chore(ci): allow fork to access secrets

Author: millotp

.github/workflows/check.yml

@@ -21,11 +21,13 @@ jobs:
   notification:
     runs-on: ubuntu-22.04
     timeout-minutes: 1
-    if: ${{ !github.event.pull_request.head.repo.fork && github.event.number }}
+    if: ${{ github.event.number }}
     permissions:
       pull-requests: write
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }} # WARNING: this gives fork PR access to the github secrets
 
       - uses: marocchino/sticky-pull-request-comment@v2
         with:
@@ -192,6 +194,8 @@ jobs:
     name: client javascript${{ needs.setup.outputs.RUN_GEN_JAVASCRIPT == 'true' && format('@{0}', fromJSON(needs.setup.outputs.JAVASCRIPT_DATA).version) || '' }}
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }} # WARNING: this gives fork PR access to the github secrets
 
       - name: Download specs artifacts
         uses: ./scripts/ci/actions/restore-artifacts
@@ -265,11 +269,11 @@ jobs:
       - name: Run e2e CTS
         id: cts-e2e
         continue-on-error: true
-        if: ${{ !github.event.pull_request.head.repo.fork && !contains(format('{0} {1}', github.event.pull_request.title, github.event.head_commit.message), '[skip-e2e]') }}
+        if: ${{ !contains(format('{0} {1}', github.event.pull_request.title, github.event.head_commit.message), '[skip-e2e]') }}
         run: yarn cli cts run javascript ${{ fromJSON(needs.setup.outputs.JAVASCRIPT_DATA).toRun }} --no-client --no-requests
 
       - name: Retry e2e CTS
-        if: ${{ !github.event.pull_request.head.repo.fork && steps.cts-e2e.outcome == 'failure' }}
+        if: ${{ steps.cts-e2e.outcome == 'failure' }}
         run: yarn cli cts run javascript ${{ fromJSON(needs.setup.outputs.JAVASCRIPT_DATA).toRun }} --no-client --no-requests
 
       - name: Run benchmarks
@@ -319,6 +323,8 @@ jobs:
     name: client ${{ matrix.client.language }}@${{ matrix.client.version }}
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }} # WARNING: this gives fork PR access to the github secrets
 
       - name: Download specs artifacts
         uses: ./scripts/ci/actions/restore-artifacts
@@ -379,11 +385,11 @@ jobs:
       - name: Run e2e CTS
         id: cts-e2e
         continue-on-error: true
-        if: ${{ !github.event.pull_request.head.repo.fork && !contains(format('{0} {1}', github.event.pull_request.title, github.event.head_commit.message), '[skip-e2e]') }}
+        if: ${{ !contains(format('{0} {1}', github.event.pull_request.title, github.event.head_commit.message), '[skip-e2e]') }}
         run: yarn cli cts run ${{ matrix.client.language }} ${{ matrix.client.toRun }} --no-client --no-requests
 
       - name: Retry e2e CTS
-        if: ${{ !github.event.pull_request.head.repo.fork && steps.cts-e2e.outcome == 'failure' }}
+        if: ${{ steps.cts-e2e.outcome == 'failure' }}
         run: yarn cli cts run ${{ matrix.client.language }} ${{ matrix.client.toRun }} --no-client --no-requests
 
       - name: Run benchmarks
@@ -479,6 +485,8 @@ jobs:
     name: client swift${{ needs.setup.outputs.RUN_MACOS_SWIFT_CTS == 'true' && format('@{0}', fromJSON(needs.setup.outputs.SWIFT_DATA).version) || '' }} macos
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }} # WARNING: this gives fork PR access to the github secrets
 
       - name: Download artifacts
         uses: ./scripts/ci/actions/restore-artifacts
@@ -527,9 +535,8 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          ref: ${{ github.event.pull_request.head.ref }}
+          ref: ${{ github.event.pull_request.head.sha }} # WARNING: this gives fork PR access to the github secrets
           token: ${{ secrets.ALGOLIA_BOT_TOKEN }}
-          repository: ${{ github.event.pull_request.head.repo.full_name }}
 
       - name: Download all artifacts
         uses: ./scripts/ci/actions/restore-artifacts
@@ -660,9 +667,8 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          ref: ${{ needs.codegen.outputs.generatedCommit }}
+          ref: ${{ github.event.pull_request.head.sha }} # WARNING: this gives fork PR access to the github secrets
           token: ${{ secrets.ALGOLIA_BOT_TOKEN }}
-          repository: ${{ github.event.pull_request.head.repo.full_name }}
 
       - name: Setup
         uses: ./.github/actions/setup