Use workflow_run instead of pull_request_target

Author: EnricoMi

.github/workflows/ci.yml

@@ -1,14 +1,17 @@
 name: CI
 
-on: [push, pull_request_target]
+on:
+  push:
+    branches:
+      - 'spark-*'
+    tags:
+      - '*'
+  pull_request:
 
 jobs:
   build:
     name: Build
     runs-on: ubuntu-latest
-    if: >
-      github.event_name == 'push' ||
-      github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository
 
     steps:
       - name: Checkout
@@ -43,9 +46,6 @@ jobs:
     name: Unit Tests (Dgraph ${{ matrix.dgraph-version }} and Python ${{ matrix.python-version }})
     runs-on: ubuntu-latest
     needs: build
-    if: >
-      github.event_name == 'push' ||
-      github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository
 
     strategy:
       fail-fast: false
@@ -128,7 +128,11 @@ jobs:
     needs: test
 
     runs-on: ubuntu-latest
-    if: success() || failure()
+    # the workflow is useless on pull_request events from fork repositories
+    # as it can not create check runs or pull request comments
+    if: >
+      ( success() || failure() ) &&
+      ( github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository )
 
     steps:
       - name: Download Artifacts
@@ -137,20 +141,17 @@ jobs:
           path: artifacts
 
       - name: Publish Unit Test Results
-        uses: docker://ghcr.io/enricomi/publish-unit-test-result-action:latest
+        uses: docker://ghcr.io/enricomi/publish-unit-test-result-action:v1
         with:
-          check_name: Unit Test Results
-          github_token: ${{ secrets.GITHUB_TOKEN }}
+          github_token: ${{ github.token }}
           files: "artifacts/Unit Test Results*/**/*.xml"
+          comment_on_pr: ${{ github.event_name != 'push' }}
           log_level: DEBUG
 
   integration:
     name: Integration Tests (Dgraph ${{ matrix.dgraph-version }})
     runs-on: ubuntu-latest
     needs: build
-    if: >
-      github.event_name == 'push' ||
-      github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository
 
     strategy:
       fail-fast: false

.github/workflows/fork.yml

@@ -0,0 +1,52 @@
+name: Fork
+
+on:
+  workflow_run:
+    workflows: ["CI"]
+    types:
+      - completed
+
+jobs:
+  unit-test-results:
+    name: Unit Test Results from Fork
+    runs-on: ubuntu-latest
+    if: >
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.conclusion != 'skipped' &&
+      github.event.workflow_run.head_repository.full_name != github.repository
+
+    steps:
+      - name: Download Artifacts
+        uses: actions/github-script@v3.1.0
+        with:
+          script: |
+            var artifacts = await github.actions.listWorkflowRunArtifacts({
+               owner: context.repo.owner,
+               repo: context.repo.repo,
+               run_id: ${{ github.event.workflow_run.id }},
+            });
+            for (const artifact of artifacts.data.artifacts) {
+               var download = await github.actions.downloadArtifact({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  artifact_id: artifact.id,
+                  archive_format: 'zip',
+               });
+               var fs = require('fs');
+               fs.writeFileSync(`${{github.workspace}}/artifact-${artifact.id}.zip`, Buffer.from(download.data));
+            }
+      - name: Extract Artifacts
+        run: |
+          for file in artifact-*.zip
+          do
+            dir="${file/%.zip/}"
+            mkdir -p "$dir"
+            unzip -d "$dir" "$file"
+          done
+
+      - name: Unit Test Results
+        uses: docker://ghcr.io/enricomi/publish-unit-test-result-action:v1
+        with:
+          github_token: ${{ github.token }}
+          commit: ${{ github.event.workflow_run.head_sha }}
+          files: "**/*.xml"