T9107: Fix integration workflow after recent GitHub security updates [vyos-1x]

2 files changed, 75 insertions, 22 deletions

diff --git a/.github/workflows/package-smoketest-comment.yml b/.github/workflows/package-smoketest-comment.yml
new file mode 100644
index 000000000..80fa52566
--- /dev/null
+++ b/.github/workflows/package-smoketest-comment.yml
@@ -0,0 +1,48 @@
+name: VyOS ISO Integration Test - PR Comment
+
+# This workflow is the trusted counterpart to package-smoketest.yml. It runs
+# with `pull-requests: write` and the base repository's GITHUB_TOKEN, so it
+# must NEVER check out or execute any code from the pull request / fork. It
+# only downloads the plain-text result artifact produced by the (untrusted,
+# `pull_request`-triggered) package-smoketest.yml run and posts it as a PR
+# comment. See https://gh.io/securely-using-pull_request_target for why this
+# split exists.
+
+on:
+  workflow_run:
+    workflows: ["VyOS ISO Integration Test"]
+    types:
+      - completed
+
+permissions:
+  contents: read
+  pull-requests: write
+  actions: read
+
+jobs:
+  comment:
+    if: github.event.workflow_run.event == 'pull_request'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - name: Download PR report artifact
+        uses: actions/download-artifact@v8
+        with:
+          name: pr-report
+          path: pr-report
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Read PR number
+        id: pr
+        run: |
+          echo "number=$(cat pr-report/pr_number.txt)" >> "$GITHUB_OUTPUT"
+
+      - name: Add PR comment
+        uses: mshick/add-pr-comment@v2
+        with:
+          issue: ${{ steps.pr.outputs.number }}
+          message-path: pr-report/message.md
+          message-id: "SMOKETEST_RESULTS"
+          allow-repeats: false
+          refresh-message-position: true
diff --git a/.github/workflows/package-smoketest.yml b/.github/workflows/package-smoketest.yml
index 66b62223e..43731ac6a 100644
--- a/.github/workflows/package-smoketest.yml
+++ b/.github/workflows/package-smoketest.yml
@@ -11,7 +11,7 @@ on:
       - '**'
       - '!.github/**'
       - '!**/*.md'
-  pull_request_target:
+  pull_request:
     branches:
       - rolling
       - circinus
@@ -22,7 +22,6 @@ on:
       - '!**/*.md'
 
 permissions:
-  pull-requests: write
   contents: read
 
 env:
@@ -56,7 +55,7 @@ jobs:
       - name: Set branch-specific configuration
         id: config
         run: |
-          if [[ "${{ github.event_name }}" == "pull_request_target" ]]; then
+          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
             BRANCH="${{ github.event.pull_request.base.ref }}"
           else
             BRANCH="${{ github.ref_name }}"
@@ -91,7 +90,7 @@ jobs:
           BRANCH="${{ steps.config.outputs.branch }}"
           VYOS_BUILD_REPO="${{ steps.config.outputs.vyos_build_repo }}"
 
-          if [[ "${{ github.event_name }}" == "pull_request_target" ]]; then
+          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
             PR_HEAD_REF="${{ github.event.pull_request.head.ref }}"
 
             # VYOS_BUILD_REPO is in owner/repo format from config
@@ -446,25 +445,31 @@ jobs:
     timeout-minutes: 5
     if: always()
     steps:
-      - name: Add PR comment
-        if: always() && github.event_name == 'pull_request_target'
-        uses: mshick/add-pr-comment@v2
-        with:
-          message: |
-            CI integration ${{ (needs.test_smoketest_cli.outputs.exit_code == 'success' && needs.test_interfaces_cli.outputs.exit_code == 'success' && needs.test_config_load.outputs.exit_code == 'success' && needs.test_raid1_install.outputs.exit_code == 'success' && (needs.test_smoketest_cli_vpp.outputs.exit_code != 'fail') && (needs.test_config_load_vpp.outputs.exit_code != 'fail') && (needs.test_encrypted_config_tpm.outputs.exit_code != 'fail')) && '👍 passed!' || '❌ failed!' }}
+      - name: Prepare PR report
+        if: always() && github.event_name == 'pull_request'
+        run: |
+          mkdir -p pr-report
+          echo "${{ github.event.pull_request.number }}" > pr-report/pr_number.txt
+
+          cat > pr-report/message.md << 'EOF'
+          CI integration ${{ (needs.test_smoketest_cli.outputs.exit_code == 'success' && needs.test_interfaces_cli.outputs.exit_code == 'success' && needs.test_config_load.outputs.exit_code == 'success' && needs.test_raid1_install.outputs.exit_code == 'success' && (needs.test_smoketest_cli_vpp.outputs.exit_code != 'fail') && (needs.test_config_load_vpp.outputs.exit_code != 'fail') && (needs.test_encrypted_config_tpm.outputs.exit_code != 'fail')) && '👍 passed!' || '❌ failed!' }}
 
-            ### Details
+          ### Details
 
-            [CI logs](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
+          [CI logs](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
 
-            * CLI Smoketests ${{ needs.test_smoketest_cli.outputs.exit_code == 'success' && '👍 passed' || '❌ failed' }}
-            * CLI Smoketests (interfaces only) ${{ needs.test_interfaces_cli.outputs.exit_code == 'success' && '👍 passed' || '❌ failed' }}
-            * Config tests ${{ needs.test_config_load.outputs.exit_code == 'success' && '👍 passed' || '❌ failed' }}
-            * RAID1 tests ${{ needs.test_raid1_install.outputs.exit_code == 'success' && '👍 passed' || '❌ failed' }}
-            * CLI Smoketests VPP ${{ needs.test_smoketest_cli_vpp.outputs.exit_code == 'success' && '👍 passed' || needs.test_smoketest_cli_vpp.outputs.exit_code == 'fail' && '❌ failed' || '⏭️ skipped' }}
-            * Config tests VPP ${{ needs.test_config_load_vpp.outputs.exit_code == 'success' && '👍 passed' || needs.test_config_load_vpp.outputs.exit_code == 'fail' && '❌ failed' || '⏭️ skipped' }}
-            * TPM tests ${{ needs.test_encrypted_config_tpm.outputs.exit_code == 'success' && '👍 passed' || needs.test_encrypted_config_tpm.outputs.exit_code == 'fail' && '❌ failed' || '⏭️ skipped' }}
+          * CLI Smoketests ${{ needs.test_smoketest_cli.outputs.exit_code == 'success' && '👍 passed' || '❌ failed' }}
+          * CLI Smoketests (interfaces only) ${{ needs.test_interfaces_cli.outputs.exit_code == 'success' && '👍 passed' || '❌ failed' }}
+          * Config tests ${{ needs.test_config_load.outputs.exit_code == 'success' && '👍 passed' || '❌ failed' }}
+          * RAID1 tests ${{ needs.test_raid1_install.outputs.exit_code == 'success' && '👍 passed' || '❌ failed' }}
+          * CLI Smoketests VPP ${{ needs.test_smoketest_cli_vpp.outputs.exit_code == 'success' && '👍 passed' || needs.test_smoketest_cli_vpp.outputs.exit_code == 'fail' && '❌ failed' || '⏭️ skipped' }}
+          * Config tests VPP ${{ needs.test_config_load_vpp.outputs.exit_code == 'success' && '👍 passed' || needs.test_config_load_vpp.outputs.exit_code == 'fail' && '❌ failed' || '⏭️ skipped' }}
+          * TPM tests ${{ needs.test_encrypted_config_tpm.outputs.exit_code == 'success' && '👍 passed' || needs.test_encrypted_config_tpm.outputs.exit_code == 'fail' && '❌ failed' || '⏭️ skipped' }}
+          EOF
 
-          message-id: "SMOKETEST_RESULTS"
-          allow-repeats: false
-          refresh-message-position: true
+      - uses: actions/upload-artifact@v7
+        if: always() && github.event_name == 'pull_request'
+        with:
+          name: pr-report
+          path: pr-report
+          retention-days: 2