From eabea443a4826d570b55cdf1d13f5609fcea169f Mon Sep 17 00:00:00 2001
From: Angelos Kyratzakos <angelos.kyratzakos@mattermost.com>
Date: Fri, 19 Sep 2025 20:00:38 +0200
Subject: [PATCH] Update mmctl-test-template.yml to conditionally execute
 docker login for mattermost repository owner (#33920)

* Update mmctl-test-template.yml to conditionally execute docker login for mattermost repository owner

* Update build-server-image.yml and server-test-template.yml to conditionally execute docker login for mattermost repository owner

* Update workflow files to conditionally execute docker login for pull requests from mattermost/mattermost

* Enhance CI workflows to conditionally execute jobs for pull requests from mattermost/mattermost

* Remove conditional check for docker login in CI workflows to streamline execution across all pull requests

* Add conditional check for docker login in CI workflows for pull requests from mattermost/mattermost

* Refactor CI workflows to gracefully skip tests for external pull requests, enhancing clarity and execution flow

* revert checks

* skip fips testing for forks

* Fix fork detection in FIPS tests to allow push events

The previous condition `github.repository_owner == 'mattermost'` was
incorrect as it would always be false for forks. Updated to properly
detect forks using `github.event.pull_request.head.repo.full_name == github.repository`
and allow FIPS tests to run on push events.

---------

Co-authored-by: Jesse Hallam <jesse@mattermost.com>
---
 .github/workflows/mmctl-test-template.yml  | 2 ++
 .github/workflows/server-ci.yml            | 6 +++++-
 .github/workflows/server-test-template.yml | 2 ++
 3 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/mmctl-test-template.yml b/.github/workflows/mmctl-test-template.yml
index 1cde38dd92b..62e858d8d26 100644
--- a/.github/workflows/mmctl-test-template.yml
+++ b/.github/workflows/mmctl-test-template.yml
@@ -30,6 +30,8 @@ jobs:
       COMPOSE_PROJECT_NAME: ghactions
     steps:
       - name: buildenv/docker-login
+        # Only FIPS requires login for private build container. (Forks won't have credentials.)
+        if: inputs.fips-enabled
         uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
diff --git a/.github/workflows/server-ci.yml b/.github/workflows/server-ci.yml
index a5aaa8f910f..75d120007ec 100644
--- a/.github/workflows/server-ci.yml
+++ b/.github/workflows/server-ci.yml
@@ -205,6 +205,8 @@ jobs:
       go-version: ${{ needs.go.outputs.version }}
       fips-enabled: false
   test-postgres-normal-fips:
+    # Skip FIPS testing for forks, which won't have docker login credentials.
+    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
     name: Postgres (FIPS)
     needs: go
     uses: ./.github/workflows/server-test-template.yml
@@ -217,9 +219,9 @@ jobs:
       go-version: ${{ needs.go.outputs.version }}
       fips-enabled: true
   test-coverage:
+    name: Generate Test Coverage
     # Skip coverage generation for cherry-pick PRs into release branches.
     if: ${{ github.event_name != 'pull_request' || !startsWith(github.event.pull_request.base.ref, 'release-') }}
-    name: Generate Test Coverage
     needs: go
     uses: ./.github/workflows/server-test-template.yml
     secrets: inherit
@@ -245,6 +247,8 @@ jobs:
       fips-enabled: false
   test-mmctl-fips:
     name: Run mmctl tests (FIPS)
+    # Skip FIPS testing for forks, which won't have docker login credentials.
+    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
     needs: go
     uses: ./.github/workflows/mmctl-test-template.yml
     secrets: inherit
diff --git a/.github/workflows/server-test-template.yml b/.github/workflows/server-test-template.yml
index af696ab5081..838957adf86 100644
--- a/.github/workflows/server-test-template.yml
+++ b/.github/workflows/server-test-template.yml
@@ -43,6 +43,8 @@ jobs:
       COMPOSE_PROJECT_NAME: ghactions
     steps:
       - name: buildenv/docker-login
+        # Only FIPS requires login for private build container. (Forks won't have credentials.)
+        if: inputs.fips-enabled
         uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}