fix: fix CI permissions 4

Author: pmalek

.github/workflows/_permission_check.yaml

@@ -12,7 +12,7 @@ on:
         type: string
 
 jobs:
-  check-permission:
+  check:
     runs-on: ubuntu-latest
     steps:
       - name: Logging
@@ -25,33 +25,49 @@ jobs:
           echo "github.triggering_actor ${{ github.triggering_actor }}"
           echo "github.actor ${{ github.actor }}"
 
-      - name: get user permission
-        id: checkAccess
+      - run: |
+          if [[ ! -z "${{ inputs.pr_user_login }}" ]]; then
+            echo "USER=${{ inputs.pr_user_login }}" >> $GITHUB_ENV
+          else
+            echo "USER=${{ github.triggering_actor }}" >> $GITHUB_ENV
+          fi
+
+      - name: get user (${{ env.USER }}) permission
+        id: check_access
         uses: actions-cool/check-user-permission@v2
         with:
           require: write
-          username: ${{ github.triggering_actor }}
+          username: ${{ env.USER }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: check user permission (non-PR)
-        if: ${{ inputs.pr_user_login }} == '' && steps.checkAccess.outputs.require-result == 'false'
-        run: |
-          echo "${{ github.triggering_actor }} does not have permissions on this repo."
-          echo "Current permission level is ${{ steps.checkAccess.outputs.user-permission }}"
-          echo "Job originally triggered by ${{ github.actor }}"
-          exit 1
+      - name: get whether triggering_actor (${{ github.triggering_actor }}) is a contributor
+        id: check_triggering_actor
+        uses: actions-cool/check-user-permission@v2
+        with:
+          require: write
+          check-contributor: true
+          username: ${{ github.triggering_actor }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: check user permission
+      - name: Check permissions
+        # If
+        # - this is triggered by a PR (send by someone else than dependabot or renovate), and
+        # - author association is neither 'COLLABORATOR' nor 'OWNER', and
+        # - triggering actor is not a contributor, then exit with an error.
         if: |
-            !(
-              (${{ inputs.pr_user_login }} == 'dependabot[bot]' && github.triggering_actor != 'dependabot[bot]') ||
-              (${{ inputs.pr_user_login }} == 'renovate[bot]' && github.triggering_actor != 'renovate[bot]')
-            )
-            &&
-            steps.checkAccess.outputs.require-result == 'false'
+          inputs.pr_user_login != '' &&
+          inputs.pr_user_login != 'dependabot[bot]' &&
+          inputs.pr_user_login != 'renovate[bot]' &&
+          github.event.pull_request.author_association != 'COLLABORATOR' &&
+          github.event.pull_request.author_association != 'OWNER' &&
+          steps.check_triggering_actor.outputs.check-result == 'false'
         run: |
-          echo "${{ github.triggering_actor }} does not have permissions on this repo."
-          echo "Current permission level is ${{ steps.checkAccess.outputs.user-permission }}"
+          echo "${{ inputs.pr_user_login }} does not have permissions on this repo."
+          echo "Contributor check-result for triggering_actor: ${{ github.triggering_actor }} is ${{ steps.check_triggering_actor.outputs.check-result }}"
+          echo "Current permission level is ${{ steps.check_access.outputs.user-permission }}"
           echo "Job originally triggered by ${{ github.actor }}"
+          echo "Author association is ${{ github.event.pull_request.author_association }}"
           exit 1
+