The aiida-bot-app does not work with forks

[csadorf]

The aiida-bot-app currently fails for forks.

We need to update the workflow so that the bot app asks users to authenticate their fork with the app, so that the update-requirements workflow can be triggered.

Originally posted by @aiida-bot-app in #3912 (comment)

[csadorf]

I spend some time on investigating this problem and trying to find a good solution. Here is my summary of the current status:

Problem Analysis

I don't really care about apps, bots, or workflows: What we need are updated requirements files that are in line with the setup.json file. These files can be either manually created or possibly obtained from the 'test-install' workflow that installs from setup.json.

Preventing to push a branch with inconsistent requirements/ files (e.g. with a pre-commit hook) is highly limiting, because figuring out what constitutes an appropriate update is difficult. This is why we save the requirements/ files as part of the test-install workflow.

Ideally a workflow would automatically update the branch that triggered the change, however this is not reliably possible for forks, because on: pull_request workflows are executed on the base repository and the provided GITHUB_TOKEN has no write permissions to the fork. This means that it is impossible to reliably execute any workflows that act upon a branch of a fork (such as linters, labelers, etc.) with GitHub actions. This is a known limitation of GitHub actions:

• https://github.community/t5/GitHub-Actions/GitHub-actions-are-severely-limited-on-PRs/m-p/54669#M9249
• https://github.community/t5/GitHub-Actions/Token-permissions-for-forks-once-again/m-p/33839
• https://github.community/t5/GitHub-Actions/Github-Workflow-not-running-from-pull-request-from-forked/td-p/32979/

The current "solution" to use a bot app that triggers workflows for the update-requirements workflow by slash-command is facing similar issues with lack of permissions on forks, however PRs from forks is the primary mechanism for updates to aiida-core and we don't want to change that.

I therefore propose the following solutions which in both case will mean to suspend the aiida-bot in its current implementation. Please note that, accidentally merging commits with inconsistent requirements/ files is already prevented, because the corresponding test will fail the workflow on pull-requests.

Minimal improvement

As part of the continuous-integration workflow, update the commit message to describe the issue and provide a proposed manual solution.

We can further improve transparency by adding a GitHub actions warning to the setup.json and/or the requirements/ files.

Comprehensive improvement

In addition the minimal improvement, also check the consistency of the requirements/ files as part of the 'test-install' workflow and when they are inconsistent and tests pass, attempt to create a pull request to update the files (will fail for forks).

In case that this fails, show a CI warning message with instructions on how to install the files manually (download the requirements files from the workflow and push them to the branch).