feat: allow checkout of fork repo on workflow approval

.github/workflows/ami-release-nix-single.yml

@@ -18,15 +18,20 @@ permissions:
   id-token: write
 
 jobs:
+  checkout:
+    uses: ./.github/workflows/shared-checkout.yml
+
   build:
+    needs: checkout
     runs-on: arm-runner
     timeout-minutes: 150
 
     steps:
-      - name: Checkout Repo
-        uses: actions/checkout@v3
+      - name: Download repository
+        uses: actions/download-artifact@v4
         with:
-          ref: ${{ github.event.inputs.branch }}
+          name: repository
+          path: .
 
       - name: Get current branch SHA
         id: get_sha

.github/workflows/ami-release-nix.yml

@@ -16,14 +16,21 @@ permissions:
   id-token: write
 
 jobs:
+  checkout:
+    uses: ./.github/workflows/shared-checkout.yml
+
   prepare:
+    needs: checkout
     runs-on: ubuntu-latest
     outputs:
       postgres_versions: ${{ steps.set-versions.outputs.postgres_versions }}
     steps:
-      - name: Checkout Repo
-        uses: actions/checkout@v3
-
+      - name: Download repository
+        uses: actions/download-artifact@v4
+        with:
+          name: repository
+          path: .
+
       - uses: DeterminateSystems/nix-installer-action@main
 
       - name: Set PostgreSQL versions
@@ -33,7 +40,7 @@ jobs:
           echo "postgres_versions=$VERSIONS" >> $GITHUB_OUTPUT
 
   build:
-    needs: prepare
+    needs: [checkout, prepare]
     strategy:
       matrix:
         postgres_version: ${{ fromJson(needs.prepare.outputs.postgres_versions) }}
@@ -47,8 +54,11 @@ jobs:
     timeout-minutes: 150
 
     steps:
-      - name: Checkout Repo
-        uses: actions/checkout@v3
+      - name: Download repository
+        uses: actions/download-artifact@v4
+        with:
+          name: repository
+          path: .
 
       - uses: DeterminateSystems/nix-installer-action@main
 

.github/workflows/check-shellscripts.yml

@@ -11,20 +11,29 @@ permissions:
   contents: read
 
 jobs:
+  checkout:
+    uses: ./.github/workflows/shared-checkout.yml
+
   build:
+    needs: checkout
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
-    - name: Run ShellCheck
-      uses: ludeeus/action-shellcheck@master
-      env:
-        SHELLCHECK_OPTS: -e SC2001 -e SC2002 -e SC2143
-      with:
-        scandir: './ansible/files/admin_api_scripts'
+      - name: Download repository
+        uses: actions/download-artifact@v4
+        with:
+          name: repository
+          path: .
+
+      - name: Run ShellCheck
+        uses: ludeeus/action-shellcheck@master
+        env:
+          SHELLCHECK_OPTS: -e SC2001 -e SC2002 -e SC2143
+        with:
+          scandir: './ansible/files/admin_api_scripts'
 
-    - name: Run ShellCheck on pg_upgrade scripts
-      uses: ludeeus/action-shellcheck@master
-      env:
-        SHELLCHECK_OPTS: -e SC2001 -e SC2002 -e SC2143
-      with:
-        scandir: './ansible/files/admin_api_scripts/pg_upgrade_scripts'
+      - name: Run ShellCheck on pg_upgrade scripts
+        uses: ludeeus/action-shellcheck@master
+        env:
+          SHELLCHECK_OPTS: -e SC2001 -e SC2002 -e SC2143
+        with:
+          scandir: './ansible/files/admin_api_scripts/pg_upgrade_scripts'

.github/workflows/ci.yml

@@ -7,12 +7,19 @@ permissions:
   contents: read
 
 jobs:
+  checkout:
+    uses: ./.github/workflows/shared-checkout.yml
+
   check-release-version:
+    needs: checkout
     timeout-minutes: 5
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout Repo
-        uses: actions/checkout@v3
+      - name: Download repository
+        uses: actions/download-artifact@v4
+        with:
+          name: repository
+          path: .
 
       - name: Load postgres_release values
         id: load_postgres_release

.github/workflows/dockerhub-release-matrix.yml

@@ -15,14 +15,22 @@ permissions:
   id-token: write
 
 jobs:
+  checkout:
+    uses: ./.github/workflows/shared-checkout.yml
+
   prepare:
+    needs: checkout
     runs-on: ubuntu-latest
     outputs:
       matrix_config: ${{ steps.set-matrix.outputs.matrix_config }}
     steps:
+      - name: Download repository
+        uses: actions/download-artifact@v4
+        with:
+          name: repository
+          path: .
+
       - uses: DeterminateSystems/nix-installer-action@main
-      - name: Checkout Repo
-        uses: actions/checkout@v3
       - name: Generate build matrix
         id: set-matrix
         run: |
@@ -53,7 +61,12 @@ jobs:
     outputs:
       build_args: ${{ steps.args.outputs.result }}
     steps:
-      - uses: actions/checkout@v3
+      - name: Download repository
+        uses: actions/download-artifact@v4
+        with:
+          name: repository
+          path: .
+
       - uses: DeterminateSystems/nix-installer-action@main
       - name: Set PostgreSQL version environment variable
         run: echo "POSTGRES_MAJOR_VERSION=${{ matrix.version }}" >> $GITHUB_ENV
@@ -77,7 +90,12 @@ jobs:
     runs-on: ${{ matrix.arch == 'amd64' && 'ubuntu-latest' || 'arm-runner' }}
     timeout-minutes: 180
     steps:
-      - uses: actions/checkout@v3
+      - name: Download repository
+        uses: actions/download-artifact@v4
+        with:
+          name: repository
+          path: .
+
       - uses: DeterminateSystems/nix-installer-action@main
       - run: docker context create builders
       - uses: docker/setup-buildx-action@v3
@@ -132,7 +150,6 @@ jobs:
         include: ${{ fromJson(needs.prepare.outputs.matrix_config).include }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
       - uses: DeterminateSystems/nix-installer-action@main
       - uses: docker/setup-buildx-action@v3
       - uses: docker/login-action@v2
@@ -175,7 +192,6 @@ jobs:
     needs: [prepare, merge_manifest]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
       - uses: DeterminateSystems/nix-installer-action@main
 
       - name: Debug Input from Prepare

.github/workflows/manual-docker-release.yml

@@ -12,14 +12,22 @@ permissions:
   contents: read
 
 jobs:
+  checkout:
+    uses: ./.github/workflows/shared-checkout.yml
+
   prepare:
+    needs: checkout
     runs-on: ubuntu-latest
     outputs:
       matrix_config: ${{ steps.set-matrix.outputs.matrix_config }}
     steps:
+      - name: Download repository
+        uses: actions/download-artifact@v4
+        with:
+          name: repository
+          path: .
+
       - uses: DeterminateSystems/nix-installer-action@main
-      - name: Checkout Repo
-        uses: actions/checkout@v3
       - name: Generate build matrix
         id: set-matrix
         run: |
@@ -50,7 +58,12 @@ jobs:
     outputs:
       build_args: ${{ steps.args.outputs.result }}
     steps:
-      - uses: actions/checkout@v3
+      - name: Download repository
+        uses: actions/download-artifact@v4
+        with:
+          name: repository
+          path: .
+
       - uses: DeterminateSystems/nix-installer-action@main
       - name: Set PostgreSQL version environment variable
         run: echo "POSTGRES_MAJOR_VERSION=${{ matrix.version }}" >> $GITHUB_ENV
@@ -74,7 +87,12 @@ jobs:
     runs-on: ${{ matrix.arch == 'amd64' && 'ubuntu-latest' || 'arm-runner' }}
     timeout-minutes: 180
     steps:
-      - uses: actions/checkout@v3
+      - name: Download repository
+        uses: actions/download-artifact@v4
+        with:
+          name: repository
+          path: .
+
       - uses: DeterminateSystems/nix-installer-action@main
       - run: docker context create builders
       - uses: docker/setup-buildx-action@v3
@@ -141,7 +159,6 @@ jobs:
         include: ${{ fromJson(needs.prepare.outputs.matrix_config).include }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
       - uses: DeterminateSystems/nix-installer-action@main
       - uses: docker/setup-buildx-action@v3
       - uses: docker/login-action@v2
@@ -184,7 +201,6 @@ jobs:
     needs: [prepare, merge_manifest]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
       - uses: DeterminateSystems/nix-installer-action@main
 
       - name: Debug Input from Prepare

.github/workflows/mirror-postgrest.yml

@@ -12,12 +12,21 @@ permissions:
   contents: read
 
 jobs:
+  checkout:
+    uses: ./.github/workflows/shared-checkout.yml
+
   version:
+    needs: checkout
     runs-on: ubuntu-latest
     outputs:
       postgrest_release: ${{ steps.args.outputs.result }}
     steps:
-      - uses: actions/checkout@v4
+      - name: Download repository
+        uses: actions/download-artifact@v4
+        with:
+          name: repository
+          path: .
+
       - id: args
         uses: mikefarah/yq@master
         with:

.github/workflows/nix-build.yml

@@ -13,7 +13,11 @@ permissions:
   id-token: write    
 
 jobs:
+  checkout:
+    uses: ./.github/workflows/shared-checkout.yml
+
   build-run-image:
+    needs: checkout
     strategy:
       fail-fast: false
       matrix:
@@ -27,13 +31,12 @@ jobs:
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 180
     steps:
-
-      - name: Check out code
-        uses: actions/checkout@v4
+      - name: Download repository
+        uses: actions/download-artifact@v4
         with:
-          ref: ${{ github.event.pull_request.head.ref || github.ref }}
-          fetch-depth: 0
-          fetch-tags: true
+          name: repository
+          path: .
+
       - name: aws-creds
         uses: aws-actions/configure-aws-credentials@v4
         with:

.github/workflows/publish-migrations-prod.yml

@@ -4,7 +4,11 @@ on:
   workflow_dispatch:
 
 jobs:
+  checkout:
+    uses: ./.github/workflows/shared-checkout.yml
+
   build:
+    needs: checkout
     runs-on: [self-hosted, linux]
     timeout-minutes: 15
     permissions:
@@ -21,9 +25,6 @@ jobs:
         env:
           GITHUB_REF: ${{ github.ref }}
 
-      - name: Checkout Repo
-        uses: actions/checkout@v2
-
       - name: Merging migration files
         run: cat $(ls -1) > ../migration-output.sql
         working-directory: ${{ github.workspace }}/migrations/db/migrations

.github/workflows/publish-migrations-staging.yml

@@ -7,17 +7,18 @@ on:
   workflow_dispatch:
 
 jobs:
+  checkout:
+    uses: ./.github/workflows/shared-checkout.yml
+
   build:
+    needs: checkout
     runs-on: [self-hosted, linux]
     timeout-minutes: 15
     permissions:
       id-token: write
       contents: read
 
     steps:
-      - name: Checkout Repo
-        uses: actions/checkout@v2
-
       - name: Merging migration files
         run: cat $(ls -1) > ../migration-output.sql
         working-directory: ${{ github.workspace }}/migrations/db/migrations