Merge pull request #1746 from cfengine/ENT-13038/3.24

Restrict workflow runs to cfengine organization pull requests (3.24)

Author: craigcomstock

.github/workflows/build-using-buildscripts.yml

@@ -31,6 +31,18 @@ jobs:
         with:
           myToken: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Checkout Buildscripts
+        uses: actions/checkout@v3
+        with:
+          repository: cfengine/buildscripts
+          path: buildscripts
+          fetch-depth: 20
+
+      - name: Get base ref
+# we use on:push in ../ci.yml when calling this workflow and that event does not include github.base_ref so we must calculate it here in case
+        run: |
+          git rev-parse --abbrev-ref @{upstream}
+
       - name: Checkout Core
         uses: actions/checkout@v3
         with:
@@ -46,12 +58,6 @@ jobs:
           path: masterfiles
           ref: ${{steps.together.outputs.masterfiles || github.base_ref}}
 
-      - name: Checkout Buildscripts (current project)
-        uses: actions/checkout@v3
-        with:
-          path: buildscripts
-          fetch-depth: 20
-
       - name: Checkout Nova
         uses: actions/checkout@v3
         with:

.github/workflows/ci.yml

@@ -1,11 +1,11 @@
 name: Continuous Integration
 
-# Run this CI on all pushes to upstream
-# (including PRs from upstream to upstream)
-on: push
+on: pull_request
 
 jobs:
   build_cfengine_hub_package:
+    # this job only works when submitted from the cfengine organization aka upstream to upstream pull requests: ENT-13038
+    if: github.event.organization.login == 'cfengine'
     uses: ./.github/workflows/build-using-buildscripts.yml
     secrets: inherit