check-execution-context.yaml

name: Check execution context

on:
  workflow_call:
    outputs:
      continue:
        description: Whether futher jobs should contine
        value: ${{ jobs.check-execution-context.outputs.continue }}
      forked_pr:
        description: Whether the event is operating from a forked PR
        value: ${{ jobs.check-execution-context.outputs.forked_pr }}

defaults:
  run:
    shell: bash

jobs:
  check-execution-context:
    name: Check execution context
    runs-on: ubuntu-latest

    permissions:
      # Required to clone repo
      contents: read
      # pull-requests: write

    steps:
      - name: Check event type
        run: echo "continue=${{ github.event_name == 'workflow_dispatch' || github.event.pull_request.head.repo.fork == (github.event_name == 'pull_request_target') }}" >> $GITHUB_ENV
      
      - name: Check PR labels if forked
        if: fromJSON(env.continue) && github.event.pull_request.head.repo.fork == true && !contains(github.event.pull_request.labels.*.name, 'safe to test')
        run: |
          echo "::error::This PR was created from a fork and requires the 'safe to test' label to run this check."
          exit 1

      # - name: Remove label
      #   uses: actions-ecosystem/action-remove-labels@v1
      #   with:
      #     labels: 'safe to test'
      
      - name: Set forked PR flag
        if: fromJSON(env.continue)
        run: echo "forked_pr=${{ github.event.pull_request.head.repo.fork == true }}" >> $GITHUB_ENV

    outputs:
      continue: ${{ env.continue }}
      forked_pr: ${{ env.forked_pr }}