WORKFLOW: added a post in the PR with the PR flatpak to be tested

.github/workflows/build_retrodeck.yml

@@ -16,15 +16,24 @@ on:
       - '*.sh'
       - 'net.retrodeck.retrodeck.yml'
       - 'net.retrodeck.retrodeck.appdata.xml'
-  pull_request:
+  pull_request_target:
+    types: [opened, synchronize, reopened]
     branches:
       - main
       - cooker*
+      - feat/*
+  pull_request:
+    types: [opened, synchronize, reopened]
+    branches:
+      - main
+      - cooker*
+      - feat/*
 
   workflow_dispatch:
 
 permissions:
   contents: write
+  pull-requests: write
 
 jobs:
 
@@ -46,10 +55,37 @@ jobs:
 
       # Clone Repository
       - name: Clone RetroDECK repo
+        if: github.event_name != 'pull_request_target'
         uses: actions/checkout@v4
         with:
           submodules: true
 
+      # Clone the target branch (eg. cooker)
+      - name: Clone Target Branch
+        if: github.event_name == 'pull_request_target'
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.base.ref }}  # Branch target
+          submodules: true
+
+      # Because we're using pull_request_target, we need to merge the PR code
+      - name: Merge PR Code
+        if: github.event_name == 'pull_request_target'
+        run: |
+          git fetch origin pull/${{ github.event.pull_request.number }}/head:pr
+          git merge --no-ff pr || {
+            echo "Merge conflict detected. Please resolve conflicts manually.";
+            exit 1;
+          }
+      # In case of PR we merged the code so we want to check that is consistent
+      - name: Validate Merged Code
+        if: github.event_name == 'pull_request_target'
+        run: |
+          echo "Branch after merge:"
+          git branch
+          echo "Last commit:"
+          git log -1 --oneline
+
       # Install Dependencies
       - name: Install dependencies
         run: curl "https://raw.githubusercontent.com/RetroDECK/components-template/main/automation_tools/install_dependencies.sh" | bash
@@ -188,7 +224,6 @@ jobs:
       - name: Generate a token for Rekku
         id: generate-rekku-token
         uses: actions/create-github-app-token@v1
-        if: github.event_name != 'pull_request'
         with:
           app-id: ${{ vars.REKKU_APP_ID }}
           private-key: ${{ secrets.REKKU_PRIVATE_KEY }}
@@ -230,25 +265,9 @@ jobs:
           path: |
             RetroDECK*.flatpak
             RetroDECK*.flatpak.sha
-            RetroDECK*Artifact.tar.gz
+            RetroDECK*Artifact.tar.gz        
-
-      - name: Post PR comment with artifacts
-        if: github.event_name == 'pull_request'
-        uses: marocchino/sticky-pull-request-comment@v2
-        with:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          REPO_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          header: "RetroDECK Build Artifacts"
-          message: |
-            A build for this pull request has completed successfully.
-            Codenname: ${{ steps.version-tag.outputs.TAG }}
-            Here are the artifacts to install and test:
-            - RetroDECK Flatpak: [RetroDECK.flatpak](./retrodeck-artifacts/RetroDECK.flatpak)
-            - SHA256 Checksum: [RetroDECK.flatpak.sha](./retrodeck-artifacts/RetroDECK.flatpak.sha)
-            - Artifact Bundle: [RetroDECKArtifact.tar.gz](./retrodeck-artifacts/RetroDECKArtifact.tar.gz)
 
   GitHub-publish:
-    if: github.event_name != 'pull_request'
     runs-on: ubuntu-latest
     needs: Build_RetroDECK
     env:
@@ -260,7 +279,6 @@ jobs:
       - name: Generate a token for Rekku
         id: generate-rekku-token
         uses: actions/create-github-app-token@v1
-        if: github.event_name != 'pull_request'
         with:
           app-id: ${{ vars.REKKU_APP_ID }}
           private-key: ${{ secrets.REKKU_PRIVATE_KEY }}
@@ -293,6 +311,20 @@ jobs:
           repo: ${{ env.REPO_NAME }}
           token: ${{ steps.generate-rekku-token.outputs.token }}
 
+      - name: Post PR comment with artifacts
+        if: github.event_name == 'pull_request_target' || github.event_name == 'pull_request'
+        uses: marocchino/sticky-pull-request-comment@v2
+        with:
+          GITHUB_TOKEN: ${{ steps.generate-rekku-token.outputs.token }}
+          header: "RetroDECK Build Artifacts"
+          message: |
+            A build for this pull request has completed successfully.
+            Codenname: ${{ env.TAG }}
+            Build artifacts can be find [here]((https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}#artifact-retrodeck-artifacts)) and they include:
+            - RetroDECK Flatpak: RetroDECK.flatpak
+            - Flatpak file SHA256 checksum: RetroDECK.flatpak.sha
+            - Flatpak Artifact Bundle: RetroDECKArtifact.tar.gz, not useful for testing or end users
+
       # Rewrite Tag (for Main Branch Only)
       - name: Rewrite Tag
         if: github.ref == 'refs/heads/main'
@@ -373,5 +405,4 @@ jobs:
       # Uninstall RetroDECK Flatpak - Not needed on a thorwaway ubuntu-latest
       # - name: Uninstall RetroDECK Flatpak
       #   run: |
-      #     flatpak remove --user --noninteractive -y net.retrodeck.retrodeck
+      #     flatpak remove --user --noninteractive -y net.retrodeck.retrodeck
-