Allow moderated secrets usage on PRs from forks

[khaeru]

This PR implements the approach recommended by this article from Github's ‘Security Lab’ to allow the usage of secrets on PRs from forks of the message_ix repository.

• Add a "receive" CI workflow.
  • Run on all PRs into main.
  • Fail if (a) the PR is from a fork and (b) it does not have a certain label, currently "safe to test".
• Adjust the "pytest" CI workflow:
  • Add a workflow_run: event trigger. Invoke this trigger every time the "receive" workflow completes (success or failure).
  • Skip the main pytest and tutorials jobs if the "receive" workflow failed.
  • Invoke actions/checkout with the right options to use the fork PR branch.

With this merged, it would be up to some user with ‘write’ permissions on the current repo to give a first look-over of any PR from and then add the "safe to test" label. (The label could also be removed again at any time.)

How to review

Per the documentation:

This [workflow_run] event will only trigger a workflow run if the workflow file is on the default branch.

This means we will need to:

• Merge this PR.
• Create or update another PR (Add .tools.sankey and tutorial #770 was suggested).
• Confirm that the pytest workflow is invoked and runs successfully; if not, open a follow-up PR to adjust the workflow(s).

PR checklist

• Continuous integration checks all ✅
• Add or expand tests; coverage checks both ✅ N/A; CI changes only
• Add, expand, or update documentation.
• Update release notes.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 95.6%. Comparing base (b0365d6) to head (0ffb789).
Report is 41 commits behind head on main.

Additional details and impacted files

@@          Coverage Diff          @@
##            main    #893   +/-   ##
=====================================
  Coverage   95.6%   95.6%           
=====================================
  Files         46      46           
  Lines       4337    4337           
=====================================
  Hits        4147    4147           
  Misses       190     190           

[glatterf42]

Thanks, this looks promising to me :)
(Rebasing on main.)

[khaeru]

@glatterf42 FYI this appears not to have worked exactly as intended 🥲

When I opened #894:

• This workflow run on main was triggered —which should not have happened, or it should have exited early because that is not a PR from a fork.
• It failed, because this value

  message_ix/.github/workflows/pytest.yaml

  Line 82 in 433868d

  repository: ${{ github.event.workflow_run.repository }}

  
  …appears to be a JSON structure rather than the desired string "iiasa/message_ix".

I'll make a note to come back and revisit this.