Actions: Securely run test workflows on forks (PROTOTYPE - do not merge)

[kyleecodes]

Resolves #enter-issue-number

N/A

What changes did you make and why did you make them?

Previously, the build-and-test workflow was triggered by the pull_request event trigger, but this does not grant secrets access to forks, which is necessary to run unit tests. The inverse is true for pull_request_target, except that it's ineffective and misleading, as it tests our develop branch without an explicit code ref checkout. Explicit checkouts with pull_request_target are strongly discouraged and goes against it's use-cases.
Given the security steps we've already taken, including the approval step and testing secrets auditing, we decided to keep the workflow and grant access to secrets on forks. For increased security, I implemented an auto-labeler to automatically label any forked PRs making changes to sensitive files (such as scripts, package.json, workflows, etc) to circumvent human error. This PR fixes our build and test workflows for forks, effectively prevents prebuild jobs without proper permissions, and adds a layer of protection against human error in PR reviews.

To-Do:

• Test & audit in GH org environment
• Implement correct dependency flow with workflow_run
• Exclude i18n and other non-config .json files in labeler config
• Add label for no sensitive files found

Actions Changelog:

• labeler.yml: config for the labeler workflow, determines sensitive files.
• community-label-forked-prs: labels forked pull requests with 'needs-file-review` if sensitive files detected.
• build-and-test-prs: updated to exit if the triggering PR is a fork, to avoid the dependency installs on forks.
• build-and-test-forks runs workflow on forks only, exiting before build if sensitive file label is detected. This can be manually removed by staff after reviewing the files.
• Pins third-party commits to SHA
• Auto-assign dependabot PRs
• More succinct pull request template

Resources:

• https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions
• https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/
• https://securitylab.github.com/resources/github-actions-untrusted-input/
• https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows

Did you run tests? Share screenshot of results:

How did you find us? (GitHub, Google search, social media, etc.):

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
bloom-frontend	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Feb 17, 2025 9:08pm