PR from a fork should run the checks

[mauritsvanrees]

In collective.honeypot we have this PR:
collective/collective.honeypot#34
It is from a fork. No checks are run.

I pushed that branch to a branch with the same name on the collective, and made a new PR, and there the checks are run just fine:
collective/collective.honeypot#35

I think we should change some condition in the workflows to allow running the checks in a PR from a fork as well.

[mauritsvanrees]

Wait, now it looks like the initial PR does get its checks run. But I think that is because the two PRs have exactly the same commits (I pushed my latest changes both to the collective and the fork).

[gforcada]

Given the supply chain attacks and some other security related incidents, do we want to open this door? 🤔 or they always have to be approved before run? 🤔

[mauritsvanrees]

For most it should be completely fine: the jobs run on GitHub runners, and there are no secrets on the repos. Exceptions would be repos from which we do deployments, say to plone.org. But those are not handled with plone.meta, and those repos are locked down more, maybe even private, IIRC.

[mauritsvanrees]

Ah, the actions are run, but they are not really visible in the PR.

See this PR: collective/collective.recipe.supervisor#24

The action run for that one can be seen on the fork:
https://github.com/szakitibi/collective.recipe.supervisor/actions/runs/25669923138