Reverted some changes because secrets can not be transferred to fork

Signed-off-by: Theodor Mihalache <[email protected]>

.github/workflows/java_pr.yml

@@ -1,44 +1,46 @@
 name: java_pr
 
 on:
-  pull_request:
+  pull_request_target:
     types:
       - opened
       - synchronize
       - labeled
 
 jobs:
   lint-java:
-    # when using pull_request, all jobs MUST have this if check for 'ok-to-test' or 'approved' for security purposes.
+    # when using pull_request_target, all jobs MUST have this if check for 'ok-to-test' or 'approved' for security purposes.
     if:
       ((github.event.action == 'labeled' && (github.event.label.name == 'approved' || github.event.label.name == 'lgtm' || github.event.label.name == 'ok-to-test')) ||
       (github.event.action != 'labeled' && (contains(github.event.pull_request.labels.*.name, 'ok-to-test') || contains(github.event.pull_request.labels.*.name, 'approved') || contains(github.event.pull_request.labels.*.name, 'lgtm')))) &&
-      github.event.pull_request.base.repo.full_name == 'feast-dev/feast'
+      github.repository == 'feast-dev/feast'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
         with:
-          repository: ${{ github.event.repository.full_name }}  # Uses the full repository name
-          ref: ${{ github.ref }}                                  # Uses the ref from the event
-          token: ${{ secrets.GITHUB_TOKEN }}                     # Automatically provided token
+          # pull_request_target runs the workflow in the context of the base repo
+          # as such actions/checkout needs to be explicit configured to retrieve
+          # code from the PR.
+          ref: refs/pull/${{ github.event.pull_request.number }}/merge
           submodules: recursive
       - name: Lint java
         run: make lint-java
 
   unit-test-java:
-    # when using pull_request, all jobs MUST have this if check for 'ok-to-test' or 'approved' for security purposes.
+    # when using pull_request_target, all jobs MUST have this if check for 'ok-to-test' or 'approved' for security purposes.
     if:
       ((github.event.action == 'labeled' && (github.event.label.name == 'approved' || github.event.label.name == 'lgtm' || github.event.label.name == 'ok-to-test')) ||
       (github.event.action != 'labeled' && (contains(github.event.pull_request.labels.*.name, 'ok-to-test') || contains(github.event.pull_request.labels.*.name, 'approved') || contains(github.event.pull_request.labels.*.name, 'lgtm')))) &&
-      github.event.pull_request.base.repo.full_name == 'feast-dev/feast'
+      github.repository == 'feast-dev/feast'
     runs-on: ubuntu-latest
     needs: lint-java
     steps:
       - uses: actions/checkout@v4
         with:
-          repository: ${{ github.event.repository.full_name }}  # Uses the full repository name
-          ref: ${{ github.ref }}                                  # Uses the ref from the event
-          token: ${{ secrets.GITHUB_TOKEN }}                     # Automatically provided token
+          # pull_request_target runs the workflow in the context of the base repo
+          # as such actions/checkout needs to be explicit configured to retrieve
+          # code from the PR.
+          ref: refs/pull/${{ github.event.pull_request.number }}/merge
           submodules: recursive
       - name: Set up JDK 11
         uses: actions/setup-java@v1
@@ -66,11 +68,11 @@ jobs:
           path: ${{ github.workspace }}/docs/coverage/java/target/site/jacoco-aggregate/
 
   build-docker-image-java:
-    # when using pull_request, all jobs MUST have this if check for 'ok-to-test' or 'approved' for security purposes.
+    # when using pull_request_target, all jobs MUST have this if check for 'ok-to-test' or 'approved' for security purposes.
     if:
       ((github.event.action == 'labeled' && (github.event.label.name == 'approved' || github.event.label.name == 'lgtm' || github.event.label.name == 'ok-to-test')) ||
       (github.event.action != 'labeled' && (contains(github.event.pull_request.labels.*.name, 'ok-to-test') || contains(github.event.pull_request.labels.*.name, 'approved') || contains(github.event.pull_request.labels.*.name, 'lgtm')))) &&
-      github.event.pull_request.base.repo.full_name == 'feast-dev/feast'
+      github.repository == 'feast-dev/feast'
     runs-on: ubuntu-latest
     strategy:
       matrix:
@@ -101,21 +103,22 @@ jobs:
         run: make build-${{ matrix.component }}-docker REGISTRY=${REGISTRY} VERSION=${GITHUB_SHA}
 
   integration-test-java-pr:
-    # when using pull_request, all jobs MUST have this if check for 'ok-to-test' or 'approved' for security purposes.
+    # when using pull_request_target, all jobs MUST have this if check for 'ok-to-test' or 'approved' for security purposes.
     if:
       ((github.event.action == 'labeled' && (github.event.label.name == 'approved' || github.event.label.name == 'lgtm' || github.event.label.name == 'ok-to-test')) ||
       (github.event.action != 'labeled' && (contains(github.event.pull_request.labels.*.name, 'ok-to-test') || contains(github.event.pull_request.labels.*.name, 'approved') || contains(github.event.pull_request.labels.*.name, 'lgtm')))) &&
-      github.event.pull_request.base.repo.full_name == 'feast-dev/feast'
+      github.repository == 'feast-dev/feast'
     runs-on: ubuntu-latest
     needs: unit-test-java
     env:
       PYTHON: 3.11
     steps:
       - uses: actions/checkout@v4
         with:
-          repository: ${{ github.event.repository.full_name }}  # Uses the full repository name
-          ref: ${{ github.ref }}                                  # Uses the ref from the event
-          token: ${{ secrets.GITHUB_TOKEN }}                     # Automatically provided token
+          # pull_request_target runs the workflow in the context of the base repo
+          # as such actions/checkout needs to be explicit configured to retrieve
+          # code from the PR.
+          ref: refs/pull/${{ github.event.pull_request.number }}/merge
           submodules: recursive
       - name: Set up JDK 11
         uses: actions/setup-java@v1

.github/workflows/pr_integration_tests.yml

@@ -1,7 +1,7 @@
 name: pr-integration-tests
 
 on:
-  pull_request:
+  pull_request_target:
     types:
       - opened
       - synchronize
@@ -14,11 +14,11 @@ on:
 
 jobs:
   integration-test-python:
-    # when using pull_request, all jobs MUST have this if check for 'ok-to-test' or 'approved' for security purposes.
+    # when using pull_request_target, all jobs MUST have this if check for 'ok-to-test' or 'approved' for security purposes.
     if:
       ((github.event.action == 'labeled' && (github.event.label.name == 'approved' || github.event.label.name == 'lgtm' || github.event.label.name == 'ok-to-test')) ||
       (github.event.action != 'labeled' && (contains(github.event.pull_request.labels.*.name, 'ok-to-test') || contains(github.event.pull_request.labels.*.name, 'approved') || contains(github.event.pull_request.labels.*.name, 'lgtm')))) &&
-      github.event.pull_request.base.repo.full_name == 'feast-dev/feast'
+      github.repository == 'feast-dev/feast'
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
@@ -41,9 +41,10 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          repository: ${{ github.event.repository.full_name }}  # Uses the full repository name
-          ref: ${{ github.ref }}                                  # Uses the ref from the event
-          token: ${{ secrets.GITHUB_TOKEN }}                     # Automatically provided token
+          # pull_request_target runs the workflow in the context of the base repo
+          # as such actions/checkout needs to be explicit configured to retrieve
+          # code from the PR.
+          ref: refs/pull/${{ github.event.pull_request.number }}/merge
           submodules: recursive
       - name: Setup Python
         uses: actions/setup-python@v5