CLOUDP-304211: Only accept pull_request_target with safe-to-test label (#2211)

* Only accept pr target with safe-to-test

And exclude the pr evertn when safe-to-test is set

Signed-off-by: jose.vazquez <[email protected]>

* add traces

Signed-off-by: jose.vazquez <[email protected]>

* Compact check

* remove branch restriction

* more traces

* Fix contribution triggering

---------

Signed-off-by: jose.vazquez <[email protected]>

Author: josvazg

.github/workflows/test.yml

@@ -8,56 +8,28 @@ on:
       - 'main'
     paths-ignore:
       - 'docs/**'
-  pull_request:
-    types: [opened, synchronize, reopened, ready_for_review, converted_to_draft, labeled, unlabeled]
-    branches:
-      - '**'
-    paths-ignore:
-      - 'docs/**'
   merge_group:
   workflow_dispatch:
+  workflow_call:
 
 concurrency:
   group: test-${{ github.head_ref || github.ref_name }}
   cancel-in-progress: true
 
 jobs:
-  run-tests:
-    name: Run Tests
-    runs-on: ubuntu-latest
-    # Contributions do NOT run any testing by default, a label is needed to allow testing
-    if: |
-      github.event.pull_request.base.repo.full_name == github.event.pull_request.head.repo.full_name ||
-      contains(github.event.pull_request.labels.*.name, 'safe-to-test') ||
-      contains(github.event.pull_request.labels.*.name, 'cloud-tests') ||
-      contains(github.event.pull_request.labels.*.name, 'retest')
-    steps:
-      - name: allowed message
-        run: echo "Allowed to run tests"
-
   lint:
-    needs:
-      - run-tests
     uses: ./.github/workflows/lint.yaml
 
   validate-manifests:
-    needs:
-      - run-tests
     uses: ./.github/workflows/validate-manifests.yml
 
   unit-tests:
-    needs:
-      - run-tests
     uses: ./.github/workflows/test-unit.yml
 
   check-licenses:
-    needs:
-      - run-tests
     uses: ./.github/workflows/check-licenses.yml
 
   cloud-tests-filter:
-    needs:
-      - run-tests
     uses: ./.github/workflows/cloud-tests-filter.yml
 
   cloud-tests:

.github/workflows/trigger.yml

@@ -0,0 +1,24 @@
+name: Trigger
+
+on:
+  pull_request_target:
+    types: [labeled]
+    paths-ignore:
+      - 'docs/**'
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review, converted_to_draft, labeled, unlabeled]
+    branches:
+      - '**'
+    paths-ignore:
+      - 'docs/**'
+
+jobs:
+  run-tests:
+    name: Run Tests
+    # Contributions do NOT run any testing by default, a label is needed to allow testing
+    # Only accept either code owner's PRs from the same repo
+    # or pull_request_target events with the safe-to-test allow flag
+    if: |
+      (!contains(github.event.pull_request.labels.*.name, 'safe-to-test') && github.event_name == 'pull_request') || 
+      (contains(github.event.pull_request_target.labels.*.name, 'safe-to-test') && github.event_name == 'pull_request_target')
+    uses: ./.github/workflows/test.yml