Switch off BrowserStack for PRs from community

[pomek]

The problem occurs here – ckeditor/ckeditor5-image#168.

We have a PR created from the forked repository. Unfortunately, Travis does not allow decrypting variables in such cases.

A pull request sent from a fork of the upstream repository could be manipulated to expose any environment variables. The upstream repository’s maintainer would have no protection against this attack, as pull requests can be sent by anyone with a fork.

Travis CI makes encrypted variables and data available only to pull requests coming from the same repository. These are considered trustworthy, as only members with write access to the repository can send them.

Pull requests sent from forked repositories do not have access to encrypted variables or data.

So, we have to change our dev script. BrowserStack cannot be used if a PR comes from the forked repositories.

We also cannot change a way how we want to decrypt the variables because a user can put in forked .travis.yml file something like echo VARIABLE_NAME and our secret will not be a secret anymore.

[pomek]

const enableBrowserStack = () => {
	return process.env.TRAVIS_EVENT_TYPE !== 'pull_request' || process.env.TRAVIS_PULL_REQUEST_SLUG === process.env.TRAVIS_REPO_SLUG;
};

The code above allows detecting whether BrowserStack should be enabled or disabled during the build.

[pomek]

Unfortunately, https://travis-ci.org/ckeditor/ckeditor5-enter/builds/370395961 proves that the bug still exists.

[pomek]

Reported as a new issue – https://github.com/ckeditor/ckeditor5-dev/issues/402.