build: skip GitHub action steps the require write perms on external PRs

... so that checks can pass when people submit external PRs to the repo.

.github/workflows/build-core.yml

@@ -39,36 +39,39 @@ jobs:
       # Test results report
       - name: Report test results
         uses: dorny/test-reporter@v1
-        if: success() || failure()
+        if: >
+          (success() || failure()) &&
+          (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
         with:
           name: Mocha tests
           path: test-results.json
           reporter: mocha-json
 
       - name: Report code coverage
-        if: ${{ github.event_name == 'pull_request' }}
+        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
         uses: romeovs/[email protected]
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           lcov-file: ./coverage/lcov.info
 
       - name: Check code coverage threshold
         uses: VeryGoodOpenSource/very_good_coverage@v2
+        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
         with:
           path: ./coverage/lcov.info
           min_coverage: 50
 
       # Build and push container image to GCR (only on main branch)
       - name: Log in to the GitHub Container Registry
-        if: ${{ github.ref == 'refs/heads/main' }}
+        if: github.ref == 'refs/heads/main'
         uses: docker/login-action@v1
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push container image to GitHub Container Registry
-        if: ${{ github.ref == 'refs/heads/main' }}
+        if: github.ref == 'refs/heads/main'
         uses: docker/build-push-action@v3
         with:
           push: true
@@ -78,17 +81,18 @@ jobs:
 
       # Build and push container image to ECR
       - name: Configure AWS credentials
+        if: github.event_name != 'pull_request'
         uses: aws-actions/configure-aws-credentials@v2
         with:
           role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ secrets.AWS_BUILD_INVOCATION_ROLE }}
           aws-region: ${{ secrets.AWS_REGION }}
 
       - name: Login to ECR
-        if: ${{ github.ref == 'refs/heads/develop' }}
+        if: github.ref == 'refs/heads/develop'
         uses: aws-actions/amazon-ecr-login@v1
 
       - name: Push image ECR
-        if: ${{ github.ref == 'refs/heads/develop' }}
+        if: github.ref == 'refs/heads/develop'
         uses: docker/build-push-action@v3
         with:
           labels: |
@@ -100,22 +104,22 @@ jobs:
 
       # Start CodePipeline to test image
       - name: Start CodePipeline
-        if: ${{ github.ref == 'refs/heads/develop' }}
+        if: github.ref == 'refs/heads/develop'
         run: |
           aws codepipeline start-pipeline-execution \
             --name ${{ secrets.AWS_CODEPIPELINE_NAME }}
 
       # Success notification
       - name: Send Slack success notification
-        if: success()
+        if: success() && github.event_name != 'pull_request'
         env:
           SLACK_TITLE: Build succeeded!
           SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
         uses: rtCamp/action-slack-notify@v2
 
       # Failure notification
       - name: Send Slack failure notification
-        if: failure()
+        if: failure() && github.event_name != 'pull_request'
         env:
           SLACK_TITLE: Build failed!
           SLACK_COLOR: danger