ci: fix fork checks (#23894)

Signed-off-by: Marc 'risson' Schmitt <marc.schmitt@risson.space>

.github/workflows/_reusable-container-build-single.yml

@@ -53,6 +53,10 @@ jobs:
       image-digest: "${{ steps.build.outputs.digest }}"
       artifact-id: "${{ steps.upload.outputs.artifact-id }}"
     steps:
+      - name: Make space on disk
+        run: |
+          sudo mkdir -p /tmp/empty/
+          sudo rsync -a --delete /tmp/empty/ /usr/local/lib/android/
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v5
         with:
           ref: "${{ inputs.ref }}"

.github/workflows/ci-docs.yml

@@ -111,7 +111,7 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
       - name: Login to Container Registry
-        if: ${{ github.repository == 'goauthentik/authentik' }}
+        if: "${{ github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) }}"
         uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ghcr.io
@@ -124,8 +124,8 @@ jobs:
           context: .
           platforms: linux/amd64,linux/arm64
           cache-from: type=registry,ref=ghcr.io/goauthentik/dev-docs:buildcache
-          cache-to: "${{ github.repository == 'goauthentik/authentik' && 'type=registry,ref=ghcr.io/goauthentik/dev-docs:buildcache,mode=max' || '' }}"
-          push: "${{ github.repository != 'goauthentik/authentik' }}"
+          cache-to: "${{ (github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository)) && 'type=registry,ref=ghcr.io/goauthentik/dev-docs:buildcache,mode=max' || '' }}"
+          push: "${{ github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) }}"
           tags: |
             ghcr.io/goauthentik/dev-docs:gh-${{ steps.compute-tags.outputs.tag-full }}
             ghcr.io/goauthentik/dev-docs:gh-${{ steps.compute-tags.outputs.tag-branch }}

.github/workflows/ci-main.yml

@@ -65,7 +65,7 @@ jobs:
       image-dockerfile: "lifecycle/container/${{ matrix.dockerfile }}"
       image-build-args: |
         GIT_BUILD_HASH=${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
-      should-cache: "${{ github.repository == 'goauthentik/authentik' }}"
+      should-cache: "${{ github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) }}"
       cache-suffix: "-${{ needs.build-compute-tags.outputs.safe-branch-name }}"
   lint:
     strategy:
@@ -313,6 +313,7 @@ jobs:
         run: |
           for image in proxy ldap radius rac; do
             skopeo copy "oci-archive:container/${image}-amd64.oci.tar" "docker-daemon:ghcr.io/goauthentik/dev-${image}:${{ needs.build-compute-tags.outputs.tag-full }}"
+            skopeo copy "oci-archive:container/${image}-amd64.oci.tar" "docker-daemon:ghcr.io/goauthentik/dev-${image}:${{ needs.build-compute-tags.outputs.tag-branch }}"
           done
           rm -rf container/
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v5
@@ -458,7 +459,7 @@ jobs:
         with:
           jobs: ${{ toJSON(needs) }}
   publish:
-    if: "${{ github.repository == 'goauthentik/authentik' }}"
+    if: "${{ github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) }}"
     needs:
       - build-compute-tags
       - build
@@ -509,7 +510,7 @@ jobs:
           subject-digest: "${{ steps.publish.outputs.digest }}"
           push-to-registry: true
   pr-comment:
-    if: "${{ github.repository == 'goauthentik/authentik' && github.event_name == 'pull_request' }}"
+    if: "${{ github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) }}"
     needs:
       - build-compute-tags
       - publish

.github/workflows/gen-image-compress.yml

@@ -16,17 +16,13 @@ on:
       - "**.jpeg"
       - "**.png"
       - "**.webp"
-  workflow_dispatch:
 
 jobs:
   compress:
     name: compress
     runs-on: ubuntu-latest
     # Don't run on forks. Token will not be available. Will run on main and open a PR anyway
-    if: |
-      github.repository == 'goauthentik/authentik' &&
-      (github.event_name != 'pull_request' ||
-       github.event.pull_request.head.repo.full_name == github.repository)
+    if: "${{ github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) }}"
     steps:
       - id: generate_token
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v2

authentik/root/test_runner.py

@@ -1,6 +1,7 @@
 """Integrate ./manage.py test with pytest"""
 
 import os
+import re
 from argparse import ArgumentParser
 from unittest import TestCase
 from unittest.mock import patch
@@ -30,7 +31,7 @@ def get_docker_tag() -> str:
     branch_name = os.environ.get(default_branch, "main")
     if os.environ.get(env_pr_branch, "") != "":
         branch_name = os.environ[env_pr_branch]
-    branch_name = branch_name.replace("refs/heads/", "").replace("/", "-").replace("'", "-")
+    branch_name = re.sub(r"[^a-zA-Z0-9-]", "-", branch_name.replace("refs/heads/", ""))
     return f"gh-{branch_name}"