fix(ci): Skip GCP CI jobs on PRs from external contributors, let mergify test them after approval

[teor2345]

Motivation

This is a quick fix for CI failures on PRs from external repositories.

We've asked the ZSA and ZSF teams to submit PRs, so let's make it a good experience for them.

Close #4529.

PR Author Checklist

Check before marking the PR as ready for review:

• Will the PR name make sense to users?
• Does the PR have a priority label?
• Have you added or updated tests?
• Is the documentation up to date?

For significant changes:

• Is there a summary in the CHANGELOG?
• Can these changes be split into multiple PRs?

If a checkbox isn't relevant to the PR, mark it as done.

This is a significant change for external developers, but we can add it to the changelog in another PR.

Specifications

GitHub context and the difference between ref and head_ref:
https://docs.github.com/en/actions/learn-github-actions/contexts#github-context

Skipping individual job steps:
https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsif

Example PRs and branch names

Internal PR: rate-limit-getaddr #7955
Recent external PR: rex4539/typos #7865
Dependabot: dependabot/github_actions/devops-599883908b #7948
Mergify: mergify/merge-queue/d948c06290 #7954

Complex Code or Requirements

We need to skip external branches in the actual CI jobs, but only run on changed files.

Then we need to run on external branches in the patch jobs, or run on unchanged files. This requires two patch workflow files. (Conditions in the same workflow file are both required, but we want either condition.)

Solution

• Skip GCP workflows on external PRs
• Add patch workflows for GCP workflows that run dummy jobs on external PRs
• Skip optional steps on external PRs because they are failing

Extra changes:

• Document some workflows
• Add a trivial Rust change so Rust GCP workflows run on this PR
• Cleanup some unnecessary workflow conditions and timeouts

Testing

We can check this using this branch, which is from @teor2345's external repository. But it won't be fully tested until we merge it, and get a branch from someone who isn't a ZF GitHub org member.

Review

I'd like to get this merged quickly so external developers have a good experience, and sort out any non-blocking changes later.

Reviewer Checklist

Check before approving the PR:

• Does the PR scope match the ticket?
• Are there enough tests to make sure it works? Do the tests cover the PR motivation?
• Are all the PR blockers dealt with?
  PR blockers can be dealt with in new tickets or PRs.

And check the PR Author checklist is complete.

[gustavovalverde]

This looks good to me, but I'd like to test it.

We have 2 options:

• Create a dummy account to trigger this
• Temporarily remove permission one of our members, and redo this PR.

[upbqdn]

[...] I'd like to test it.

This PR is from an external repository already, and the GCP jobs were skipped. We can test this on the upcoming PRs submitted by QEDIT.

[teor2345]

I just checked after the merge, and we're still running GCP jobs on the main branch. So all we have to check now is another PR from a non-Zebra contributor.

[gustavovalverde]

This PR is from an external repository already

That's correct, but it wasn't from an external contributor (which is the trigger for the permission issue). I just didn't want to wait until an external contributor made a contribution to confirm it's working as expected.

[teor2345]

This PR is from an external repository already

That's correct, but it wasn't from an external contributor (which is the trigger for the permission issue). I just didn't want to wait until an external contributor made a contribution to confirm it's working as expected.

I think there might have been some miscommunication here. We're expecting multiple PRs from the ZSA and sustainability fund teams over the next few weeks. The first one is #7978, which would have run CI, but it has merge conflicts.