Pass secrets to approved workflow jobs

[zimeg]

Summary

This PR attempts to pass secrets to integration tests for PRs opened from a fork. Fixes #251.

PRs not opened by a COLLABORATOR will initially fail because secrets "are not passed to workflows that are triggered by a pull request from a fork" but checking out the head.sha on a re-run is an apparent workaround for this and workflows can be re-run by a maintainer!

Notes

• Other options for author_associations include MEMBER which might work better for the check in access_check. I think a re-run will pass this check in any case though 🤔

Requirements

• I've read and understood the Contributing Guidelines and have done my best effort to follow them.
• I've read and agree to the Code of Conduct.

[zimeg]

Good to know that MEMBER is different from COLLABORATOR! I'll try a re-run to see if that works 👀

Edit: Darn no luck with the re-run... Going to update the check to MEMBER now! 🙏

[zimeg]

Hmm... MEMBER passes the access check (unsure if this would be true for re-runs against other PRs) but secrets still aren't shared 🔐

[zimeg]

Trouble with secret passing might be a limitation of the pull_request event entirely! There's an option to use pull_request_target instead which can access secrets but comes with many warnings around security. I think it's alright to use this event with caution and the "Require approval for outside collaborators" setting for Actions, but open to discussion!

[seratch]

Ideally, we wan to run tests for PRs but this workaround looks good to me at this time

[zimeg]

@seratch There are a few new changes so want to check that this looks good before merging.

The tests aren't running on this PR, but I believe this is because pull_request was removed and the updated pull_request_target doesn't yet exist on main.

Using pull_request_target for future PRs should start this workflow with necessary secrets and the github.event.pull_request.head.sha in actions/checkout@v4 will use the changes in the PR when building and testing changes.

[zimeg]

The pull_request_target still uses the event.pull_request values from what I can tell: https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target

[seratch]

@zimeg Sorry for missing the additional changes here. All of them look good to me too. You can merge this PR tomorrow (or early next week).

[zimeg]

@seratch No worries at all! Thank you for another review 🙌