ci: support PRs from forks (#1928)

.github/workflows/gradle-run-unit-tests.yml

@@ -33,7 +33,7 @@ jobs:
 
       - name: Validate Gradle wrapper
         uses: gradle/wrapper-validation-action@e6e38bacfdf1a337459f332974bb2327a31aaf4b
-      
+
       - name: Gradle cache
         uses: gradle/gradle-build-action@v2
 
@@ -51,32 +51,34 @@ jobs:
       - name: Install Pip for test result publishing
         run: sudo apt-get install -y python3-pip
 
-      - name: Publish Unit Test Results
-        uses: EnricoMi/publish-unit-test-result-action/[email protected]
+      # Uploads test results as GitHub artifacts, so publish-test-results can find them later.
+      # This name is referenced in the publish-test-results workflow.
+      - name: Upload Test Results
+        uses: actions/upload-artifact@v3
         if: always()
         with:
           files: |
             **/build/test-results/testDevDebugUnitTest/**/*.xml
             **/build/test-results/**/*.xml
             **/build/outputs/androidTest-results/**/*.xml
 
-      -   name: Generate report
-          uses: actions/upload-artifact@v3
-          with:
-              name: report
-              path: app/build/reports/jacoco
+      - name: Generate report
+        uses: actions/upload-artifact@v3
+        with:
+          name: report
+          path: app/build/reports/jacoco
 
-      -   name: Download Test Reports Folder
-          uses: actions/download-artifact@v3
-          with:
-              name: report
-              path: app/build/reports/jacoco
+      - name: Download Test Reports Folder
+        uses: actions/download-artifact@v3
+        with:
+          name: report
+          path: app/build/reports/jacoco
+
+      - name: Upload Test Report
+        uses: codecov/codecov-action@v2
+        with:
+          files: "app/build/reports/jacoco/jacocoReport/jacocoReport.xml"
 
-      -   name: Upload Test Report
-          uses: codecov/codecov-action@v2
-          with:
-              files: "app/build/reports/jacoco/jacocoReport/jacocoReport.xml"
-
       - name: Cleanup Gradle Cache
         # Remove some files from the Gradle cache, so they aren't cached by GitHub Actions.
         # Restoring these files from a GitHub Actions cache might cause problems for future builds.
@@ -98,3 +100,13 @@ jobs:
     with:
       flavour: "dev-debug"
 
+  event_file:
+    # This name is referenced in the publish-test-results workflow.
+    name: "Upload Event File"
+    runs-on: ubuntu-latest
+    steps:
+        - name: Upload
+          uses: actions/upload-artifact@v3
+          with:
+              name: Event File
+              path: ${{ github.event_path }}

.github/workflows/jira-lint-and-link.yml

@@ -6,6 +6,8 @@ on:
 jobs:
   add-jira-description:
     runs-on: ubuntu-latest
+    # Run only if the PR is not from a Fork / external contributor
+    if: github.repository_owner == 'wireapp'
     steps:
       - uses: cakeinpanic/[email protected]
         name: jira-description-action

.github/workflows/pr-author-assigner.yml

@@ -1,7 +1,7 @@
 name: Auto assign author to PR
 on:
-    pull_request:
-        types: [ opened ]
+  pull_request_target:
+    types: [ opened ]
 
 jobs:
     assign-author:

.github/workflows/publish-test-results.yml

@@ -0,0 +1,47 @@
+name: Publish Test Results
+
+# Takes the artifacts uploaded by run-unit-tests and publishes them in PRs as a comment.
+# This is needed in order to support PRs created from forks, as PRs from Forks or Dependabot
+# run in read-only mode and can't comment on PRs, for example.
+# More context here: https://github.blog/changelog/2021-02-19-github-actions-workflows-triggered-by-dependabot-prs-will-run-with-read-only-permissions/
+# This work-around makes it so that:
+#   - this workflow is triggered by the end of the test workflow, instead
+#     of being triggered directly by the PR
+#   - we can control the permissions to only have what's needed to write comments, etc.
+
+on:
+    workflow_run:
+        workflows: ["Run Unit Tests"]
+        types:
+            - completed
+permissions: {}
+
+jobs:
+    test-results:
+        name: Publish Test Results
+        runs-on: ubuntu-latest
+        if: github.event.workflow_run.conclusion != 'skipped'
+
+        # Limit permissions to only what's needed
+        permissions:
+            checks: write
+
+            # needed to write the PR comment with the results
+            pull-requests: write
+            # required in order to download step to access artifacts API
+            actions: read
+
+        steps:
+            - name: Download and Extract Artifacts
+              uses: dawidd6/action-download-artifact@v2
+              with:
+                  run_id: ${{ github.event.workflow_run.id }}
+                  path: artifacts
+
+            - name: Publish Test Results
+              uses: EnricoMi/publish-unit-test-result-action@v2
+              with:
+                  commit: ${{ github.event.workflow_run.head_sha }}
+                  event_file: artifacts/Upload Event File/event.json
+                  event_name: ${{ github.event.workflow_run.event }}
+                  files: "artifacts/Upload Test Results/**/*.xml"

.github/workflows/semantic-commit-lint.yml

@@ -1,9 +1,12 @@
 name: "Semantic Commit Linting of PR titles"
 
 on:
-  pull_request:
+  pull_request_target:
     types: [ opened, edited, synchronize ]
 
+permissions:
+    pull-requests: read
+
 jobs:
   semantic-commit-pr-title-lint:
     runs-on: ubuntu-latest
@@ -12,15 +15,10 @@ jobs:
       CUSTOM_PR_LABEL: "Fix PR Title or Commit message️"
       HEAD: ${{github.head_ref}}
     steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
-          submodules: recursive # Needed in order to fetch Kalium sources for building
       # Please look up the latest version from
       # https://github.com/amannn/action-semantic-pull-request/releases
       - name: Run Semantic Commint Linter
-        uses: amannn/action-semantic-pull-request@v3.4.6
+        uses: amannn/action-semantic-pull-request@v5.2.0
         with:
           # Configure which types are allowed.
           # Default: https://github.com/commitizen/conventional-commit-types