From 59da52854a95fc4beaffbc1fa6bbe19d052a1c51 Mon Sep 17 00:00:00 2001
From: Jalil Arfaoui <jalil@arfaoui.net>
Date: Tue, 16 Jul 2024 17:01:30 +0200
Subject: [PATCH] =?UTF-8?q?ci:=20limit=20CI=20from=20fork=20to=20jobs=20th?=
 =?UTF-8?q?at=20don=E2=80=99t=20depend=20en=20secrets?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/add-a11y-checklist.yaml |  2 +-
 .github/workflows/deploy.yaml             | 12 +++++++-----
 .github/workflows/test.yaml               |  2 +-
 3 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/add-a11y-checklist.yaml b/.github/workflows/add-a11y-checklist.yaml
index 3b9b07d2c..638c1b461 100644
--- a/.github/workflows/add-a11y-checklist.yaml
+++ b/.github/workflows/add-a11y-checklist.yaml
@@ -25,7 +25,7 @@ jobs:
           comment-author: 'github-actions[bot]'
           body-includes: accessibilité
       - name: Create comment
-        if: steps.changed-files-specific.outputs.any_changed == 'true' && steps.find-comment.outputs.comment-id == ''
+        if: github.event.pull_request.head.repo.full_name == github.repository && steps.changed-files-specific.outputs.any_changed == 'true' && steps.find-comment.outputs.comment-id == ''
         uses: peter-evans/create-or-update-comment@v3
         with:
           issue-number: ${{ github.event.pull_request.number }}
diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml
index e00e66ca9..a72bad578 100644
--- a/.github/workflows/deploy.yaml
+++ b/.github/workflows/deploy.yaml
@@ -18,6 +18,7 @@ on:
 
 jobs:
   deploy-context:
+    if: github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-22.04
     outputs:
       env-name: ${{ steps.deploy-env.outputs.name }}
@@ -37,6 +38,7 @@ jobs:
 
   build:
     needs: deploy-context
+    if: github.event.pull_request.head.repo.full_name == github.repository
     env:
       API_BASE_URL: ${{ needs.deploy-context.outputs.api_url }}
       SERVER_BASE_URL: ${{ needs.deploy-context.outputs.server_url }}
@@ -138,7 +140,7 @@ jobs:
   deploy-preview:
     needs: [build, build-storybook, deploy-context]
     runs-on: ubuntu-22.04
-    if: needs.deploy-context.outputs.env-name != 'master'
+    if: github.event.pull_request.head.repo.full_name == github.repository && needs.deploy-context.outputs.env-name != 'master'
     strategy:
       matrix:
         site: ['', 'en']
@@ -175,7 +177,7 @@ jobs:
   deploy-prod:
     needs: [build, build-storybook, deploy-context]
     runs-on: ubuntu-22.04
-    if: needs.deploy-context.outputs.env-name == 'master'
+    if: github.event.pull_request.head.repo.full_name == github.repository && needs.deploy-context.outputs.env-name == 'master'
     steps:
       - uses: actions/checkout@v3
       - uses: actions/download-artifact@v3
@@ -204,7 +206,7 @@ jobs:
 
   post-comment:
     runs-on: ubuntu-22.04
-    if: github.event_name == 'pull_request'
+    if: github.event.pull_request.head.repo.full_name == github.repository && github.event_name == 'pull_request'
     needs: [deploy-preview, deploy-context]
     steps:
       - name: Find Comment
@@ -235,7 +237,7 @@ jobs:
     runs-on: ubuntu-22.04
     container: cypress/browsers:latest
     # We need to specify always() https://github.com/actions/runner/issues/491
-    if: always() && needs.deploy-preview.result == 'success'
+    if: always() && github.event.pull_request.head.repo.full_name == github.repository && needs.deploy-preview.result == 'success'
     needs: [deploy-context, deploy-preview]
 
     strategy:
@@ -306,7 +308,7 @@ jobs:
     runs-on: ubuntu-22.04
     container: cypress/browsers:latest
     # We need to specify always() https://github.com/actions/runner/issues/491
-    if: always() && needs.deploy-prod.result == 'success'
+    if: always() && github.event.pull_request.head.repo.full_name == github.repository && needs.deploy-prod.result == 'success'
     needs: [deploy-context, deploy-prod]
 
     strategy:
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 499ff9278..d683c937a 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -1,5 +1,5 @@
 name: Tests
-on: push
+on: ['push', 'pull_request']
 
 jobs:
   lint: