Update CI jobs to support PR branches (#4189)

* fix(ci): check out correct repo+ref for PRs. Addresses #3999

* fix(ci): update a bunch of other CI jobs to specify refs. For #3999

.github/workflows/actions-lint.yml

@@ -18,6 +18,7 @@ jobs:
         if: github.event_name == 'pull_request'
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.ref }}
 
       - name: Check out repository code
         uses: actions/checkout@v4

.github/workflows/automated-end-to-end-api.yaml

@@ -23,6 +23,7 @@ jobs:
         if: github.event_name == 'pull_request'
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.ref }}
 
       - name: Check out repository code
         uses: actions/checkout@v4

.github/workflows/browser-testing.yml

@@ -24,6 +24,7 @@ jobs:
         if: github.event_name == 'pull_request'
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.ref }}
 
       - name: Check out repository code
         uses: actions/checkout@v4

.github/workflows/build-storybook.yml

@@ -21,6 +21,7 @@ jobs:
         if: github.event_name == 'pull_request'
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.ref }}
 
       - name: Check out repository code
         uses: actions/checkout@v4
@@ -48,6 +49,7 @@ jobs:
           npm run build-storybook -- -o ../docs/components
 
       - name: Commit changes
+        if: github.repository == 'owncast/owncast'
         uses: EndBug/add-and-commit@v9
         with:
           author_name: Owncast
@@ -59,6 +61,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Dispatch event to web site
+        if: github.repository == 'owncast/owncast'
         uses: peter-evans/repository-dispatch@v3
         with:
           token: ${{ secrets.BUNDLE_STORYBOOK_OWNCAST_ONLINE }}

.github/workflows/chromatic.yml

@@ -7,7 +7,7 @@ on:
   push:
     paths:
       - web/**
-  pull_request_target:
+  pull_request:
     paths:
       - web/**
 
@@ -16,7 +16,6 @@ jobs:
   chromatic-deployment:
     # Operating System
     runs-on: ubuntu-latest
-    if: github.repository == 'owncast/owncast'
 
     defaults:
       run:
@@ -28,15 +27,16 @@ jobs:
         with:
           concurrent_skipping: 'same_content_newer'
 
-      - name: Check out pull request code
-        uses: actions/checkout@v4
-        if: github.event_name == 'pull_request' || github.event_name == 'pull_request_target'
-        with:
-          repository: ${{ github.event.pull_request.head.repo.full_name }}
-
-      - name: Check out repository code
-        uses: actions/checkout@v4
+      - name: Check out repository code (Push)
         if: github.event_name == 'push'
+        uses: actions/checkout@v4
+
+      - name: Check out pull request code (PR)
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.ref }}
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
 
       - name: Get changed files
         id: changed-files-yaml

.github/workflows/codeql-analysis.yml

@@ -41,6 +41,7 @@ jobs:
         if: github.event_name == 'pull_request'
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.ref }}
 
       - name: Check out repository code
         uses: actions/checkout@v4

.github/workflows/container-lint.yml

@@ -24,6 +24,7 @@ jobs:
         if: github.event_name == 'pull_request'
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.ref }}
 
       - name: Check out repository code
         uses: actions/checkout@v4

.github/workflows/container.yaml

@@ -42,6 +42,7 @@ jobs:
         if: github.event_name == 'pull_request'
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.ref }}
 
       - name: Check out repository code
         uses: actions/checkout@v4

.github/workflows/css-lint.yaml

@@ -21,6 +21,7 @@ jobs:
         if: github.event_name == 'pull_request'
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.ref }}
 
       - name: Check out repository code
         uses: actions/checkout@v4

.github/workflows/generate-api-documentation.yaml

@@ -14,6 +14,7 @@ jobs:
         if: github.event_name == 'pull_request'
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.ref }}
 
       - name: Check out repository code
         uses: actions/checkout@v4

.github/workflows/hls-tests.yml

@@ -30,6 +30,7 @@ jobs:
         if: github.event_name == 'pull_request'
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.ref }}
 
       - name: Check out repository code
         uses: actions/checkout@v4

.github/workflows/javascript-format-test-build.yml

@@ -121,6 +121,7 @@ jobs:
         if: github.event_name == 'pull_request'
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.ref }}
 
       - name: Check out repository code
         uses: actions/checkout@v4
@@ -191,6 +192,7 @@ jobs:
         if: github.event_name == 'pull_request'
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.ref }}
 
       - name: Check out repository code
         uses: actions/checkout@v4