Test images are not generated when a pull request originates from a fork

[SirLouen]

Builds are failing here

wpdev-docker-images/templates/workflow.yml-template

Line 98 in aad6cbb

echo "$REGISTRY_PASSWORD" | docker login "$PACKAGE_REGISTRY_HOST" -u "$REGISTRY_USERNAME" --password-stdin

Maybe it would be better to use the login-action instead of the CLI docker login

https://docs.github.com/en/packages/managing-github-packages-using-github-actions-workflows/publishing-and-installing-a-package-with-github-actions#publishing-a-package-using-an-action

[desrosj]

This is currently expected behavior.

Currently, only branches that belong to the repository are allowed to build and publish containers for security reasons.

That said, I've been discussing with @johnbillion recently, and I think it is beneficial to change this to enable community members that are not able to push directly to this repository to contribute.

It's likely safe to adjust the workflows to allow all pull requests to publish images to the GitHub container registry only because:

• These images are only intended to be used for testing purposes to ensure changes to the generated images in pull requests work as expected.
• The labels always have the pull request number appended to them (ie. php:8.3-fpm-123) and never published without those.
• While containers are available indefinitely, they can be deleted programmatically. So a workflow can be added to delete these after a pull request is merged to avoid confusion.

Even if we are willing to make these concessions, it should still be documented properly, and it needs to be done carefully as to not expose any secrets or sensitive data in the process.

[SirLouen]

Even if we are willing to make these concessions, it should still be documented properly, and it needs to be done carefully as to not expose any secrets or sensitive data in the process.

Definitely, it would be a great enhancement.

[SirLouen]

@desrosj I've been thinking that for how these are being made, they completely hinder contributions, as any non-committer can really pass those tests. Maybe the build tests should be made optional? After all, they are not truly testing anything but just a support step.