Pull Request Checks fail for the Che-Code when a PR is created from a fork

[RomanNikitenko]

Describe the bug

I've created a pull request to the Che-Code from a fork.
The Pull Request Check - Dev job fails on the Login to Quay.io step.
See https://github.com/che-incubator/che-code/actions/runs/6794116398/job/18470022496?pr=292

Che version

7.75@latest

Steps to reproduce

1. Create a pull request to the Che-Code from a fork.
2. See the corresponding job

Expected behavior

Login to Quay.io step should be successful for the Pull Request Check - Dev job

Additional context

I'm not sure, but maybe the cause of the problem came from the recently merged PR che-incubator/che-code#253

@vitaliy-guliy
could you take a look?

[vitaliy-guliy]

I do not know how it was working till yesterday, but as it described in the article below, ' secrets are not passed to the runner when a workflow is triggered from a forked repository.'

https://docs.github.com/en/actions/security-guides/using-secrets-in-github-actions#using-secrets-in-a-workflow

[RomanNikitenko]

I do not know how it was working till yesterday

could you try to revert your changes and check it?

[vitaliy-guliy]

I see there is only way is specify a separate job to push images like it was before
https://github.com/che-incubator/che-code/blob/7.76.0/.github/workflows/pr-check-image-publish.yml

[azatsarynnyy]

I see there is only way is specify a separate job to push images like it was before https://github.com/che-incubator/che-code/blob/7.76.0/.github/workflows/pr-check-image-publish.yml

yes, we should separate the jobs for building and publishing Che-Code test images:

• In the Workflow that is triggered on: [pull_request], we should run the build jobs only. It allows running it on the PRs opened from the forked repos.
• In the Workflow that is triggered on completing the previous ^^ one, we can push the images to quay. Such a job will fail on a PR opened from a fork, but it will not block the PR from merging as such a job is not a required PR status check.

As it's clearer now 🙂 why we used to have two GH Workflows instead of a single one, I suggest returning to the state of Che-Code GH Workflows that we had before merging che-incubator/che-code@6d47882 with adding some comments why there's a separate Workflow for pushing the images.

[vitaliy-guliy]

I suggest returning to the state of Che-Code GH Workflows that we had before merging che-incubator/che-code@6d47882 with adding some comments why there's a separate Workflow for pushing the images.

What is the point if it does not fix building and pushing che-dev image for pull requests, that were made from a fork?
Che-dev image appeared to be large (more than 2.5 gigabytes) to be used in artifacts to share the images between jobs.

[azatsarynnyy]

Che-dev image appeared to be large (more than 2.5 gigabytes) to be used in artifacts to share the images between jobs.

@vitaliy-guliy doesn't this step fix the problem?
I don't know for sure, but I suppose it may help.

[vitaliy-guliy]

Che-dev image appeared to be large (more than 2.5 gigabytes) to be used in artifacts to share the images between jobs.

@vitaliy-guliy doesn't this step fix the problem? I don't know for sure, but I suppose it may help.

It increases only the swap file size.
We do not need it as it is possible to build the images without touching the swap.

[vitaliy-guliy]

A pull request fixing the problem has been merged