ci: Add workflow to regenerate static assets

[PythonGermany]

Summary

Closes #1454. This workflow will never work if the pull request author has set the PR option Allow edits and access to secrets by maintainers to false.

I am currently not sure how to easily test if the permissions are given to push to the feature branch of the PR in the forked repo when the workflow runs in the base repo.

If there are no checkout or push permission issues the workflow works. I already tested it with PRs in my fork with the base in the same repository.

TODO

• Make sure only trusted sources can trigger workflow, e.g. a specific actor or only people with write access! -> covered by github/command action

Checklist

• (n/a) Tested and/or added tests to validate that the changes work as intended, if applicable.
• (n/a) Updated documentation in README.md, if applicable.

[PythonGermany]

@TwiN We can start thinking about how to test/introduce this properly. Does the current version already cover all the needs for this repo? I don't want to make it more complicated than it needs to be.

The issue with testing is that the workflow trigger issue_comment only works once the workflow is in the default branch. I don't know how to test if everything works in terms of permissions, since I'd probably first need to create a second GitHub user to fork a test repo containing the new workflow to test the whole final scenario before actually merging it. Can you think of an easier way?

[TwiN]

There's no need to test this. I'll manually test it once it's merged in the master branch, and make adjustments as necessary.

[PythonGermany]

There are still two open questions I have:

• Whether or not to allow the workflow to be run on draft pull requests
• Whether or not to require reviews before this workflow can be run

The restriction to require reviews required probably makes sense and if reviews are required the restriction to only allow non-draft PRs makes sense too since draft PRs can not be approved, I think.

[TwiN]

Yes for the former, no for the latter.

Does this currently not work for draft PRs?

[PythonGermany]

Does this currently not work for draft PRs?

The default for the action is not to allow it. I enabled it now.

Have I understood correctly: The wanted behavior is like this?

allow_drafts: true
skip_ci: true # Meaning CI check do not need to pass to allow updating static assets
skip_reviews: false # Meaning there needs to be a review before updating static assets is allowed

If any conditions fail the action will add a comment to the PR explaining which condition is not met, e.g PythonGermany#23 (comment)

[PythonGermany]

Just tested it again, in my fork it works just as intended: PythonGermany#18 (comment)

[TwiN]

Excellent work, @PythonGermany!

[TwiN]

@PythonGermany To answer your questions, it seems to be perfectly configured as-is in your branch

[PythonGermany]

Great to hear. If there are any issues let me know!