Github Action for pushing forks to upstream

[scholtzan]

This wraps the git-push-fork-to-upstream-branch script into a Github Action. The CircleCI config has been updated to have a failing tasks for forks that will show instructions of how to trigger the Github Actions so that integration tests will get executed for forks.

I successfully tested this approach in this repository: https://github.com/scholtzan/gh-actions-test

The main advantage here is that we don't have to share secrets with forks, however it might be a little unintuitive.

Another option that came to mind that we could try:

• All environment variables (our secrets) get moved into a restricted context
• The setup is essentially the same as described here: Bug 1681899 - Update and re-enable size check CI job glean.js#422 (comment)
• When sharing secrets also SSH keys are being shared, so we'd need to remove deploy keys from the repository settings and move them to environment variables managed by the restricted context
  • The CircleCI config would need to be rewritten to use the SSH keys from the environment variable

This seems a little less safe since it would require sharing secrets with forks (although if set up correctly it should not pose a security problem). Also not sure how much effort rewriting the CircleCI config would be.

[jklukas]

r+wc

Don't hesitate to go ahead and merge this so that we can do some more concrete testing of this workflow, and then we can PR improvements as needed.

[scholtzan]

this repository doesn't seem to support the webfactory/ssh-agent@v0.5.1 plugin:

webfactory/ssh-agent@v0.5.1 is not allowed to be used in mozilla/bigquery-etl. Actions in this workflow must be: within a repository that belongs to your Enterprise account, created by GitHub or match the following: !/mozilla/**, !mozilla/**, ./**, aws-actions/*, docker/*, pypa/gh-action-pypi-publish@release/v1.4.2.