Review GHA workflows that run for external PRs

[aethr]

The problem

GitHub Actions are triggered for every pull request to the repo, but some actions will fail for PRs from external contributors due to permissions.

See: #200 (comment)

Definition of "done"

• Assess which workflows/actions are important to run and pass for PRs from external contributors
• Determine the work involved updating workflows so that only these steps are run

The ultimate goal is to allow PRs from external repos/contributors to run vital QA checks like tests, while skipping non-essential (and authenticated) steps that will cause their PR checks to fail.

Additional context

[aethr]

Required checks

The repo has two workflows:

• CI - which runs tests
• Build docker image - which builds docker, pushes image to GHCR, runs basic tests, and pushes to AWS

Of these, running tests in CI is more critical for contributions from external contributors, since we're unlikely to accept external PRs that change the docker image or infra. We can probably resolve this issue by disabling the Build docker image workflow when the PR is external.

Running tests

Unfortunately, the openmethane-prior test suite includes integration tests that must fetch live data sources, including from Copernicus ADS, an authenticated service. This requires setting CDSAPI_KEY environment variable from secrets:

      - name: Run tests
        run: |
          make test
        env:
          CDSAPI_KEY: ${{ secrets.CDSAPI_ADS_KEY }}
          CDSAPI_URL: https://ads.atmosphere.copernicus.eu/api
          INPUT_CACHE: data/.cache

Workaround

Warm cache

When inputs are available in the cache, no request to ADS will be required since the DataManager detects the GFAS files already exist. However this can't be guaranteed to be available whenever a PR is submitted.

Mirrored test data

We could add the required GFAS files to the test data in our public data store, so it can be fetched and placed in the cache before running tests. This would allow us to remove the credentials entirely from GitHub Actions, but would mean the CDS download isn't tested in GitHub.

Split test jobs into privileged / non-privileged

It's an option to split testing into two jobs, one that runs tests that need privileges, and one that doesn't. The privileged job can be skipped when running tests on an external PR. Unfortunately, this prevents the most comprehensive integration tests which run the entire prior.

[aethr]

At this stage, it seems that mirroring GFAS data specifically for integration tests is the lowest friction path forward:

• run tests locally
• upload any fetched GFAS files to the data to tests/gfas/* in the public data store
• add a workflow step (after test data cache step) to fetch GFAS files into the input cache path
• delete the GHA test data cache
• remove ADS credentials from GHA secrets
• push a change and ensure that tests pass
• restore ADS credentials to GHA secrets

If we're really worried about the ADS integration being tested, we can write a test step which only runs for internal PRs/pushes that runs the test_cdsapi_connection integration test in tests/integration/test_sector_fire/test_sector_fire.py (it's currently skipped).

• Exclude test_cdsapi_connection from normal GHA test step
• Add exclusive test_cdsapi_connection test step, only if running on the official repo

This may mean that CDS connection tests don't run in external PRs, but as they get merged to main by a contributor they will be run in the push event to main. This would at least alert us to issues in the repo, even if the change was already merged.