chore: update-fork-flow

Author: ryanbas21

.github/workflows/ci-fork.yml

@@ -1,17 +1,27 @@
 name: ForgeRock Fork Pull Request CI
+
 on:
-  pull_request_target:
-    types: [opened, synchronize, reopened]
-    branches:
-      - main
+  pull_request:
+
+permissions:
+  contents: read
+  actions: read
+
+concurrency:
+  group: pr-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
 
 jobs:
   pr:
+    # Only run for forks
+    if: ${{ github.event.pull_request.head.repo.full_name != github.repository }}
     runs-on: ubuntu-latest
     timeout-minutes: 20
+
     steps:
       - uses: actions/checkout@v4
         with:
+          # head commit is fine; the default merge ref also works on pull_request
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
 
@@ -20,26 +30,28 @@ jobs:
           run_install: false
 
       - uses: actions/setup-node@v4
-        id: cache
         with:
           node-version-file: '.node-version'
           cache: 'pnpm'
+          cache-dependency-path: '**/pnpm-lock.yaml'
 
       - run: pnpm install --frozen-lockfile
 
-      - name: Cache Playwright browsers
-        uses: actions/cache@v4
+      # Restore-only cache to avoid save attempts/noise on forks
+      - name: Restore Playwright browsers cache
+        uses: actions/cache/restore@v4
         with:
           path: ~/.cache/ms-playwright
           key: ${{ runner.os }}-playwright-${{ hashFiles('**/pnpm-lock.yaml') }}
           restore-keys: |
             ${{ runner.os }}-playwright-
 
-      - run: pnpm exec playwright install
+      - run: pnpm exec playwright install --with-deps
 
       - uses: nrwl/nx-set-shas@v4
-      # This line is needed for nx affected to work when CI is running on a PR
-      - run: git branch --track main origin/main
+
+      # Needed so nx affected can diff against main
+      - run: git branch --track main origin/main || true
 
       - run: pnpm nx format:check
       - run: pnpm nx affected -t build typecheck lint test e2e-ci

.github/workflows/ci.yml

@@ -16,6 +16,7 @@ concurrency:
 
 jobs:
   pr:
+    if: ${{github.event.pull_request.head.repo.full_name == github.repository}}
     runs-on: ubuntu-latest
     timeout-minutes: 20
     permissions:
@@ -37,8 +38,6 @@ jobs:
 
       - run: pnpm install --frozen-lockfile
 
-      # This line enables distribution
-      # The "--stop-agents-after" is optional, but allows idle agents to shut down once the "e2e-ci" targets have been requested
       - run: pnpm dlx nx-cloud start-ci-run --distribute-on=".nx/workflows/dynamic-changesets.yml" --stop-agents-after="e2e-ci" --with-env-vars="CODECOV_TOKEN"
       - run: pnpm nx sync:check
 

e2e/certs/proxy-cert.pem

@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIEQzCCAqugAwIBAgIRAIqd92q/xx9lEhN7RB7ES4wwDQYJKoZIhvcNAQELBQAw
+czEeMBwGA1UEChMVbWtjZXJ0IGRldmVsb3BtZW50IENBMSQwIgYDVQQLDBtyeWFu
+LmJhc21hamlhbkBtYWMtNkdXR1k3VFcxKzApBgNVBAMMIm1rY2VydCByeWFuLmJh
+c21hamlhbkBtYWMtNkdXR1k3VFcwHhcNMjUxMDI0MTQxNDQ1WhcNMjgwMTI0MTUx
+NDQ1WjBPMScwJQYDVQQKEx5ta2NlcnQgZGV2ZWxvcG1lbnQgY2VydGlmaWNhdGUx
+JDAiBgNVBAsMG3J5YW4uYmFzbWFqaWFuQG1hYy02R1dHWTdUVzCCASIwDQYJKoZI
+hvcNAQEBBQADggEPADCCAQoCggEBAMc4NZA7Mw1kSwa4/A3yezY7kKcwdGZ621Ob
+c0uO0nBckuyQRQ2R50NQGjzxGtAZ9rj6o1ebLZN8Q2c93iCiopw9BJGQBS8Gau/N
+dwdvnq/2NpKnLILm8q55hz+9POBiYBZrYD7JxnvDY81I43q9NfXD6VdFTLdBDHQf
+qz+Euf4qy7VFfMoY5eci7CMxY8D0LfwWX+kTg4QMrythqkqdfr7QDL7VbTpr2HSj
+ZogGhQ83vJaH5xG6VnCLITx6GIe4r4vP91IaMXwzotU5f8kCd/KwIYUx0dSxqNT4
+fUMJIgBVz7VNj8SNpq7BfilGE+5c8s9g4mTy24DUTJ6GqPsK2W0CAwEAAaN2MHQw
+DgYDVR0PAQH/BAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMB8GA1UdIwQYMBaA
+FKnpi5lXgRSqB2stvD11zsBPK8UUMCwGA1UdEQQlMCOCCWxvY2FsaG9zdIcEfwAA
+AYcQAAAAAAAAAAAAAAAAAAAAATANBgkqhkiG9w0BAQsFAAOCAYEAiEXgxf2tADpC
+CXQF5d34lEZjhXTWxqpclbrNUSwXVaYEaq40r3wTGrGCHFCpyxscowXBnA3WHEJ+
+oCnN4fj4xVTUEAc7XVM1QKAEtytmqPxle4kzTvvEWF9chDKpYvoCn4X6mBzJLIhG
+36maZIqQv7g9e6TVwUxsTcD9POWVzEQc0xy9JYfJ57qie/9kYy7tk26Nd5/OzRPk
+ILhM4Ta9TUih0rKzwgi48k9uEtHAnuh7XjKdGU1KwcZVZjJFfjUAKXIgLnnQPtwc
+XFoRJnphj+O1mcj0eZBU4nOCl2XImtTzcexi2p11PKHkEJSsDhxuk4hjtd6Fhr5h
+19I/d/evKuxlcxd7AFcKV7THtJyQBiKtJz9cdGrpcQOnZveAek6ILs/2cdP0A7gq
+2TqwmqYGKj0KWwzk70wTsjYKhXNAVwUU8gH3m7UVf3JXvusH4bR5sYosBBSL+s9h
+/58S9O9QRIWwMAkn+V/136aIFibdCP3MatuSPaS+vOo0Cs8Gcx8w
+-----END CERTIFICATE-----

e2e/certs/proxy-key.pem

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDHODWQOzMNZEsG
+uPwN8ns2O5CnMHRmettTm3NLjtJwXJLskEUNkedDUBo88RrQGfa4+qNXmy2TfENn
+Pd4goqKcPQSRkAUvBmrvzXcHb56v9jaSpyyC5vKueYc/vTzgYmAWa2A+ycZ7w2PN
+SON6vTX1w+lXRUy3QQx0H6s/hLn+Ksu1RXzKGOXnIuwjMWPA9C38Fl/pE4OEDK8r
+YapKnX6+0Ay+1W06a9h0o2aIBoUPN7yWh+cRulZwiyE8ehiHuK+Lz/dSGjF8M6LV
+OX/JAnfysCGFMdHUsajU+H1DCSIAVc+1TY/EjaauwX4pRhPuXPLPYOJk8tuA1Eye
+hqj7CtltAgMBAAECggEAMarW182ajcUqW1O1K3j/tOamyrfu3TnWAoMn/HdwCala
+y/Wv8ZElmgeXcwgdSjKe60E5hfbfJvz9BPlMrtA9QDyKLgw87ptn/7825Li0VGRK
++McK9tvDNzJ/QKnaSorcL9q3VRATFvoAoMaCSDByCoK8YxCY7rsd8rmOhTh+8lmi
+WxSH/cQEgnnx4/9J9yisOY1zZ59Hnbq/TeUlU1qB5Ba2InOrvqFz+uO4UBVahxSK
+Ih22S5YXateutfvsUbWkwUT4D9AIywZZtHIUmLI3YD48c7LBgynKqym4fpzToVmG
+QdZ0gAMGQjXRt/ZzAALX7KcCbKLMZoyxHlks+X2F9QKBgQDrK1Ygmmugqxmy4idt
+1I1QSdGTMwCuToiDwvK8WW4OhhsRhT9XCftSAP8fdA9P6Wbr15u1y+ZBmUztqkOv
+2B4rq9XbULyV8l/weQGA135VA+paqg5dKp1Nfa3GoOt6CL/uvqG+t7wjw9+Ow4Oo
+NV0xUHk75GbyAqUnI2JSaXP++wKBgQDY3a6ybyHaGrv9ez4qx8aPclknMWbPTVN1
+BZ+nUYfZaEgFuE/4GhQC9dEBt/vd+spLTnm/KGXXUD7h1hOW/aGG8nw6K3LQBn7H
+vBA+01OojuPpQ5gR0OZvuc5snLyWvsVP4zdJw9QXpoWOuqlyT8poPiplH/8iXMdJ
+yIGO0np8twKBgC8ZwOhKxV+qpT0Euqzus1bvUgBPaMWAiSsKsp8ysi5KgcVikKsY
+HrPv6ykbj62Lq8d0qYUhz343/AZl4aSofnJ0uiJw6zSFFN4O/lQV1QGmBRwfjzzt
+ug+5KkLsG/2XHwnsOG0AU7g+FNp9IjNgbMfhvEZYmp3CFd3e4mRrJoZdAoGAfVjk
+uM3zSxVYw1KQxDlkU1VMopKzUe7n5iOx/Avr8YWM24GE92pbVrqua8fkFJH4iz54
+sDyxYJpJPk92UzeWPWG63ARxADxA20GgQi/zkuHEafdf1ixghQNohO6zMo5hjaNP
+OZuu41ykpbLObfwgidAkwP6VgU8PAV6bQ+n0UlECgYEAggvT3jDTl50PGMOnmnyT
+OWoGikZKF+EVkvXZ5m8/5F+jXOWplUJFYvi+1g76ur5Np219pRZCtSnwExFRR06S
+jtbm9vqzsvL2VLn1nOX2Gf/MBCOFM3QoI2cF77lkx2vMHz0TTXnj5L0drlOvtEvr
+jA5IHSIzxpHi3aogjVjOyvM=
+-----END PRIVATE KEY-----