Proper setup for deployments, restyled, etc for the external contributors

[yathomasi]

@iterative/websites folks we need to figure out deployments, restyled, etc for the external contributors when we have time. Something happened to the restyled. Can we use the logic similar to the one we did in PyDrive2 that @0x2b3bfa0 discovered (using pull_request_target and deployments to approve runs - https://github.com/iterative/PyDrive2/blob/main/.github/workflows/test.yml ?)

Originally posted by @shcheklein in #3964 (comment)

[yathomasi]

Also, @iterative/mlem might also have a similar setup to trigger using GHA. I will need to see if we can trigger deployment, and restyled on a similar setup.

[aguschin]

Yes, we do approves to trigger runs. Earlier someone suggested to split tests into two chunks: one that doesn't require secrets (can run without approval) and the other that requeires them and has to be approved each time, manually.

[0x2b3bfa0]

• See Allow access to secrets for external contributors cml#574 (comment) for more information¹

Footnotes

1. ...and bear with me for procrastinating a decent blog post. 😅 ↩

[yathomasi]

Restyled has been pretty inconsistent lately. Related slack thread on the topic

We can have our own workflow to run the fix (we can also run other tools that can autofix) and create a PR. I have been testing this lately and have done a few iterations to handle the possible edge-case scenarios as well.

Note: There is one caveat with this approach, which we are already pretty familiar with, which is that we need to close and open the PR to run the workflows in PR. We can have this in the PR description to help with this, like we have been doing where we have used it.

• Update version and CHANGELOG for release vscode-dvc#5046
• Bump version to v0.3.11 gatsby-theme-iterative#245

GHA workflow to autofix

name: Auto Fix Linting and Prettier Errors

on:
  workflow_run:
    workflows: ["Check"]
    types:
      - completed

jobs:
  autofix:
    if: ${{ github.event.workflow_run.conclusion == 'failure' && !startsWith(github.event.workflow_run.head_branch, 'autofix/') }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.workflow_run.head_branch }}
      - name: Setup Node and yarn
        uses: actions/setup-node@v4
        with:
          node-version: 20.x
          cache: yarn
      - name: Install dependencies
        run: yarn install

      - name: Close PR if already exists
        continue-on-error: true
        run: |
          gh pr close autofix/${{ github.event.workflow_run.head_branch }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Run fix-all and create PR
        run: |
          git config --global user.name "${GITHUB_ACTOR}"
          git config --global user.email "${GITHUB_ACTOR}@users.noreply.github.com"
          git checkout -b autofix/${{ github.event.workflow_run.head_branch }}

          yarn fix-all

          git commit -am "Fix lint and prettier errors"
          git push --set-upstream origin HEAD -f
          
          gh pr create --base ${{ github.event.workflow_run.head_branch }} --title "autofix(#${{github.event.workflow_run.pull_requests[0].number}}) - ${{ github.event.workflow_run.display_title }}" --body "Automated fixes for #${{ github.event.workflow_run.pull_requests[0].number }} , created using Github Actions. 
          
          **Note**: Please close and reopen this PR to run the Github action workflows on this PR.
          "
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

To add to this, we could enable workflows to run for external contributions by utilizing the method that @0x2b3bfa0 proposes here: https://iterative.ai/blog/testing-external-contributions-using-github-actions-secrets#workflow.

cc: @shcheklein

[shcheklein]

Can we use https://pre-commit.ci/ folks as a replacement, I think I saw in the YOLO ultralytics repo and it was working fine even for forks and probably consistent with the regular pre-commit.