productionize community-ci workflow (#37404)

Author: alafanechere

.github/actions/airbyte-ci-requirements/action.yml

@@ -10,20 +10,28 @@ inputs:
     description: "Path to airbyte-ci source"
     required: false
     default: airbyte-ci/connectors/pipelines
+  is_fork:
+    description: "Whether the PR is from a fork"
+    required: false
+    default: "false"
 runs:
   using: "composite"
   steps:
     - name: Get changed files
-      uses: tj-actions/changed-files@v39
+      uses: tj-actions/changed-files@v44
+      # When the PR is from a fork, we always install from binary, so we don't need to check for changes
+      if: inputs.is_fork == 'false'
       id: changes
       with:
         files_yaml: |
           pipelines:
             - '${{ inputs.path_to_airbyte_ci_source }}/**'
 
-    - name: Determine how Airbyte CI should be installed
+    - name: "Determine how Airbyte CI should be installed"
       shell: bash
       id: determine-install-mode
+      # When the PR is from a fork, we always install from binary
+      if: inputs.is_fork == 'false'
       run: |
         if [[ "${{ github.ref }}" != "refs/heads/master" ]] && [[ "${{ steps.changes.outputs.pipelines_any_changed }}" == "true" ]]; then
           echo "Making changes to Airbyte CI on a non-master branch. Airbyte-CI will be installed from source."
@@ -34,7 +42,7 @@ runs:
 
     - name: Install Airbyte CI from binary
       id: install-airbyte-ci-binary
-      if: steps.determine-install-mode.outputs.install-mode == 'binary'
+      if: steps.determine-install-mode.outputs.install-mode == 'binary' || ${{ inputs.is_fork }} == 'true'
       shell: bash
       run: |
         curl -sSL ${{ inputs.airbyte_ci_binary_url }} --output airbyte-ci-bin

.github/actions/install-airbyte-ci/action.yml

@@ -34,6 +34,10 @@ inputs:
     description: "GCP credentials for GCP Secret Manager"
     required: false
     default: ""
+  git_repo_url:
+    description: "Git repository URL"
+    default: https://github.com/airbytehq/airbyte.git
+    required: false
   git_branch:
     description: "Git branch to checkout"
     required: false
@@ -79,7 +83,10 @@ inputs:
   python_registry_token:
     description: "Python registry API token to publish python package"
     required: false
-
+  is_fork:
+    description: "Whether the PR is from a fork"
+    required: false
+    default: "false"
 runs:
   using: "composite"
   steps:
@@ -88,16 +95,6 @@ runs:
       shell: bash
       run: echo "name=start-timestamp=$(date +%s)" >> $GITHUB_OUTPUT
 
-    - name: Check if PR is from a fork
-      id: check-if-pr-is-from-fork
-      if: github.event_name == 'pull_request'
-      shell: bash
-      run: |
-        if [ "${{ github.event.pull_request.head.repo.fork }}" == "true" ]; then
-          echo "PR is from a fork. Exiting workflow..."
-          exit 78
-        fi
-
     - name: Docker login
       id: docker-login
       uses: docker/login-action@v3
@@ -110,14 +107,15 @@ runs:
       uses: ./.github/actions/install-airbyte-ci
       with:
         airbyte_ci_binary_url: ${{ inputs.airbyte_ci_binary_url }}
-
+        is_fork: ${{ inputs.is_fork }}
     - name: Run airbyte-ci
       id: run-airbyte-ci
       shell: bash
       run: |
         airbyte-ci --disable-update-check --disable-dagger-run --is-ci --gha-workflow-run-id=${{ github.run_id }} ${{ inputs.subcommand }} ${{ inputs.options }}
       env:
         CI_CONTEXT: "${{ inputs.context }}"
+        CI_GIT_REPO_URL: ${{ inputs.git_repo_url }}
         CI_GIT_BRANCH: ${{ inputs.git_branch || github.head_ref }}
         CI_GIT_REVISION: ${{ inputs.git_revision || github.sha }}
         CI_GITHUB_ACCESS_TOKEN: ${{ inputs.github_token }}

.github/actions/run-airbyte-ci/action.yml

@@ -24,7 +24,7 @@ jobs:
     steps:
       - name: Checkout Airbyte
         if: github.event_name != 'pull_request'
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
       - id: changes
         uses: dorny/paths-filter@v2
         with:
@@ -44,6 +44,7 @@ jobs:
 
   run-tests:
     needs: changes
+    # We only run the Connectors CI job if there are changes to the connectors on a non-forked PR
     if: needs.changes.outputs.internal_poetry_packages == 'true'
     #name: Internal Poetry packages CI
     # To rename in a follow up PR
@@ -53,8 +54,20 @@ jobs:
       pull-requests: read
       statuses: write
     steps:
+      # The run-tests job will be triggered if a fork made changes to the internal poetry packages.
+      # We don't want forks to make changes to the internal poetry packages.
+      # So we fail the job if the PR is from a fork, it will make the required CI check fail.
+      - name: Check if PR is from a fork
+        id: check-if-pr-is-from-fork
+        if: github.event_name == 'pull_request'
+        shell: bash
+        run: |
+          if [ "${{ github.event.pull_request.head.repo.fork }}" == "true" ]; then
+            echo "PR is from a fork. Exiting workflow..."
+            exit 78
+          fi
       - name: Checkout Airbyte
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
           ref: ${{ github.event.pull_request.head.ref }}