GH Actions: restrict access to certain GH Actions

.github/workflows/delete-old-releases.yml

@@ -30,7 +30,32 @@ on:
         default: ^v
 
 jobs:
+  gate-check:
+    # Adding an `if:` that evaluates to false for this gate-check job prevents other dependent jobs from running.
+    runs-on: ubuntu-latest
+    steps:
+    - id: checkUserMember
+      # Only check for manual runs, not scheduled runs
+      if: github.event_name == 'workflow_dispatch'
+      uses: tspascoal/get-user-teams-membership@v2
+      with:
+        username: ${{ github.actor }}
+        team: 'vro-restricted'
+        GITHUB_TOKEN: ${{ secrets.ACCESS_TOKEN_READ_TEAM }}
+    - name: "Check permission"
+      id: check-permission
+      # Only check for manual runs, not scheduled runs
+      if: github.event_name == 'workflow_dispatch'
+      run: |
+        echo "${{ github.actor }} isTeamMember: ${{ steps.checkUserMember.outputs.isTeamMember }}"
+        echo "Member of teams: ${{ steps.checkUserMember.outputs.teams }}"
+        if [ "${{ steps.checkUserMember.outputs.isTeamMember }}" = 'false' ]; then
+          echo "Only VRO-RESTRICTED team members can run this action!" | tee -a "$GITHUB_STEP_SUMMARY"
+          exit 3
+        fi
+
   delete_releases:
+    needs: gate-check
     # Deletions in public repo will be automatically propagated to internal repo when mirror.yml runs, at which point:
     # - Git release tags (associated with GitHub pre-releases) will be deleted in the internal repo
     # - Tag deletions will result in GitHub releases disappearing in internal repo: https://github.com/department-of-veterans-affairs/abd-vro-internal/releases

.github/workflows/delete-published-images.yml

@@ -34,7 +34,32 @@ on:
 #        - '^release-1\.\d+\.\d+$'
 
 jobs:
+  gate-check:
+    # Adding an `if:` that evaluates to false for this gate-check job prevents other dependent jobs from running.
+    runs-on: ubuntu-latest
+    steps:
+    - id: checkUserMember
+      # Only check for manual runs, not scheduled runs
+      if: github.event_name == 'workflow_dispatch'
+      uses: tspascoal/get-user-teams-membership@v2
+      with:
+        username: ${{ github.actor }}
+        team: 'vro-restricted'
+        GITHUB_TOKEN: ${{ secrets.ACCESS_TOKEN_READ_TEAM }}
+    - name: "Check permission"
+      id: check-permission
+      # Only check for manual runs, not scheduled runs
+      if: github.event_name == 'workflow_dispatch'
+      run: |
+        echo "${{ github.actor }} isTeamMember: ${{ steps.checkUserMember.outputs.isTeamMember }}"
+        echo "Member of teams: ${{ steps.checkUserMember.outputs.teams }}"
+        if [ ${{ steps.checkUserMember.outputs.isTeamMember }} = 'false' ]; then
+          echo "Only VRO-RESTRICTED team members can run this action!" | tee -a "$GITHUB_STEP_SUMMARY"
+          exit 3
+        fi
+
   delete_images:
+    needs: gate-check
     if: github.repository == 'department-of-veterans-affairs/abd-vro-internal'
     continue-on-error: true
     strategy:

.github/workflows/delete-workflow-runs.yml

@@ -20,7 +20,32 @@ on:
         default: 20
 
 jobs:
+  gate-check:
+    # Adding an `if:` that evaluates to false for this gate-check job prevents other dependent jobs from running.
+    runs-on: ubuntu-latest
+    steps:
+    - id: checkUserMember
+      # Only check for manual runs, not scheduled runs
+      if: github.event_name == 'workflow_dispatch'
+      uses: tspascoal/get-user-teams-membership@v2
+      with:
+        username: ${{ github.actor }}
+        team: 'vro-restricted'
+        GITHUB_TOKEN: ${{ secrets.ACCESS_TOKEN_READ_TEAM }}
+    - name: "Check permission"
+      id: check-permission
+      # Only check for manual runs, not scheduled runs
+      if: github.event_name == 'workflow_dispatch'
+      run: |
+        echo "${{ github.actor }} isTeamMember: ${{ steps.checkUserMember.outputs.isTeamMember }}"
+        echo "Member of teams: ${{ steps.checkUserMember.outputs.teams }}"
+        if [ ${{ steps.checkUserMember.outputs.isTeamMember }} = 'false' ]; then
+          echo "Only VRO-RESTRICTED team members can run this action!" | tee -a "$GITHUB_STEP_SUMMARY"
+          exit 3
+        fi
+
   delete_runs:
+    needs: gate-check
     runs-on: ubuntu-latest
     steps:
       - name: "Delete old workflow runs"

.github/workflows/deploy-secrets.yml

@@ -29,9 +29,35 @@ on:
         type: boolean
 
 jobs:
+  gate-check:
+    # Adding an `if:` that evaluates to false for this gate-check job prevents other dependent jobs from running.
+    if: github.repository == 'department-of-veterans-affairs/abd-vro-internal'
+    runs-on: ubuntu-latest
+    steps:
+    - id: checkUserMember
+      # Only check for manual runs against prod
+      if: github.event_name == 'workflow_dispatch' && inputs.target_env == 'prod'
+      uses: tspascoal/get-user-teams-membership@v2
+      with:
+        username: ${{ github.actor }}
+        team: 'vro-restricted'
+        GITHUB_TOKEN: ${{ secrets.ACCESS_TOKEN_READ_TEAM }}
+    - name: "Check permission"
+      id: check-permission
+      # Only check for manual runs against prod
+      if: github.event_name == 'workflow_dispatch' && inputs.target_env == 'prod'
+      run: |
+        echo "${{ github.actor }} isTeamMember: ${{ steps.checkUserMember.outputs.isTeamMember }}"
+        echo "Member of teams: ${{ steps.checkUserMember.outputs.teams }}"
+        if [ ${{ steps.checkUserMember.outputs.isTeamMember }} = 'false' ]; then
+          echo "Only VRO-RESTRICTED team members can run this action for ${{inputs.target_env}}!" | tee -a "$GITHUB_STEP_SUMMARY"
+          exit 3
+        fi
+
   publish_image:
     name: "Publish GitHub runner image"
-    if: ${{ inputs.publish_new_image || false }} && (github.repository == 'department-of-veterans-affairs/abd-vro-internal')
+    needs: gate-check
+    if: ${{ inputs.publish_new_image || false }}
     runs-on: ubuntu-latest
     steps:
       - name: "Login to GitHub Container Registry"
@@ -58,8 +84,11 @@ jobs:
 
   gh_runner:
     name: "Start GitHub runner to set ${{ inputs.target_env }} secrets"
-    needs: publish_image
-    if: always() && (github.repository == 'department-of-veterans-affairs/abd-vro-internal')
+    # Run after publish_image job (if the job runs)
+    needs: [gate-check, publish_image]
+    # Always run even if publish_image job is skipped.
+    # Runs only if gate-check job succeeded and publish_image job succeeded or is skipped
+    if: always() && needs.gate-check.result == 'success' && (needs.publish_image.result == 'success' || needs.publish_image.result == 'skipped')
     runs-on: ubuntu-latest
     steps:
       - name: "Set up kube config for dev env"

.github/workflows/update-deployment.yml

@@ -84,10 +84,34 @@ env:
   SHUTDOWN_FIRST: ${{ inputs.shutdown }}
 
 jobs:
-  update-deployment:
-    # Required secrets are set in the specific repo
+  gate-check:
+    # Adding an `if:` that evaluates to false for this gate-check job prevents other dependent jobs from running.
     if: github.repository == 'department-of-veterans-affairs/abd-vro-internal'
     runs-on: ubuntu-latest
+    steps:
+    - id: checkUserMember
+      # Only check for manual runs against prod
+      if: github.event_name == 'workflow_dispatch' && inputs.target_env == 'prod'
+      uses: tspascoal/get-user-teams-membership@v2
+      with:
+        username: ${{ github.actor }}
+        team: 'vro-restricted'
+        GITHUB_TOKEN: ${{ secrets.ACCESS_TOKEN_READ_TEAM }}
+    - name: "Check permission"
+      id: check-permission
+      # Only check for manual runs against prod
+      if: github.event_name == 'workflow_dispatch' && inputs.target_env == 'prod'
+      run: |
+        echo "${{ github.actor }} isTeamMember: ${{ steps.checkUserMember.outputs.isTeamMember }}"
+        echo "Member of teams: ${{ steps.checkUserMember.outputs.teams }}"
+        if [ ${{ steps.checkUserMember.outputs.isTeamMember }} = 'false' ]; then
+          echo "Only VRO-RESTRICTED team members can run this action for ${{inputs.target_env}}!" | tee -a "$GITHUB_STEP_SUMMARY"
+          exit 3
+        fi
+
+  update-deployment:
+    needs: gate-check
+    runs-on: ubuntu-latest
     steps:
       - name: "Slack: workflow triggered"
         id: notify-slack