ci: Fix authorization logic in pull_request_target workflows

[rm3l]

Description

Otherwise, they might be tricked into executing arbitrary code.

Which issue(s) does this PR fix or relate to

More details in https://boostsecurity.io/blog/weaponizing-dependabot-pwn-request-at-its-finest

PR acceptance criteria

• Tests
• Documentation

How to test changes / Special notes to the reviewer

Summary by Sourcery

Fix authorization and checkout logic in pull_request_target workflows to prevent execution of arbitrary code

Bug Fixes:

• Use pull_request.user.login instead of github.actor for internal/external environment gating
• Checkout workflows now use pull_request.head.sha instead of head.ref to pin to the exact commit

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign kim-tsao for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[sourcery-ai]

Hey there - I've reviewed your changes and they look great!

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[rm3l]

/cherry-pick release-1.6
/cherry-pick release-1.7

[openshift-cherrypick-robot]

@rm3l: once the present PR merges, I will cherry-pick it on top of release-1.6, release-1.7 in new PRs and assign them to you.

Details

In response to this:

/cherry-pick release-1.6
/cherry-pick release-1.7

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[github-actions]

PR images are available:

1. https://quay.io/rhdh-community/operator:0.8.0-pr-1563-e1bb50f
2. https://quay.io/rhdh-community/operator-bundle:0.8.0-pr-1563-e1bb50f
3. https://quay.io/rhdh-community/operator-catalog:0.8.0-pr-1563-e1bb50f

[openshift-cherrypick-robot]

@rm3l: new pull request created: #1564

Details

In response to this:

/cherry-pick release-1.6
/cherry-pick release-1.7

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-cherrypick-robot]

@rm3l: #1563 failed to apply on top of branch "release-1.6":

Applying: ci: Fix authorization logic in pull_request_target workflows
Using index info to reconstruct a base tree...
M	.github/workflows/pr-bundle-diff-checks.yaml
M	.github/workflows/pr-container-build.yaml
M	.github/workflows/pr.yaml
Falling back to patching base and 3-way merge...
Auto-merging .github/workflows/pr.yaml
CONFLICT (content): Merge conflict in .github/workflows/pr.yaml
Auto-merging .github/workflows/pr-container-build.yaml
CONFLICT (content): Merge conflict in .github/workflows/pr-container-build.yaml
Auto-merging .github/workflows/pr-bundle-diff-checks.yaml
CONFLICT (content): Merge conflict in .github/workflows/pr-bundle-diff-checks.yaml
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config advice.mergeConflict false"
Patch failed at 0001 ci: Fix authorization logic in pull_request_target workflows

Details

In response to this:

/cherry-pick release-1.6
/cherry-pick release-1.7

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.