test: improve test workflow to reduce boilerplate

.github/workflows/automerge-dependabot.yml

@@ -1,13 +1,13 @@
 name: Dependabot auto-merge
 on: pull_request
 
-permissions:
-  contents: write
-  pull-requests: write
 
 jobs:
   dependabot:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
     if: ${{ github.actor == 'dependabot[bot]' }}
     steps:
       - name: Enable auto-merge for Dependabot PRs

.github/workflows/test.yml

@@ -1,31 +1,28 @@
 name: 'Test'
 on:
-  workflow_call:
-    inputs:
-      branch_ref:
-        description: 'Which ref to pull'
-        type: string
-  workflow_dispatch:
-    inputs:
-      branch_ref:
-        description: 'Which ref to pull'
-        type: string
   push:
     branches:
       - main
-
-env:
-  CHECKOUT_REF: ${{ github.event_name == 'push' && github.ref || inputs.branch_ref }}
+  pull_request:
 
 jobs:
+  check-not-fork:
+    runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository }}
+    permissions: {}
+    steps:
+      - name: Check if fork
+        run: |
+          echo "::notice::Action not triggered from a fork. Proceeding with tests."
+
   test-branch-on-remote: # make sure the action works on a clean machine without building
     runs-on: ubuntu-latest
+    needs: [check-not-fork]
     permissions:
       contents: write
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          ref: ${{ env.CHECKOUT_REF }}
           persist-credentials: true
 
       - name: Setup test branch
@@ -75,12 +72,12 @@ jobs:
 
   test-branch-not-on-remote: # make sure the action works on a clean machine without building
     runs-on: ubuntu-latest
+    needs: [check-not-fork]
     permissions:
       contents: write
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          ref: ${{ env.CHECKOUT_REF }}
           persist-credentials: true
       - name: Setup test branch
         id: setup-test-branch
@@ -128,12 +125,12 @@ jobs:
           RESPONSE: ${{ steps.test-action.outputs.commit-response }}
   test-not-stage-all-files:
     runs-on: ubuntu-latest
+    needs: [check-not-fork]
     permissions:
       contents: write
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          ref: ${{ env.CHECKOUT_REF }}
           persist-credentials: true
       - name: Setup test branch
         id: setup-test-branch
@@ -185,12 +182,12 @@ jobs:
           RESPONSE: ${{ steps.test-action.outputs.commit-response }}
   test-stage-all-files:
     runs-on: ubuntu-latest
+    needs: [check-not-fork]
     permissions:
       contents: write
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          ref: ${{ env.CHECKOUT_REF }}
           persist-credentials: true
       - name: Setup test branch
         id: setup-test-branch
@@ -243,12 +240,12 @@ jobs:
 
   test-multiple-files:
     runs-on: ubuntu-latest
+    needs: [check-not-fork]
     permissions:
       contents: write
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          ref: ${{ env.CHECKOUT_REF }}
           persist-credentials: true
       - name: Setup test branch
         id: setup-test-branch
@@ -312,12 +309,12 @@ jobs:
 
   test-very-large-file:
     runs-on: ubuntu-latest
+    needs: [check-not-fork]
     permissions:
       contents: write
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          ref: ${{ env.CHECKOUT_REF }}
           persist-credentials: true
       - name: Setup test branch
         id: setup-test-branch
@@ -371,12 +368,12 @@ jobs:
 
   test-multiple-large-files:
     runs-on: ubuntu-latest
+    needs: [check-not-fork]
     permissions:
       contents: write
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          ref: ${{ env.CHECKOUT_REF }}
           persist-credentials: true
       - name: Setup test branch
         id: setup-test-branch
@@ -439,12 +436,12 @@ jobs:
 
   test-file-rename: # make sure the action works on a clean machine without building
     runs-on: ubuntu-latest
+    needs: [check-not-fork]
     permissions:
       contents: write
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          ref: ${{ env.CHECKOUT_REF }}
           persist-credentials: true
       - name: Setup test branch
         id: setup-test-branch
@@ -496,12 +493,12 @@ jobs:
 
   test-modify-file: # make sure the action works on a clean machine without building
     runs-on: ubuntu-latest
+    needs: [check-not-fork]
     permissions:
       contents: write
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          ref: ${{ env.CHECKOUT_REF }}
           persist-credentials: true
       - name: Setup test branch
         id: setup-test-branch
@@ -553,12 +550,12 @@ jobs:
           RESPONSE: ${{ steps.test-action.outputs.commit-response }}
   test-delete-file: # make sure the action works on a clean machine without building
     runs-on: ubuntu-latest
+    needs: [check-not-fork]
     permissions:
       contents: write
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          ref: ${{ env.CHECKOUT_REF }}
           persist-credentials: true
       - name: Setup test branch
         id: setup-test-branch
@@ -610,12 +607,12 @@ jobs:
           RESPONSE: ${{ steps.test-action.outputs.commit-response }}
   test-token-url: # make sure the action works on a clean machine without building
     runs-on: ubuntu-latest
+    needs: [check-not-fork]
     permissions:
       contents: write
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          ref: ${{ env.CHECKOUT_REF }}
           persist-credentials: true
       - name: Setup test branch
         id: setup-test-branch
@@ -665,12 +662,12 @@ jobs:
 
   test-fail-if-no-changes: # make sure the action works on a clean machine without building
     runs-on: ubuntu-latest
+    needs: [check-not-fork]
     permissions:
       contents: write
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          ref: ${{ env.CHECKOUT_REF }}
           persist-credentials: true
       - name: Setup test branch
         id: setup-test-branch
@@ -718,12 +715,12 @@ jobs:
 
   test-success-if-no-changes: # make sure the action works on a clean machine without building
     runs-on: ubuntu-latest
+    needs: [check-not-fork]
     permissions:
       contents: write
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
-          ref: ${{ env.CHECKOUT_REF }}
           persist-credentials: true
       - name: Setup test branch
         id: setup-test-branch

action.yml

@@ -197,6 +197,7 @@ runs:
 
         echo $graphql_query
 
+        # re: zizmor[template-injection] - Converting to env vars prevents the parameters from being injected into the command correctly
         response=$(gh api graphql -F "repo=${REPO}" -F "branch=${BRANCH}" -F "commitMessage=${COMMIT_MESSAGE}" -F "expectedHeadOid=$head_oid" ${{ steps.additions-and-deletions.outputs.additions }} ${{ steps.additions-and-deletions.outputs.deletions }} -F "query=$graphql_query")
         echo "commit_response=$response" >> $GITHUB_OUTPUT
       env: