Modernize run-test workflow

Author: marickvantuil

.github/workflows/run-tests.yml

@@ -2,22 +2,72 @@ name: Run tests
 
 on:
   pull_request_target:
+    types: [opened, synchronize, labeled]
   schedule:
     - cron: '0 0 * * *'
 
 jobs:
-  php-tests:
-    runs-on: ${{ matrix.os }}
+  access_check:
+    runs-on: ubuntu-latest
+    name: Access check
+    steps:
+      - name: Ensure pull-request is safe to run
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{secrets.GITHUB_TOKEN}}
+          script: |
+            if (context.eventName === 'schedule') {
+              return
+            }
+            
+            // If the user that pushed the commit is a maintainer, skip the check
+            const collaborators = await github.rest.repos.listCollaborators({
+              owner: context.repo.owner,
+              repo: context.repo.repo
+            });
+            
+            if (collaborators.data.some(c => c.login === context.actor)) {
+              console.log(`User ${context.actor} is allowed to run tests because they are a collaborator.`);
+              return
+            }
+            
+            const issue_number = context.issue.number;
+            const repository = context.repo.repo;
+            const owner = context.repo.owner;
+            
+            const response = await github.rest.issues.listLabelsOnIssue({
+              owner,
+              repo: repository,
+              issue_number
+            });
+            const labels = response.data.map(label => label.name);
+            let hasLabel = labels.includes('safe-to-test')
+            
+            if (context.payload.action === 'synchronize' && hasLabel) {
+                hasLabel = false
+                await github.rest.issues.removeLabel({
+                  owner,
+                  repo: repository,
+                  issue_number,
+                  name: 'safe-to-test'
+                });
+            }
+            
+            if (!hasLabel) {
+              throw "Action was not authorized. Exiting now."
+            }
 
+  php-tests:
+    runs-on: ubuntu-latest
+    needs: access_check
     strategy:
       matrix:
-        os: [ubuntu-latest]
         payload:
           - { laravel: '11.*', php: '8.3', 'testbench': '9.*' }
           - { laravel: '11.*', php: '8.2', 'testbench': '9.*' }
-          - { laravel: '10.*', php: '8.3', 'testbench': '8.*'}
-          - { laravel: '10.*', php: '8.2', 'testbench': '8.*'}
-          - { laravel: '10.*', php: '8.1', 'testbench': '8.*'}
+          - { laravel: '10.*', php: '8.3', 'testbench': '8.*' }
+          - { laravel: '10.*', php: '8.2', 'testbench': '8.*' }
+          - { laravel: '10.*', php: '8.1', 'testbench': '8.*' }
 
     name: PHP ${{ matrix.payload.php }} - Laravel ${{ matrix.payload.laravel }}
 
@@ -36,7 +86,9 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
 
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
@@ -50,11 +102,4 @@ jobs:
           composer require "laravel/framework:${{ matrix.payload.laravel }}" "orchestra/testbench:${{ matrix.payload.testbench }}" --no-interaction --no-update
           composer update --prefer-stable --prefer-dist --no-interaction
       - name: Execute tests
-        env:
-          CI_DB_DRIVER: mysql
-          CI_DB_HOST: 127.0.0.1
-          CI_DB_PORT: 3307
-          CI_DB_DATABASE: test
-          CI_DB_USERNAME: root
-          CI_DB_PASSWORD: root
         run: composer test