Skip signed plugin build on pull requests

[lpetrora]

A pull request from a fork is not able to build the signed plugin due to the secret API KEY, so this step should be skipped. In other instances, like releases and daily builds, the signed plugin should be created.

[BenediktSeidl]

hm. but this would mean, this is also skipped if we do internal pull requests, like this one, right?
so if we want to debug the signing, we would have to merge it into the master, otherwise we can not test it?
have you seen pull_request_target? https://runs-on.com/github-actions/pull-request-vs-pull-request-target/

what do you think of the following: we change the event to pull_request_target (thus external prs can access our secrets) but activate that all external collaborations have to be manually approved:
https://docs.github.com/en/actions/managing-workflow-runs-and-deployments/managing-workflow-runs/approving-workflow-runs-from-public-forks

[lpetrora]

You are right, I did not consider our PRs. Your solution works but will add us the additional task to manually validate the collaborators.
What do you think about triggering the validation if the action does not come from a PR or if the PR comes from our own repo?

(github.event_name != 'pull_request') || (github.event.pull_request.head.repo.full_name == github.repository)

[BenediktSeidl]

nice. i have also searched for something like that, but could not find it.
the worst thing that can happen with your solution is that the signed build fails, which is not a catastrophe, so let's go for it!