fix: add id-token to workflows (#4063)

* feat: support testing on forked repos

* add pull_request to test on PR

* remove prod suffix

* decode json on matrix paths

* add experimental to check names

* add experimental to job names

* run test only if paths is not empty

* test explicitly against empty array

* move experimental as a prefix

* success check if no paths are found

* always set check to done

* remove pull_request trigger

* rearrange if check

* add more comments

* fix: add id-token to workflows

Author: David Cavazos

.github/workflows/custard-run-dev.yaml

@@ -61,6 +61,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 120 # 2 hours hard limit
     permissions:
+      id-token: write
       statuses: write
     strategy:
       fail-fast: false
@@ -108,13 +109,6 @@ jobs:
         with:
           check: ${{ steps.in_progress.outputs.check }}
           status: failure
-      # - name: Upload test results for FlakyBot workflow
-      #   if: github.event.action == 'schedule' && always() # always() submits logs even if tests fail
-      #   uses: actions/upload-artifact@v4
-      #   with:
-      #     name: test-results
-      #     path: ${{ matrix.path }}/${{ github.run_id }}_sponge_log.xml
-      #     retention-days: 1
 
   done:
     needs: [affected, test]

.github/workflows/custard-run.yaml

@@ -105,6 +105,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 120 # 2 hours hard limit
     permissions:
+      id-token: write
       statuses: write
     strategy:
       fail-fast: false
@@ -152,13 +153,6 @@ jobs:
         with:
           check: ${{ steps.in_progress.outputs.check }}
           status: failure
-      # - name: Upload test results for FlakyBot workflow
-      #   if: github.event.action == 'schedule' && always() # always() submits logs even if tests fail
-      #   uses: actions/upload-artifact@v4
-      #   with:
-      #     name: test-results
-      #     path: ${{ matrix.path }}/${{ github.run_id }}_sponge_log.xml
-      #     retention-days: 1
 
   done:
     needs: [affected, lint, test]