Add pull_request_target workflows for community PRs

.github/workflows/build-android-target.yml

@@ -0,0 +1,35 @@
+# This workflow is intended to be run when we need to build the Android SDK and produce artifacts that require secrets
+# when the PR source branch does not have access to secrets (e.g. a fork).
+# This workflow will run in the context of the target of the PR and have access to secrets.
+# This should only be done after reviewing the PR to ensure that no malicious code has been introduced,
+# as it could allow the code on the forked branch to have access to workflow secrets.
+
+name: Build Android on PR Target
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+    branches:
+      - main
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  check-run:
+    name: Check PR run
+    uses: bitwarden/gh-actions/.github/workflows/check-run.yml@main
+    permissions:
+      contents: read
+
+  run-workflow:
+    name: Build Android
+    needs: check-run
+    if: ${{ github.event.pull_request.head.repo.full_name != github.repository }}
+    uses: ./.github/workflows/build-android.yml
+    secrets: inherit
+    permissions:
+      contents: read
+      pull-requests: write
+      id-token: write

.github/workflows/build-android.yml

@@ -11,6 +11,14 @@ on:
         description: "Update Android Repo - Opens a PR updating the SDK in bitwarden/android"
         type: boolean
         default: false
+  workflow_call:
+    secrets:
+      AZURE_SUBSCRIPTION_ID:
+        required: true
+      AZURE_TENANT_ID:
+        required: true
+      AZURE_CLIENT_ID:
+        required: true
 
 defaults:
   run:
@@ -69,6 +77,7 @@ jobs:
     name: Combine
     runs-on: ubuntu-24.04
     needs: build
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     outputs:
       sdk-package-id: ${{ steps.publish.outputs.sdk-package-id }}
       sdk-version: ${{ steps.publish.outputs.sdk-version }}
@@ -79,10 +88,11 @@ jobs:
     steps:
       - name: Checkout repo (PR)
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        if: github.event_name == 'pull_request'
+        if: github.event_name == 'pull_request' || github.event_name == 'pull_request_target'
         with:
           fetch-depth: 0
-          ref: ${{ github.event.pull_request.head.ref }}
+          ref: ${{ github.event.pull_request.head.sha }}
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
           persist-credentials: false
 
       - name: Checkout repo (Push or manual run)
@@ -141,7 +151,7 @@ jobs:
 
   check-android-breaking-changes:
     name: Check for Android breaking changes
-    if: github.event_name == 'pull_request'
+    if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
     needs: combine
     permissions:
       contents: read

.github/workflows/build-wasm-internal-target.yml

@@ -0,0 +1,35 @@
+# This workflow is intended to be run when we need to build the WASM SDK and produce artifacts that require secrets
+# when the PR source branch does not have access to secrets (e.g. a fork).
+# This workflow will run in the context of the target of the PR and have access to secrets.
+# This should only be done after reviewing the PR to ensure that no malicious code has been introduced,
+# as it could allow the code on the forked branch to have access to workflow secrets.
+
+name: Build @bitwarden/sdk-internal on PR Target
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+    branches:
+      - main
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  check-run:
+    name: Check PR run
+    uses: bitwarden/gh-actions/.github/workflows/check-run.yml@main
+    permissions:
+      contents: read
+
+  run-workflow:
+    name: Build @bitwarden/sdk-internal
+    needs: check-run
+    if: ${{ github.event.pull_request.head.repo.full_name != github.repository }}
+    uses: ./.github/workflows/build-wasm-internal.yml
+    secrets: inherit
+    permissions:
+      contents: read
+      pull-requests: write
+      id-token: write

.github/workflows/build-wasm-internal.yml

@@ -8,6 +8,14 @@ on:
       - "rc"
       - "hotfix-rc"
   workflow_dispatch:
+  workflow_call:
+    secrets:
+      AZURE_SUBSCRIPTION_ID:
+        required: true
+      AZURE_TENANT_ID:
+        required: true
+      AZURE_CLIENT_ID:
+        required: true
 
 permissions: {}
 
@@ -35,13 +43,22 @@ jobs:
             readable: "commercial license"
 
     steps:
-      - name: Checkout repo
+      - name: Checkout repo (PR)
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        if: github.event_name == 'pull_request' || github.event_name == 'pull_request_target'
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
+          persist-credentials: false
+
+      - name: Checkout repo (Push or manual run)
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
         with:
           persist-credentials: false
 
       - name: Set version (PR)
-        if: ${{ github.event_name == 'pull_request' }}
+        if: ${{ github.event_name == 'pull_request' || github.event_name == 'pull_request_target' }}
         env:
           PR_HEAD_REF: "${{ github.event.pull_request.head.ref }}"
         run: |
@@ -110,8 +127,17 @@ jobs:
     permissions:
       contents: read
     steps:
-      - name: Checkout repo
+      - name: Checkout repo (PR)
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        if: github.event_name == 'pull_request' || github.event_name == 'pull_request_target'
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
+          persist-credentials: false
+
+      - name: Checkout repo (Push or manual run)
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
         with:
           persist-credentials: false
 
@@ -138,7 +164,7 @@ jobs:
 
   trigger-wasm-publish:
     name: Trigger WASM publish
-    if: github.ref == 'refs/heads/main'
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-24.04
     needs: build
     permissions:
@@ -155,7 +181,9 @@ jobs:
 
   trigger-breaking-change-check:
     name: Trigger client breaking change checks
-    if: github.event_name == 'pull_request'
+    if: |
+      (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) ||
+      github.event_name == 'pull_request_target'
     needs: build
     permissions:
       contents: read