meta: run e2e workflow on the head branch instead of the base one (#3561)

Refs: https://securitylab.github.com/research/github-actions-preventing-pwn-requests/

.github/workflows/e2e.yml

@@ -0,0 +1,72 @@
+name: End-to-end tests
+on:
+  push:
+    branches: [ main ]
+  pull_request_target:
+    types: [ opened, synchronize, reopened, labeled ]
+
+concurrency: ${{ github.workflow }}--${{ github.ref }}
+
+jobs:
+  e2e:
+    if: ${{ !github.event.pull_request || (contains(github.event.pull_request.labels.*.name, 'safe to test') && github.event.pull_request.state == 'open') || (github.event.pull_request.head.repo.full_name == github.repository && github.event.event_name != 'labeled') }}
+    name: Browser tests
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout sources
+        uses: actions/checkout@v2
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+      - name: Get yarn cache directory path
+        id: yarn-cache-dir-path
+        run: echo "::set-output name=dir::$(corepack yarn config get cacheFolder)"
+
+      - uses: actions/cache@v2
+        id: yarn-cache # use this to check for `cache-hit` (`steps.yarn-cache.outputs.cache-hit != 'true'`)
+        with:
+          path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
+          key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-yarn-
+      - name: Install Node.js
+        uses: actions/setup-node@v2
+        with:
+          node-version: 16.x
+      - name: Install dependencies
+        run: corepack yarn install --immutable
+      - name: Build Uppy packages
+        run: corepack yarn build
+      - name: Run end-to-end browser tests
+        run: corepack yarn run e2e:ci
+        env:
+          COMPANION_UNSPLASH_KEY: ${{secrets.COMPANION_UNSPLASH_KEY}}
+          COMPANION_UNSPLASH_SECRET: ${{secrets.COMPANION_UNSPLASH_SECRET}}
+          VITE_TRANSLOADIT_KEY: ${{secrets.TRANSLOADIT_KEY}}
+          VITE_TRANSLOADIT_TEMPLATE: ${{secrets.TRANSLOADIT_TEMPLATE}}
+          VITE_TRANSLOADIT_SERVICE_URL: ${{secrets.TRANSLOADIT_SERVICE_URL}}
+      - name: Remove 'pending end-to-end tests' label
+        # Remove the 'pending end-to-end tests' label if tests ran successfully
+        if: github.event.pull_request && contains(github.event.pull_request.labels.*.name, 'pending end-to-end tests')
+        run: gh pr edit "$NUMBER" --remove-label 'pending end-to-end tests'
+        env:
+          NUMBER: ${{ github.event.pull_request.number }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Remove 'safe to test' label
+        # Remove the 'safe to test' label to ensure next commit needs approval before re-running this.
+        if: always() && github.event.pull_request && contains(github.event.pull_request.labels.*.name, 'safe to test')
+        run: gh pr edit "$NUMBER" --remove-label 'safe to test'
+        env:
+          NUMBER: ${{ github.event.pull_request.number }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  add-pending-e2e-label:
+    # Add the 'pending end-to-end tests' label for PRs that come from forks.
+    # For those PRs, we want to review the code before running e2e tests.
+    # See https://securitylab.github.com/research/github-actions-preventing-pwn-requests/.
+    if: github.event.pull_request.state == 'open' && github.event.pull_request.head.repo.full_name != github.repository && !contains(github.event.pull_request.labels.*.name, 'safe to test') && !contains(github.event.pull_request.labels.*.name, 'pending end-to-end tests')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Add label
+        env:
+          NUMBER: ${{ github.event.pull_request.number }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh pr edit "$NUMBER" --repo ${{ github.repository }} --add-label 'pending end-to-end tests'

.github/workflows/end-to-end.yml

@@ -1,46 +0,0 @@
-name: End-to-end tests
-on:
-  push:
-    branches: [ main ]
-  pull_request_target:
-    # We want all branches so we configure types to be the GH default again
-    types: [ opened, synchronize, reopened ]
-
-jobs:
-  e2e:
-    name: Browser tests
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout sources
-        uses: actions/checkout@v2
-        with:
-          # Necessary for yarn version plugin
-          # https://yarnpkg.com/features/release-workflow#commit-history
-          fetch-depth: 0
-      - name: Get yarn cache directory path
-        id: yarn-cache-dir-path
-        run: echo "::set-output name=dir::$(corepack yarn config get cacheFolder)"
-
-      - uses: actions/cache@v2
-        id: yarn-cache # use this to check for `cache-hit` (`steps.yarn-cache.outputs.cache-hit != 'true'`)
-        with:
-          path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
-          key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-yarn-
-      - name: Install Node.js
-        uses: actions/setup-node@v2
-        with:
-          node-version: 16.x
-      - name: Install dependencies
-        run: corepack yarn install --immutable
-      - name: Build Uppy packages
-        run: corepack yarn build
-      - name: Run end-to-end browser tests
-        run: corepack yarn run e2e:ci
-        env:
-          COMPANION_UNSPLASH_KEY: ${{secrets.COMPANION_UNSPLASH_KEY}}
-          COMPANION_UNSPLASH_SECRET: ${{secrets.COMPANION_UNSPLASH_SECRET}}
-          VITE_TRANSLOADIT_KEY: ${{secrets.TRANSLOADIT_KEY}}
-          VITE_TRANSLOADIT_TEMPLATE: ${{secrets.TRANSLOADIT_TEMPLATE}}
-          VITE_TRANSLOADIT_SERVICE_URL: ${{secrets.TRANSLOADIT_SERVICE_URL}}