Update GitHub Actions to work in private GitHub repo (#25197)

.github/workflows/AssignPrs.yml

@@ -7,6 +7,7 @@ permissions:
 
 jobs:
   run:
+    if: github.repository_owner == 'PowerShell'
     runs-on: ubuntu-latest
     permissions:
       issues: write

.github/workflows/backport.yml

@@ -1,78 +0,0 @@
-name: Backport PR to branch
-on:
-  issue_comment:
-    types: [created]
-  schedule:
-    # once a day at 13:00 UTC to cleanup old runs
-    - cron: '0 13 * * *'
-
-permissions:
-  contents: write
-  issues: write
-  pull-requests: write
-  actions: write
-
-jobs:
-  label:
-    if: ${{ contains(github.event.comment.body, '/backport to') }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Add Label
-        uses: actions/github-script@v6
-        with:
-          script: |
-            const comment = context.payload.comment.body;
-            const match = comment.match(/\/backport to release\/v(\d+\.\d+)$/);
-            if (match) {
-              const version = match[1];
-              const label = `Backport-${version}.x-Consider`;
-              console.log(label);
-
-              // Add the label to the issue
-              await github.rest.issues.addLabels({
-                ...context.repo,
-                issue_number: context.issue.number,
-                labels: [label],
-              });
-            } else {
-              throw new Error("No version found in comment.  Expected: /backport to release/vN.N");
-            }
-  backport:
-    if: ${{ contains(github.event.comment.body, '/backport to') || github.event_name == 'schedule' }}
-    # validates our branch format and that the issue is labeled before backport
-    needs: label
-    uses: dotnet/arcade/.github/workflows/backport-base.yml@main
-    with:
-      repository_owners: 'powershell,travisez13'
-      pr_description_template: |
-        Backport of #%source_pr_number% to %target_branch%
-
-        <!--
-        DO NOT MODIFY THIS COMMENT. IT IS AUTO-GENERATED.
-        $$$originalpr:%source_pr_number%$$$
-        -->
-
-        /cc %cc_users%
-
-        ## Customer Impact
-
-        - [ ] Customer reported
-        - [ ] Found internally
-
-        [Select one or both of the boxes. Describe how this issue impacts customers, citing the expected and actual behaviors and scope of the issue. If customer-reported, provide the issue number.]
-
-        ## Regression
-
-        - [ ] Yes
-        - [ ] No
-
-        [If yes, specify when the regression was introduced. Provide the PR or commit if known.]
-
-        ## Testing
-
-        [How was the fix verified? How was the issue missed previously? What tests were added?]
-
-        ## Risk
-
-        [High/Medium/Low. Justify the indication by mentioning how risks were measured and addressed.]
-

.github/workflows/createReminders.yml

@@ -9,6 +9,8 @@ permissions:
 
 jobs:
   reminder:
+    if: github.repository_owner == 'PowerShell'
+
     permissions:
       issues: write  # for agrc/create-reminder-action to set reminders on issues
       pull-requests: write  # for agrc/create-reminder-action to set reminders on PRs

.github/workflows/labels.yml

@@ -13,7 +13,7 @@ permissions:
 
 jobs:
   verify-labels:
-    if: github.repository_owner == 'PowerShell'
+    if: startsWith(github.repository_owner, 'azure') || github.repository_owner == 'PowerShell'
     runs-on: ubuntu-latest
 
     steps:

.github/workflows/linux-ci.yml

@@ -37,6 +37,7 @@ env:
   system_debug: 'false'
 jobs:
   changes:
+    if: startsWith(github.repository_owner, 'azure') || github.repository_owner == 'PowerShell'
     name: Change Detection
     runs-on: ubuntu-latest
     # Required permissions
@@ -50,7 +51,7 @@ jobs:
         uses: actions/checkout@v4.1.0
 
         # For pull requests it's not necessary to checkout the code
-      - uses: dorny/paths-filter@v3
+      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.2.0
         id: filter
         with:
           list-files: json
@@ -232,7 +233,7 @@ jobs:
       - linux_test_unelevated_others
       - analyze
     if: always()
-    uses: PowerShell/compliance/.github/workflows/ready-to-merge.yml@master
+    uses: PowerShell/compliance/.github/workflows/ready-to-merge.yml@v1.0.0
     with:
       needs_context: ${{ toJson(needs) }}
   # TODO: Enable this when we have a Linux packaging workflow

.github/workflows/macos-ci.yml

@@ -38,6 +38,7 @@ jobs:
   changes:
     name: Change Detection
     runs-on: ubuntu-latest
+    if: startsWith(github.repository_owner, 'azure') || github.repository_owner == 'PowerShell'
     # Required permissions
     permissions:
       pull-requests: read
@@ -49,7 +50,7 @@ jobs:
         uses: actions/checkout@v4.1.0
 
         # For pull requests it's not necessary to checkout the code
-      - uses: dorny/paths-filter@v3
+      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.2.0
         id: filter
         with:
           list-files: json
@@ -186,6 +187,6 @@ jobs:
       - macos_test_unelevated_ci
       - macos_test_unelevated_others
     if: always()
-    uses: PowerShell/compliance/.github/workflows/ready-to-merge.yml@master
+    uses: PowerShell/compliance/.github/workflows/ready-to-merge.yml@v1.0.0
     with:
       needs_context: ${{ toJson(needs) }}

.github/workflows/markdownLink.yml

@@ -10,6 +10,8 @@ permissions:
 jobs:
   markdown-link-check:
     runs-on: ubuntu-latest
+    if: github.repository_owner == 'PowerShell'
+
     steps:
     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
     - uses: gaurav-nelson/github-action-markdown-link-check@5c5dfc0ac2e225883c0e5f03a85311ec2830d368 # v1

.github/workflows/processReminders.yml

@@ -10,6 +10,7 @@ permissions:
 
 jobs:
   reminder:
+    if: github.repository_owner == 'PowerShell'
     permissions:
       issues: write  # for agrc/reminder-action to set reminders on issues
       pull-requests: write  # for agrc/reminder-action to set reminders on PRs

.github/workflows/scorecards.yml

@@ -20,6 +20,7 @@ permissions: read-all
 jobs:
   analysis:
     name: Scorecard analysis
+    if: github.repository_owner == 'PowerShell'
     runs-on: ubuntu-latest
     permissions:
       # Needed to upload the results to code-scanning dashboard.

.github/workflows/windows-ci.yml

@@ -39,6 +39,7 @@ jobs:
   changes:
     name: Change Detection
     runs-on: ubuntu-latest
+    if: startsWith(github.repository_owner, 'azure') || github.repository_owner == 'PowerShell'
     # Required permissions
     permissions:
       pull-requests: read
@@ -50,7 +51,7 @@ jobs:
         uses: actions/checkout@v4.1.0
 
         # For pull requests it's not necessary to checkout the code
-      - uses: dorny/paths-filter@v3
+      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.2.0
         id: filter
         with:
           list-files: json
@@ -170,6 +171,6 @@ jobs:
       - windows_test_unelevated_ci
       - windows_test_unelevated_others
     if: always()
-    uses: PowerShell/compliance/.github/workflows/ready-to-merge.yml@master
+    uses: PowerShell/compliance/.github/workflows/ready-to-merge.yml@v1.0.0
     with:
       needs_context: ${{ toJson(needs) }}