change salesloft build workflow to use github runners

[mshepet]

Switch to using github hosted runners instead of self-hosted runners

[adrianmoisey]

Why move them to github's runners?

[mshepet]

Why move them to github's runners?

This repo doesn't have access to launch workflows on the self-hosted runners, and I don't think it's a good idea to open up access from a public repository.

[adrianmoisey]

This repo doesn't have access to launch workflows on the self-hosted runners, and I don't think it's a good idea to open up access from a public repository.

Oh interesting.

If we use public runners, then we need to be writing harbor secrets to public infra, that also doesn't seem like an ideal situation.

What is the concern with using our runners? The rules are to only run the workflow when there is a push to a branch, even though the repo is public, nobody should be able to push to branches.

[mshepet]

This repo doesn't have access to launch workflows on the self-hosted runners, and I don't think it's a good idea to open up access from a public repository.

Oh interesting.

If we use public runners, then we need to be writing harbor secrets to public infra, that also doesn't seem like an ideal situation.

This repo doesn't push to harbor, it pushes to a public Docker Hub registry.

What is the concern with using our runners? The rules are to only run the workflow when there is a push to a branch, even though the repo is public, nobody should be able to push to branches.

Following the recommendation from GitHub here https://docs.github.com/en/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#self-hosted-runner-security

[adrianmoisey]

Their recommendation seems pretty compelling

[adrianmoisey]

This repo doesn't have access to launch workflows on the self-hosted runners, and I don't think it's a good idea to open up access from a public repository.

Oh interesting.

If we use public runners, then we need to be writing harbor secrets to public infra, that also doesn't seem like an ideal situation.

What is the concern with using our runners? The rules are to only run the workflow when there is a push to a branch, even though the repo is public, nobody should be able to push to branches.

I assume that someone could fork the repo, change the workflow to be "on PR" and run something on our runners