Merge pull request #3028 from alphagov/percy-secret-permissions

Skip “Percy screenshots” when secrets are unavailable on forks

.github/workflows/screenshots.yml

@@ -0,0 +1,34 @@
+name: Percy screenshots
+
+on:
+  workflow_call:
+  workflow_dispatch:
+
+concurrency:
+   group: screenshots-${{ github.head_ref || github.run_id }}
+   cancel-in-progress: true
+
+jobs:
+  screenshots:
+    name: Send screenshots
+    runs-on: ubuntu-latest
+
+    env:
+      PERCY_TOKEN: ${{ secrets.PERCY_TOKEN }}
+      PORT: 8888
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Install dependencies
+        uses: ./.github/workflows/actions/install-node
+
+      - name: Build
+        uses: ./.github/workflows/actions/build
+
+      - name: Start review application
+        run: npm run serve &
+
+      - name: Send screenshots to Percy
+        run: npx percy exec -- npm run test:screenshots

.github/workflows/tests.yml

@@ -162,26 +162,13 @@ jobs:
         run: ${{ matrix.run }}
 
   regression:
-    name: Send screenshots to Percy
-    runs-on: ubuntu-latest
+    name: Percy
     needs: [install, build]
 
-    env:
-      PERCY_TOKEN: ${{ secrets.PERCY_TOKEN }}
-      PORT: 8888
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-
-      - name: Restore dependencies
-        uses: ./.github/workflows/actions/install-node
-
-      - name: Restore build
-        uses: ./.github/workflows/actions/build
-
-      - name: Start review application
-        run: npm run serve &
+    # Run existing "Percy screenshots" workflow
+    # (after install and build have been cached)
+    uses: ./.github/workflows/screenshots.yml
+    secrets: inherit
 
-      - name: Send screenshots to Percy
-        run: npx percy exec -- npm run test:screenshots
+    # Skip when secrets are unavailable on forks
+    if: ${{ github.repository_owner == 'alphagov' }}