PRs from forks are not running GitHub Actions properly

[kimadactyl]

Description

2 new contributors have done PRs from forks and GitHub isn't loading properly. The below action just never starts. A Google I did before hinted this is something to do with our key config, but leaving here for further investigation.

Promising stackoverflow answer here: https://stackoverflow.com/a/69169858

Motivation

We want to have people contribute to the repo without needing to add them into our org.

[kimadactyl]

It could also be this (which isn't showing up) - hmm https://docs.github.com/en/actions/managing-workflow-runs-and-deployments/managing-workflow-runs/approving-workflow-runs-from-public-forks

[kimadactyl]

@erbridge / @pedantic-git - not sure if you can shed any light on this im feeling very out my depth

[pedantic-git]

Here's my guess:

Currently your workflow is set to on push. A PR in a fork never pushes to your repo so the workflow is never activated. I think you need to add that pull_request_target but I'm not sure if that will cause double-activation for PRs in your own repo.

Afaik there's no way for forks to kick off workflows automatically (because an attacker could fork your repo just to use up all your GHA minutes) but hopefully changing that will at least cause the approval button to appear.

[JessFairbairn]

This SO answer suggests maybe using pull_request rather than pull_request_target unless it's necessary for accessing keys. As only the deploy steps need secrets maybe that's unnecessary?

#2685 experimented with a pull request here