Add option to build&push image on PR automatically

[mszostok]

ISSUE TYPE

• Feature Pull Request

SUMMARY

Add an option to push the BotKube image automatically on PR. It's alternative approach for #604.

This PR will solve the problem with manual PR builds, e.g. we had that issue here:

• Add support for cfg via env vars and define external volumes #601
• Use golangci-lint and resolve all found issues #593
• Update Go, Kubernetes and other dependencies #582
• Do not log full Slack event details in case of unmarshalling error #583

Example run: https://github.com/mszostok/botkube/runs/6714112689?check_suite_focus=true

Fixes #590

To ensure that secrets won't be available for untrusted code, first we need to build the image and share it with the second job, which doesn't check out the untrusted code and can safely push an artifact to ghcr.io.

The flow is as follows:

Job1: image build -> image save -> artifact upload 
Job2: artifact download -> image load -> image push

Job1—runs untrusted code but without write repo perms
Job2—push built image with package write perms

Security

This article describes it well: https://securitylab.github.com/research/github-actions-preventing-pwn-requests/

[pkosiec]

Just a few comments 🙂

[pkosiec]

Please apply these two small comments and run the job again on your fork, just to confirm it works. We'll be ready to merge this (ofc if @PrasadG193 agrees with this approach) 👍

[pkosiec]

Hi @mszostok,

As #615 will require that job with image build, maybe let's merge this? Generally it's LGTM from my side, but I would like to see it running on fork with the applied improvements before merge.

Even after merge, we can apply any other suggestions if necessary 👍 We will refine the solution over time anyway.
Thanks!

[mszostok]

Hi @pkosiec

Branch was rebased with the newest develop. I applied minor changes (628c1c7 5619734)

NOTE: second commit fixes problem reported by goreleaser:
⨯release failed after 0.03serror=failed to parse tag 'PR-6' as semver: Invalid Semantic Version
I prefer PR-{x} syntax but I had to go with v{x}-PR to solve the issue. Other option is to ignore the error on goreleaser side with --skip-validate.

The example run is here: https://github.com/mszostok/botkube/actions/runs/2534149331
To check locally, run: docker run ghcr.io/mszostok/pr/botkube:v6-PR

[pkosiec]

LGTM - but please remove v prefix if possible, to have a bit nicer tag. Thanks!