ci: make ECR login and Docker-dependent jobs conditional on secret availability

- Make aws_ecr_login action tolerate missing inputs and skip gracefully
- Add check-secrets job to tests.yml that gates Docker image builds
- Skip dashmate E2E, test-suite, and functional tests when ECR is unavailable
- Make ECR login conditional in consumer workflows as defense-in-depth
- Cache protoc Docker image via actions/cache to avoid Docker Hub rate limits
- Make CodeQL DockerHub login conditional

Fork PRs now get: Rust tests, JS tests, linting, formatting, security audits
Fork PRs skip: Docker builds, E2E tests, test-suite, functional tests

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: PastaPastaPasta

.github/actions/aws_ecr_login/action.yaml

@@ -1,39 +1,53 @@
 ---
 # Login to AWS ECR
 name: "aws_ecr_login"
-description: "Login to AWS ECR to store Docker containers"
+description: "Login to AWS ECR to store Docker containers. Skips gracefully when credentials are not provided."
 inputs:
   aws_account_id:
     description: AWS account ID (AWS_ACCOUNT_ID)
-    required: true
+    required: false
   aws_access_key_id:
     description: Access key ID (AWS_ACCESS_KEY_ID)
-    required: true
+    required: false
   aws_secret_access_key:
     description: Secret access key (AWS_SECRET_ACCESS_KEY)
-    required: true
+    required: false
   aws_region:
     description: AWS region to use (AWS_REGION)
-    required: true
+    required: false
 
 runs:
   using: composite
   steps:
+    - name: Check ECR credentials
+      id: check
+      shell: bash
+      run: |
+        if [[ -z "${{ inputs.aws_region }}" || -z "${{ inputs.aws_access_key_id }}" || -z "${{ inputs.aws_secret_access_key }}" || -z "${{ inputs.aws_account_id }}" ]]; then
+          echo "skip=true" >> "$GITHUB_OUTPUT"
+          echo "::warning::ECR login skipped — credentials not available (expected for fork PRs)"
+        else
+          echo "skip=false" >> "$GITHUB_OUTPUT"
+        fi
+
     - name: Configure AWS credentials and bucket region
+      if: steps.check.outputs.skip != 'true'
       uses: aws-actions/configure-aws-credentials@v4
       with:
         aws-access-key-id: ${{ inputs.aws_access_key_id }}
         aws-secret-access-key: ${{ inputs.aws_secret_access_key }}
         aws-region: ${{ inputs.aws_region }}
 
     - name: Login to ECR
+      if: steps.check.outputs.skip != 'true'
       run: |
         aws ecr get-login-password \
           --region ${{ inputs.aws_region }} | docker login --username AWS --password-stdin ${{ inputs.aws_account_id }}.dkr.ecr.${{ inputs.aws_region  }}.amazonaws.com
       shell: bash
 
     # Unset AWS credentials to avoid conflicts, as we prefer credentials from ~/.aws/credentials to authenticate
     - name: Unset AWS credentials to avoid conflicts
+      if: steps.check.outputs.skip != 'true'
       shell: bash
       run: |
         echo AWS_DEFAULT_REGION='' >> $GITHUB_ENV

.github/workflows/tests-build-js.yml

@@ -25,10 +25,24 @@ jobs:
           password: ${{ secrets.DOCKERHUB_TOKEN }}
         if: ${{ steps.check-artifact.outputs.exists != 'true' && secrets.DOCKERHUB_USERNAME != '' }}
 
-      - name: Pre-pull protoc Docker image for gRPC codegen
-        run: docker pull rvolosatovs/protoc:4.0.0
+      - name: Cache protoc Docker image
+        id: cache-protoc
+        uses: actions/cache@v4
+        with:
+          path: /tmp/protoc-image.tar
+          key: docker-rvolosatovs-protoc-4.0.0
         if: ${{ steps.check-artifact.outputs.exists != 'true' }}
 
+      - name: Load protoc image from cache
+        run: docker load -i /tmp/protoc-image.tar
+        if: ${{ steps.check-artifact.outputs.exists != 'true' && steps.cache-protoc.outputs.cache-hit == 'true' }}
+
+      - name: Pull and cache protoc Docker image
+        run: |
+          docker pull rvolosatovs/protoc:4.0.0
+          docker save rvolosatovs/protoc:4.0.0 -o /tmp/protoc-image.tar
+        if: ${{ steps.check-artifact.outputs.exists != 'true' && steps.cache-protoc.outputs.cache-hit != 'true' }}
+
       - name: Setup Node.JS
         uses: ./.github/actions/nodejs
         if: ${{ steps.check-artifact.outputs.exists != 'true' }}

.github/workflows/tests-codeql.yml

@@ -20,6 +20,7 @@ jobs:
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
+        if: ${{ secrets.DOCKERHUB_USERNAME != '' }}
 
       - name: Setup Node.JS
         uses: ./.github/actions/nodejs

.github/workflows/tests-dashmate.yml

@@ -39,6 +39,7 @@ jobs:
           aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           aws_region: ${{ vars.AWS_REGION }}
           aws_account_id: ${{ secrets.AWS_ACCOUNT_ID }}
+        if: ${{ secrets.AWS_ACCESS_KEY_ID != '' }}
 
       - name: Setup Node.JS
         uses: ./.github/actions/nodejs

.github/workflows/tests-packges-functional.yml

@@ -28,6 +28,7 @@ jobs:
           aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           aws_region: ${{ vars.AWS_REGION }}
           aws_account_id: ${{ secrets.AWS_ACCOUNT_ID }}
+        if: ${{ secrets.AWS_ACCESS_KEY_ID != '' }}
 
       - name: Start local network
         uses: ./.github/actions/local-network

.github/workflows/tests-test-suite.yml

@@ -46,6 +46,7 @@ jobs:
           aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           aws_region: ${{ vars.AWS_REGION }}
           aws_account_id: ${{ secrets.AWS_ACCOUNT_ID }}
+        if: ${{ secrets.AWS_ACCESS_KEY_ID != '' }}
 
       - name: Start local network
         uses: ./.github/actions/local-network

.github/workflows/tests.yml

@@ -19,6 +19,23 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  check-secrets:
+    name: Check secret availability
+    if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' || !github.event.pull_request.draft }}
+    runs-on: ubuntu-24.04
+    outputs:
+      has_ecr: ${{ steps.check.outputs.has_ecr }}
+    steps:
+      - name: Check if ECR credentials are available
+        id: check
+        run: |
+          if [[ -n "${{ secrets.AWS_ACCESS_KEY_ID }}" && -n "${{ secrets.AWS_ACCOUNT_ID }}" ]]; then
+            echo "has_ecr=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "has_ecr=false" >> "$GITHUB_OUTPUT"
+            echo "::notice::ECR credentials not available — Docker image builds and dependent tests will be skipped (expected for fork PRs)"
+          fi
+
   changes:
     name: Determine changed packages
     if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' || !github.event.pull_request.draft }}
@@ -69,7 +86,9 @@ jobs:
 
   build-images:
     name: Build Docker images
-    if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' || !github.event.pull_request.draft }}
+    needs:
+      - check-secrets
+    if: ${{ needs.check-secrets.outputs.has_ecr == 'true' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' || !github.event.pull_request.draft) }}
     secrets: inherit
     strategy:
       fail-fast: false
@@ -193,6 +212,7 @@ jobs:
       - changes
       - build-js
       - build-images
+      - check-secrets
     strategy:
       fail-fast: false
       matrix:
@@ -211,16 +231,17 @@ jobs:
       name: ${{ matrix.name }}
       test-pattern: ${{ matrix.test-pattern }}
       restore_local_network_data: ${{ matrix.restore_local_network_data }}
-    if: contains(needs.changes.outputs.js-packages, 'dashmate')
+    if: ${{ needs.check-secrets.outputs.has_ecr == 'true' && contains(needs.changes.outputs.js-packages, 'dashmate') }}
 
   test-suite:
     name: Test Suite
     needs:
       - build-js
       - build-images
       - changes
+      - check-secrets
     secrets: inherit
-    if: needs.changes.outputs.test-suite == 'true'
+    if: ${{ needs.check-secrets.outputs.has_ecr == 'true' && needs.changes.outputs.test-suite == 'true' }}
     strategy:
       fail-fast: false
       matrix:
@@ -250,6 +271,7 @@ jobs:
       - build-js
       - build-images
       - changes
+      - check-secrets
     secrets: inherit
-    if: needs.changes.outputs.test-suite == 'true'
+    if: ${{ needs.check-secrets.outputs.has_ecr == 'true' && needs.changes.outputs.test-suite == 'true' }}
     uses: ./.github/workflows/tests-packges-functional.yml