only require approvals on PRs from forks

Author: haritamar

.github/workflows/test-warehouse.yml

@@ -53,9 +53,25 @@ env:
   TESTS_DIR: ${{ github.workspace }}/dbt-data-reliability/integration_tests
 
 jobs:
+  detect-fork:
+    runs-on: ubuntu-latest
+    outputs:
+      requires_approval: ${{ steps.set-output.outputs.requires_approval }}
+    steps:
+      - name: Set fork output
+        id: set-output
+        run: |
+          if [[ "${{ github.event_name }}" == "pull_request_target" && "${{ github.event.pull_request.head.repo.full_name }}" != "${{ github.repository }}" ]]; then
+            echo "requires_approval=true" >> $GITHUB_OUTPUT
+          else
+            echo "requires_approval=false" >> $GITHUB_OUTPUT
+          fi
+
   test:
     runs-on: ubuntu-latest
-    environment: elementary_test_env # This is a github environment (not to be confused with env vars)
+    needs: [detect-fork]
+    # PRs from forks require approval - so we use an environment that requires an approver from the team.
+    environment: ${{ (steps.detect-fork.outputs.requires_approval == 'true' && 'elementary_test_env') || '' }}
     concurrency:
       # This is what eventually defines the schema name in the data platform.
       group: tests_${{ inputs.warehouse-type }}_dbt_${{ inputs.dbt-version }}_${{ github.head_ref || github.ref_name }}