_TITLE: Build succeeded!
           SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
         uses: rtCamp/action-slack-notify@v2
 
       # Failure notification
       - name: Send Slack failure notification
-        if: failure()
+        if: failure() && ${{ github.event_name != 'pull_request' }}
         env:
           SLACK_TITLE: Build failed!
           SLACK_COLOR: danger