Cleanup GH Actions

.github/actions/setup-base/action.yml

@@ -8,8 +8,6 @@ runs:
       uses: actions/checkout@v6
       with:
         submodules: recursive
-        ref: ${{github.event.pull_request.head.ref}}
-        repository: ${{github.event.pull_request.head.repo.full_name}}
 
     - name: Install dependencies
       shell: bash

.github/workflows/build_debian_src.yml

@@ -28,8 +28,6 @@ jobs:
         with:
           submodules: recursive
           path: meshtasticd
-          ref: ${{github.event.pull_request.head.ref}}
-          repository: ${{github.event.pull_request.head.repo.full_name}}
 
       - name: Install deps
         shell: bash
@@ -42,6 +40,7 @@ jobs:
           sudo mk-build-deps --install --remove --tool='apt-get -o Debug::pkgProblemResolver=yes --no-install-recommends --yes' debian/control
 
       - name: Import GPG key
+        if: github.event_name != 'pull_request' && github.event_name != 'pull_request_target'
         uses: crazy-max/ghaction-import-gpg@v7
         with:
           gpg_private_key: ${{ secrets.PPA_GPG_PRIVATE_KEY }}
@@ -60,7 +59,7 @@ jobs:
         run: debian/ci_pack_sdeb.sh
         env:
           SERIES: ${{ inputs.series }}
-          GPG_KEY_ID: ${{ steps.gpg.outputs.keyid }}
+          GPG_KEY_ID: ${{ steps.gpg.outputs.keyid || '' }}
           PKG_VERSION: ${{ steps.version.outputs.deb }}
 
       - name: Store binaries as an artifact

.github/workflows/build_firmware.yml

@@ -26,8 +26,6 @@ jobs:
       - uses: actions/checkout@v6
         with:
           submodules: recursive
-          ref: ${{github.event.pull_request.head.ref}}
-          repository: ${{github.event.pull_request.head.repo.full_name}}
 
       - name: Build ${{ inputs.platform }}
         id: build

.github/workflows/docker_build.yml

@@ -50,8 +50,6 @@ jobs:
         uses: actions/checkout@v6
         with:
           submodules: recursive
-          ref: ${{github.event.pull_request.head.ref}}
-          repository: ${{github.event.pull_request.head.repo.full_name}}
 
       - name: Get release version string
         run: |

.github/workflows/docker_manifest.yml

@@ -86,8 +86,6 @@ jobs:
         uses: actions/checkout@v6
         with:
           submodules: recursive
-          ref: ${{github.event.pull_request.head.ref}}
-          repository: ${{github.event.pull_request.head.repo.full_name}}
 
       - name: Get release version string
         run: |

.github/workflows/hook_copr.yml

@@ -22,8 +22,6 @@ jobs:
         uses: actions/checkout@v6
         with:
           submodules: recursive
-          ref: ${{ github.ref }}
-          repository: ${{ github.repository }}
 
       - name: Trigger COPR build
         uses: vidplace7/copr-build@main

.github/workflows/main_matrix.yml

@@ -15,8 +15,7 @@ on:
       - "**.md"
       - version.properties
 
-  # Note: This is different from "pull_request". Need to specify ref when doing checkouts.
+  pull_request:
-  pull_request_target:
     branches:
       - master
       - develop
@@ -88,8 +87,6 @@ jobs:
       - uses: actions/checkout@v6
         with:
           submodules: recursive
-          ref: ${{github.event.pull_request.head.ref}}
-          repository: ${{github.event.pull_request.head.repo.full_name}}
       - name: Check ${{ matrix.check.board }}
         uses: meshtastic/gh-action-firmware@main
         with:
@@ -173,9 +170,6 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v6
-        with:
-          ref: ${{github.event.pull_request.head.ref}}
-          repository: ${{github.event.pull_request.head.repo.full_name}}
 
       - uses: actions/download-artifact@v8
         with:
@@ -245,7 +239,7 @@ jobs:
     needs: [build]
     steps:
       - uses: actions/checkout@v6
-        if: github.event_name == 'pull_request_target'
+        if: github.event_name == 'pull_request'
         with:
           filter: blob:none # means we download all the git history but none of the commit (except ones with checkout like the head)
           fetch-depth: 0
@@ -263,21 +257,21 @@ jobs:
           overwrite: true
           path: manifests-new/*.mt.json
       - name: Find the merge base
-        if: github.event_name == 'pull_request_target'
+        if: github.event_name == 'pull_request'
         run: echo "MERGE_BASE=$(git merge-base "origin/$base" "$head")" >> $GITHUB_ENV
         env:
           base: ${{ github.base_ref }}
           head: ${{ github.sha }}
       # Currently broken (for-loop through EVERY artifact -- rate limiting)
       # - name: Download the old manifests
-      #   if: github.event_name == 'pull_request_target'
+      #   if: github.event_name == 'pull_request'
       #   run: gh run download -R "$repo" --name "manifests-$merge_base" --dir manifest-old/
       #   env:
       #     GH_TOKEN: ${{ github.token }}
       #     merge_base: ${{ env.MERGE_BASE }}
       #     repo: ${{ github.repository }}
       # - name: Do scan and post comment
-      #   if: github.event_name == 'pull_request_target'
+      #   if: github.event_name == 'pull_request'
       #   run: python3 bin/shame.py ${{ github.event.pull_request.number }} manifests-old/ manifests-new/
 
   release-artifacts:

.github/workflows/package_pio_deps.yml

@@ -27,8 +27,6 @@ jobs:
         uses: actions/checkout@v6
         with:
           submodules: recursive
-          ref: ${{github.event.pull_request.head.ref}}
-          repository: ${{github.event.pull_request.head.repo.full_name}}
 
       - name: Setup Python
         uses: actions/setup-python@v6

.github/workflows/package_ppa.yml

@@ -36,8 +36,6 @@ jobs:
         with:
           submodules: recursive
           path: meshtasticd
-          ref: ${{github.event.pull_request.head.ref}}
-          repository: ${{github.event.pull_request.head.repo.full_name}}
 
       - name: Install deps
         shell: bash

.github/workflows/test_native.yml

@@ -16,8 +16,6 @@ jobs:
     steps:
       - uses: actions/checkout@v6
         with:
-          ref: ${{github.event.pull_request.head.ref}}
-          repository: ${{github.event.pull_request.head.repo.full_name}}
           submodules: recursive
 
       - name: Setup native build
@@ -72,8 +70,6 @@ jobs:
     steps:
       - uses: actions/checkout@v6
         with:
-          ref: ${{github.event.pull_request.head.ref}}
-          repository: ${{github.event.pull_request.head.repo.full_name}}
           submodules: recursive
 
       - name: Setup native build
@@ -128,9 +124,6 @@ jobs:
     if: always()
     steps:
       - uses: actions/checkout@v6
-        with:
-          ref: ${{github.event.pull_request.head.ref}}
-          repository: ${{github.event.pull_request.head.repo.full_name}}
 
       - name: Get release version string
         run: echo "long=$(./bin/buildinfo.py long)" >> $GITHUB_OUTPUT

debian/ci_pack_sdeb.sh

@@ -27,5 +27,10 @@ rm -rf debian/changelog
 dch --create --distribution "$SERIES" --package "$package" --newversion "$PKG_VERSION~$SERIES" \
 	"GitHub Actions Automatic packaging for $PKG_VERSION~$SERIES"
 
-# Build the source deb
+if [[ -n $GPG_KEY_ID ]]; then
-debuild -S -nc -k"$GPG_KEY_ID"
+	# Build and sign the source deb
+	debuild -S -nc -k"$GPG_KEY_ID"
+else
+	# Build the source deb without signing (forks)
+	debuild -S -nc
+fi