chore(cicd): Setup build system to work with forks

.github/workflows/build.yml

@@ -7,6 +7,9 @@ on:
       repo:
         required: true
         type: string
+      fork_pr:
+        default: false
+        type: boolean
     secrets:
       SIGNING_SECRET:
         required: true
@@ -27,10 +30,15 @@ jobs:
 
     steps:
       - uses: EarthBuild/actions-setup@f4d20223e70dbb43b5fc08c4d857ab9cf0dbf3ae # v2.2.0
+        if: ${{ ! inputs.fork_pr }}
         with:
           use-cache: false
 
+      - uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4.0.0
+        if: ${{ ! inputs.fork_pr }}
+
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        if: ${{ ! inputs.fork_pr }}
         with:
           persist-credentials: false
           fetch-depth: 0
@@ -39,16 +47,18 @@ jobs:
 
 
       - name: Login to GitHub Container Registry
+        if: ${{ ! inputs.fork_pr }}
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ github.token }}
 
       - name: Run build
+        if: ${{ ! inputs.fork_pr }}
         id: build
         run: |
-          earth --ci --push -P +prebuild
+          just image-prebuild-publish
 
   amd64-prebuild:
     timeout-minutes: 20
@@ -58,11 +68,16 @@ jobs:
 
     steps:
       - uses: EarthBuild/actions-setup@f4d20223e70dbb43b5fc08c4d857ab9cf0dbf3ae # v2.2.0
+        if: ${{ ! inputs.fork_pr }}
         with:
           use-cache: false
 
+      - uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4.0.0
+        if: ${{ ! inputs.fork_pr }}
+
       # Setup repo and add caching
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        if: ${{ ! inputs.fork_pr }}
         with:
           persist-credentials: false
           fetch-depth: 0
@@ -72,6 +87,7 @@ jobs:
 
       - name: Login to GitHub Container Registry
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        if: ${{ ! inputs.fork_pr }}
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -80,8 +96,9 @@ jobs:
 
       - name: Run build
         id: build
+        if: ${{ ! inputs.fork_pr }}
         run: |
-          earth --ci --push -P +prebuild
+          just image-prebuild-publish
 
   build-images:
     permissions:
@@ -107,6 +124,8 @@ jobs:
       - name: Set up QEMU
         uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
 
+      - uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4.0.0
+
       # Setup repo and add caching
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
@@ -118,33 +137,39 @@ jobs:
 
       - name: Login to GitHub Container Registry
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        if: ${{ ! inputs.fork_pr }}
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ github.token }}
 
-
       - name: Run build
+        if: ${{ ! inputs.fork_pr }}
         env:
           GH_ACTOR: ${{ github.actor }}
           GH_TOKEN: ${{ github.token }}
           COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
         run: |
-          earth \
-            --secret COSIGN_PRIVATE_KEY \
-            --secret GH_ACTOR \
-            --secret GH_TOKEN \
-            --push --ci -P +build-images-all
-          earth \
-            --artifact +sign-all/digest-list ./digest-list
+          if [ -n "${COSIGN_PRIVATE_KEY}" ]; then
+            just image-sign-publish
+          else
+            just image-publish
+          fi
+
+      - name: Run build
+        if: ${{ inputs.fork_pr }}
+        run: |
+          just image-build
 
       - name: Store image digest info
+        if: ${{ ! inputs.fork_pr }}
         id: image_manifest_metadata
         run: |
           digest_list_json=$(jq -Rc '[ inputs | split(",") | {"image_ref":.[0],"image_digest":.[1]} ]' ./digest-list)
           echo "digests=$digest_list_json" >> $GITHUB_OUTPUT
 
   provenance:
+    if: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
     needs: [build-images]
     permissions:
       actions: read # for detecting the Github Actions environment.

.github/workflows/main.yml

@@ -15,7 +15,6 @@ on:
 jobs:
   build:
     uses: ./.github/workflows/build.yml
-    if: github.repository == 'blue-build/cli'
     permissions:
       contents: read # read repo contents
       packages: write # write package to ghcr

.github/workflows/pr.yml

@@ -12,7 +12,6 @@ on:
 jobs:
   build:
     uses: ./.github/workflows/build.yml
-    if: github.repository == 'blue-build/cli'
     permissions:
       contents: read # read repo contents
       packages: write # write package to ghcr
@@ -21,6 +20,7 @@ jobs:
     with:
       repo: ${{ github.event.pull_request.head.repo.full_name }}
       ref: ${{ github.event.pull_request.head.ref }}
+      fork_pr: ${{ github.event.pull_request.head.repo.full_name != github.repository }}
     secrets:
       SIGNING_SECRET: ${{ secrets.SIGNING_SECRET }}
   test:
@@ -33,5 +33,6 @@ jobs:
       repo: ${{ github.event.pull_request.head.repo.full_name }}
       ref: ${{ github.event.pull_request.head.ref }}
       pr_event_number: ${{ github.event.number }}
+      fork_pr: ${{ github.event.pull_request.head.repo.full_name != github.repository }}
     secrets:
       TEST_SIGNING_SECRET: ${{ secrets.TEST_SIGNING_SECRET }}

.github/workflows/run-test.yml

@@ -0,0 +1,109 @@
+on:
+  workflow_call:
+    inputs:
+      ref:
+        required: true
+        type: string
+      repo:
+        required: true
+        type: string
+      run:
+        required: true
+        type: string
+      pr_event_number:
+        type: string
+      fork_pr:
+        default: false
+        type: boolean
+      registry_login:
+        default: false
+        type: boolean
+      install_qemu:
+        default: false
+        type: boolean
+      install_docker:
+        default: false
+        type: boolean
+      install_earthbuild:
+        default: false
+        type: boolean
+    secrets:
+      TEST_SIGNING_SECRET:
+        required: true
+        description: The cosign private key used to sign images for tests
+env:
+  FORCE_COLOR: 1
+  CLICOLOR_FORCE: 1
+  RUST_LOG_STYLE: always
+
+permissions: {}
+
+jobs:
+  run-test:
+    name: ${{ inputs.run }}
+    timeout-minutes: 60
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read # read repo contents
+      packages: write # write test package to ghcr
+      id-token: write # docker auth
+
+    steps:
+      - name: Maximize build space
+        uses: hastd/free-disk-space@68572aeaadb7f76bd408246328e95926323402b5 # v0.1.2
+        with:
+          skip-if-available: "64G"
+
+      - name: Set up Docker Buildx
+        if: ${{ inputs.install_docker }}
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        with:
+          install: true
+
+      - uses: EarthBuild/actions-setup@f4d20223e70dbb43b5fc08c4d857ab9cf0dbf3ae # v2.2.0
+        if: ${{ inputs.install_earthbuild }}
+        with:
+          use-cache: false
+
+      - name: Set up QEMU
+        if: ${{ inputs.install_qemu }}
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+
+      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        if: ${{ ! inputs.fork_pr && inputs.registry_login }}
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ github.token }}
+
+      # Setup repo and add caching
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+          ref: ${{ inputs.ref }}
+          repository: ${{ inputs.repo }}
+
+      - uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4.0.0
+
+      - name: Run ${{ inputs.run }}
+        if: ${{ ! inputs.fork_pr }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_PR_EVENT_NUMBER: ${{ inputs.pr_event_number }}
+          COSIGN_PRIVATE_KEY: ${{ secrets.TEST_SIGNING_SECRET }}
+          RUN_JUST_RECIPE: ${{ inputs.run }}
+        run: just "${RUN_JUST_RECIPE}"
+
+      - name: Run ${{ inputs.run }} Fork PR
+        if: ${{ inputs.fork_pr }}
+        env:
+          GH_PR_EVENT_NUMBER: ${{ inputs.pr_event_number }}
+          RUN_JUST_RECIPE: ${{ inputs.run }}
+        run: |
+          export CARGO_HOME=$HOME/.cargo
+          just "${RUN_JUST_RECIPE}"
+