e2e_authorize.yaml

# Separate job: GitHub sends job-level secrets to the runner as soon as that job starts.
name: Authorize E2E secrets access

on:
  workflow_call:
    outputs:
      authorized:
        description: true if e2e may run with repository secrets
        value: ${{ jobs.authorize.outputs.authorized }}

jobs:
  authorize:
    name: Check repository access
    runs-on: ubuntu-latest
    timeout-minutes: 2
    if: github.event.action != 'labeled' || github.event.label.name == 'ok-to-test'
    permissions:
      contents: read
      members: read
    outputs:
      authorized: ${{ steps.check.outputs.authorized }}
    steps:
      - name: Allow repo members, or ok-to-test from an owner
        id: check
        env:
          GH_TOKEN: ${{ github.token }}
          EVENT_NAME: ${{ github.event_name }}
          EVENT_ACTION: ${{ github.event.action }}
          USER: ${{ github.event.pull_request.user.login || github.actor }}
          ACTOR: ${{ github.actor }}
          REPOSITORY: ${{ github.repository }}
        run: |
          set -euo pipefail

          allow() { echo "$1"; echo "authorized=true" >> "$GITHUB_OUTPUT"; exit 0; }
          deny()  { echo "::warning::$1"; echo "authorized=false" >> "$GITHUB_OUTPUT"; exit 0; }

          encode() { jq -nr --arg u "$1" '$u|@uri'; }

          # True if the user is on this repository or an org owner/member.
          is_repo_user_or_member() {
            local encoded org role
            encoded=$(encode "$1")
            if gh api --silent "repos/${REPOSITORY}/collaborators/${encoded}"; then
              return 0
            fi
            org="${REPOSITORY%%/*}"
            role=$(gh api "orgs/${org}/memberships/${encoded}" \
              --jq 'if .state == "active" then .role else "none" end' 2>/dev/null || echo none)
            [ "$role" = "admin" ] || [ "$role" = "member" ]
          }

          repo_permission() {
            gh api "repos/${REPOSITORY}/collaborators/$(encode "$1")/permission" --jq .permission 2>/dev/null || echo none
          }

          [ "$EVENT_NAME" = "schedule" ] && allow "Scheduled run."

          echo "executor=$USER"
          if is_repo_user_or_member "$USER"; then
            allow "$USER is a user or member of ${REPOSITORY}."
          fi

          [ "$EVENT_ACTION" = "labeled" ] || deny "$USER is not a user or member of ${REPOSITORY}."

          LABELER_PERM=$(repo_permission "$ACTOR")
          echo "ok-to-test labeler=$ACTOR permission=$LABELER_PERM"
          [ "$LABELER_PERM" = "admin" ] && allow "Owner $ACTOR added ok-to-test."

          deny "ok-to-test must be added by a repository owner."