Add functionality for allow self-hosted runner to protect workflow file and allow only execution only for collaborators for PRS

Description:

Hi all, first of all I really like the github action runner and self-hosted runner.

It has however an issue with working for pull-request workflows.

I think the runner should have a way to be configurable to run only on Pull-requests from collaborator of X org or Repo. The problem to be solved is to protect the github-workflow file and don’t be changed by any arbitrary PR ( so there is no output redirection or other code executed) it is a recurring topic in some forums, but there is no solution or any issue about this afaik. let me know, and ping me for any info .

best

[eladchen]

How about this:

An example:

Let’s say .github/workflows/pull-request.yml exists, and the suggested checkbox above is checked, and user John / DEV team is configured.

Workflow “.github/workflows/pull-request.yml” will not be executed if:

• A pull request is created based of a forked repository
• The pull request changed files include .github/workflows/pull-request.yml
• The pull request is not authored (triggered?) by user John / a member of DEV team.

This allows contributors to create pull requests, and have workflows provide them (and maintainers) with feedback on the changes introduced by the pull request, and, in the same time preventing untrusted parties from changing a workflow, thus preventing any security issues that might arise.

WDYT?

[TingluoHuang]

@MalloZup sounds like some policy feature we can add on the service side even before sending the job to the runner.

@chrispat for feedback.