Previews Broken for PRs originating in Forks

[wildintellect]

This is probably a permissions/security problem related to not previewing content generated outside of the main fork. https://github.com/cloudnativegeo/cloud-optimized-geospatial-formats-guide/actions/runs/6354887466/job/17262077823?pr=73

TODO: research the github recommended solution for how to deal with this. I know I've seen it written about before.

Acceptance Criteria

• [ ] PRs regardless of fork origin can be previewed before accepting a PR.

[wildintellect]

Research:

• https://github.blog/2020-08-03-github-actions-improvements-for-fork-and-pull-request-workflows/
• https://github.com/orgs/community/discussions/7730
• https://docs.github.com/en/actions/managing-workflow-runs/approving-workflow-runs-from-public-forks

pull_request_target seems to be the answer but there are deep security implications. Need to read through how to properly protect the repository.

• https://docs.boostsecurity.io/rules/cicd-gha-risky-pull-request-target-usage.html
• https://securitylab.github.com/research/github-actions-preventing-pwn-requests/

[wildintellect]

The github action we're using does not support forks yet.

This Action does not currently support deploying previews for PRs from forks, but will do so in https://github.com/rossjrw/pr-preview-action/pull/6.

[zacharyDez]

I propose the following workaround to integrate external forks in the meantime that we decide on another solution:

• We create a staging branch
• We only run the preview action on PRs to main
• We create some branch restrictions to only accept PRs from staging to main