chore(ci): new workflow target to handle ci execution from forks

.github/workflows/approve_label.yml

@@ -1,8 +1,9 @@
-# Manage approved label in pull request
-name: PR approved label manager
+# Add labels in pull request
+name: PR label manager
 
 on:
   pull_request:
+  pull_request_target:
   pull_request_review:
     types: [submitted]
 
@@ -17,7 +18,8 @@ jobs:
 
       # Remove label if a push is performed after an approval
       - name: Remove approved label
-        if: ${{ github.event_name == 'pull_request' && contains(fromJSON(env.LABELS), 'approved') }}
+        if: ${{ (github.event_name == 'pull_request' || github.event_name == 'pull_request_target')
+          && contains(fromJSON(env.LABELS), 'approved') }}
         uses: actions-ecosystem/action-remove-labels@2ce5d41b4b6aa8503e285553f75ed56e0a40bae0
         with:
           # We use a PAT to have the same user (zama-bot) for label deletion as for creation.
@@ -27,8 +29,19 @@ jobs:
       # Add label only if the review is approved and if the label doesn't already exist
       - name: Add approved label
         uses: actions-ecosystem/action-add-labels@18f1af5e3544586314bbe15c0273249c770b2daf
-        if: ${{ github.event_name == 'pull_request_review' && github.event.review.state == 'approved' && !contains(fromJSON(env.LABELS), 'approved') }}
+        if: ${{ github.event_name == 'pull_request_review' 
+          && github.event.review.state == 'approved'
+          && !contains(fromJSON(env.LABELS), 'approved') }}
         with:
           # We need to use a PAT to be able to trigger `labeled` event for the other workflow.
           github_token: ${{ secrets.FHE_ACTIONS_TOKEN }}
           labels: approved
+
+      # Add label only if the pull request is from a forked repository
+      - name: Add external contribution label
+        uses: actions-ecosystem/action-add-labels@18f1af5e3544586314bbe15c0273249c770b2daf
+        if: ${{ github.event_name == 'pull_request_target' 
+          && !contains(fromJSON(env.LABELS), 'external-contribution') }}
+        with:
+          github_token: ${{ secrets.FHE_ACTIONS_TOKEN }}
+          labels: external-contribution

.github/workflows/aws_tfhe_fast_tests.yml

@@ -16,6 +16,7 @@ on:
   # Allows you to run this workflow manually from the Actions tab as an alternative.
   workflow_dispatch:
   pull_request:
+  pull_request_target:
 
 jobs:
   setup-instance:
@@ -45,6 +46,8 @@ jobs:
     steps:
       - name: Checkout tfhe-rs
         uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29
+        with:
+          persist-credentials: 'false'
 
       - name: Set up home
         run: |

.github/workflows/aws_tfhe_gpu_4090_tests.yml

@@ -17,6 +17,8 @@ on:
   workflow_dispatch:
   pull_request:
     types: [labeled]
+  pull_request_target:
+    types: [ labeled ]
 
 jobs:
   cuda-tests-linux:
@@ -30,6 +32,8 @@ jobs:
     steps:
       - name: Checkout tfhe-rs
         uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29
+        with:
+          persist-credentials: 'false'
 
       - name: Install latest stable
         uses: dtolnay/rust-toolchain@d8352f6b1d2e870bc5716e7a6d9b65c4cc244a1a

.github/workflows/aws_tfhe_gpu_tests.yml

@@ -16,6 +16,7 @@ on:
   # Allows you to run this workflow manually from the Actions tab as an alternative.
   workflow_dispatch:
   pull_request:
+  pull_request_target:
 
 jobs:
   setup-instance:
@@ -56,6 +57,8 @@ jobs:
     steps:
       - name: Checkout tfhe-rs
         uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29
+        with:
+          persist-credentials: 'false'
 
       - name: Set up home
         run: |
@@ -122,6 +125,8 @@ jobs:
     steps:
       - name: Checkout tfhe-rs
         uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29
+        with:
+          persist-credentials: 'false'
 
       - name: Set up home
         run: |

.github/workflows/aws_tfhe_integer_tests.yml

@@ -16,6 +16,8 @@ on:
   workflow_dispatch:
   pull_request:
     types: [ labeled ]
+  pull_request_target:
+    types: [ labeled ]
 
 jobs:
   setup-instance:
@@ -46,6 +48,8 @@ jobs:
     steps:
       - name: Checkout tfhe-rs
         uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29
+        with:
+          persist-credentials: 'false'
 
       - name: Set up home
         run: |

.github/workflows/aws_tfhe_signed_integer_tests.yml

@@ -16,6 +16,8 @@ on:
   workflow_dispatch:
   pull_request:
     types: [ labeled ]
+  pull_request_target:
+    types: [ labeled ]
 
 jobs:
   setup-instance:
@@ -46,6 +48,8 @@ jobs:
     steps:
       - name: Checkout tfhe-rs
         uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29
+        with:
+          persist-credentials: 'false'
 
       - name: Set up home
         run: |

.github/workflows/aws_tfhe_tests.yml

@@ -17,6 +17,8 @@ on:
   workflow_dispatch:
   pull_request:
     types: [ labeled ]
+  pull_request_target:
+    types: [ labeled ]
   schedule:
     # Nightly tests @ 1AM after each work day
     - cron: "0 1 * * MON-FRI"
@@ -118,8 +120,9 @@ jobs:
 
   setup-instance:
     name: Setup instance (cpu-tests)
-    if: github.event_name != 'pull_request' ||
-      (github.event_name == 'pull_request' && needs.should-run.outputs.any_file_changed == 'true')
+    if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') ||
+      ((github.event_name == 'pull_request' || github.event_name != 'pull_request_target') && 
+      needs.should-run.outputs.any_file_changed == 'true')
     needs: should-run
     runs-on: ubuntu-latest
     outputs:
@@ -138,8 +141,9 @@ jobs:
 
   cpu-tests:
     name: CPU tests
-    if: github.event_name != 'pull_request' ||
-      (github.event_name == 'pull_request' && needs.setup-instance.result != 'skipped')
+    if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') ||
+      ((github.event_name == 'pull_request' || github.event_name != 'pull_request_target') &&
+      needs.setup-instance.result != 'skipped')
     needs: [ should-run, setup-instance ]
     concurrency:
       group: ${{ github.workflow }}_${{github.event_name}}_${{ github.ref }}
@@ -148,6 +152,8 @@ jobs:
     steps:
       - name: Checkout tfhe-rs
         uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29
+        with:
+          persist-credentials: 'false'
 
       - name: Set up home
         run: |

.github/workflows/aws_tfhe_wasm_tests.yml

@@ -16,6 +16,8 @@ on:
   workflow_dispatch:
   pull_request:
     types: [ labeled ]
+  pull_request_target:
+    types: [ labeled ]
 
 jobs:
   setup-instance:
@@ -46,6 +48,8 @@ jobs:
     steps:
       - name: Checkout tfhe-rs
         uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29
+        with:
+          persist-credentials: 'false'
 
       - name: Set up home
         run: |

.github/workflows/csprng_randomness_tests.yml

@@ -16,7 +16,8 @@ on:
   workflow_dispatch:
   pull_request:
     types: [ labeled ]
-
+  pull_request_target:
+    types: [labeled]
 
 jobs:
   setup-instance:
@@ -47,6 +48,8 @@ jobs:
     steps:
       - name: Checkout tfhe-rs
         uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29
+        with:
+          persist-credentials: 'false'
 
       - name: Set up home
         run: |

.github/workflows/m1_tests.yml

@@ -4,6 +4,8 @@ on:
   workflow_dispatch:
   pull_request:
     types: [labeled]
+  pull_request_target:
+    types: [ labeled ]
   # Have a nightly build for M1 tests
   schedule:
     # * is a special character in YAML so you have to quote this string
@@ -32,6 +34,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29
+        with:
+          persist-credentials: 'false'
 
       - name: Install latest stable
         uses: dtolnay/rust-toolchain@d8352f6b1d2e870bc5716e7a6d9b65c4cc244a1a
@@ -136,7 +140,7 @@ jobs:
     if: ${{ always() }}
     steps:
       - uses: actions-ecosystem/action-remove-labels@2ce5d41b4b6aa8503e285553f75ed56e0a40bae0
-        if: ${{ github.event_name == 'pull_request' }}
+        if: ${{ github.event_name == 'pull_request' || github.event_name == 'pull_request_target' }}
         with:
           labels: m1_test
           github_token: ${{ secrets.GITHUB_TOKEN }}