fix auth for inst groups not in our infos

.github/workflows/wipac-cicd.yml

@@ -16,7 +16,12 @@ jobs:
     steps:
       - uses: actions/checkout@v3
       - id: versions
-        uses: WIPACrepo/[email protected]
+        uses: WIPACrepo/[email protected]
+
+
+  #############################################################################
+  # LINTERS
+  #############################################################################
 
 
   flake8:
@@ -42,30 +47,63 @@ jobs:
       - uses: WIPACrepo/[email protected]
 
 
+  #############################################################################
+  # PACKAGING
+  #############################################################################
+
+
+  writable-branch-detect:
+    runs-on: ubuntu-latest
+    outputs:
+      OKAY: ${{ steps.detect.outputs.OKAY }}
+    steps:
+      - name: is this a non-dependabot branch?
+        id: detect
+        # dependabot can't access normal secrets
+        #   & don't run non-branch triggers (like tags)
+        #   & we don't want to trigger an update on PR's merge to main/master/default (which is a branch)
+        run: |
+          if [[ \
+              ${{github.actor}} != 'dependabot[bot]' && \
+              ${{github.ref_type}} == 'branch' && \
+              ${{format('refs/heads/{0}', github.event.repository.default_branch)}} != ${{github.ref}} \
+          ]]; then
+            echo "OKAY=true" >> "$GITHUB_OUTPUT"
+            echo "yes, this branch is compatible"
+          else
+            echo "OKAY=false" >> "$GITHUB_OUTPUT"
+            echo "no, this branch is incompatible"
+          fi
+
   py-setup:
+    needs: [ writable-branch-detect ]
     runs-on: ubuntu-latest
     steps:
-      # dependabot can't access normal secrets
-      #   & don't run non-branch triggers (like tags)
-      #   & we don't want to trigger an update on PR's merge to main/master/default (which is a branch)
-      # IOW: only for non-dependabot branches
-      - if: |
-          github.actor != 'dependabot[bot]' &&
-          github.ref_type == 'branch' &&
-          format('refs/heads/{0}', github.event.repository.default_branch) != github.ref
-        name: checkout (only for non-dependabot non-default branches)
+      - if: needs.writable-branch-detect.outputs.OKAY == 'true'
         uses: actions/checkout@v3
         with:
           token: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
-      - if: |
-          github.actor != 'dependabot[bot]' &&
-          github.ref_type == 'branch' &&
-          format('refs/heads/{0}', github.event.repository.default_branch) != github.ref
-        name: wipac-dev-py-setup-action (only for non-dependabot non-default branches)
-        uses: WIPACrepo/[email protected]
+      - if: needs.writable-branch-detect.outputs.OKAY == 'true'
+        uses: WIPACrepo/[email protected]
         with:
           base-keywords: WIPAC IceCube
 
+  py-dependencies:
+    needs: [ writable-branch-detect ]
+    runs-on: ubuntu-latest
+    steps:
+      - if: needs.writable-branch-detect.outputs.OKAY == 'true'
+        uses: actions/checkout@v3
+        with:
+          token: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
+      - if: needs.writable-branch-detect.outputs.OKAY == 'true'
+        uses: WIPACrepo/[email protected]
+
+
+  #############################################################################
+  # TESTS
+  #############################################################################
+
 
   unit-tests:
     needs: [py-versions]
@@ -217,10 +255,15 @@ jobs:
           docker logs "${{ job.services.mongo.id }}" || true
 
 
+  #############################################################################
+  # GITHUB RELEASE
+  #############################################################################
+
+
   release:
     # only run on main/master/default
     if: format('refs/heads/{0}', github.event.repository.default_branch) == github.ref
-    needs: [flake8, mypy, py-setup, unit-tests, integration-tests]
+    needs: [flake8, mypy, py-setup, py-dependencies, unit-tests, integration-tests]
     runs-on: ubuntu-latest
     concurrency: release
     steps:

.gitignore

@@ -141,4 +141,6 @@ client_secrets.json
 # wipac-dev-py-setup-action
 !dependencies*.log
 
-*secret\.json
+*secret\.json
+
+.idea