ci: enable fork PR checks against 8.8 and 8.9

This restructures ci.yml to allow fork PR checks.

External contributor PRs cannot access repository secrets. This change:
- unit-tests and local_integration run on every push and PR.
- saas_integration only runs on pushes to main.
- Removed 8.7 self-managed jobs requiring DOCKER_PASSWORD.

Author: jwulf

.github/workflows/ci.yml

@@ -3,11 +3,12 @@ name: CI
 on:
   push:
     branches-ignore:
-      - main
       - "stable/**"
   pull_request:
 
 jobs:
+  # Runs on every push (non-stable branches) and every pull request, including
+  # pull requests from forks. No secrets required.
   unit-tests:
     runs-on: ubuntu-latest
     steps:
@@ -28,11 +29,11 @@ jobs:
       - name: Run Unit Tests
         run: npm run test
 
-  local_integration:
-    if: github.actor != 'dependabot[bot]'
+  # 8.8 self-managed integration tests. Uses only the public docker-compose
+  # stack — no secrets required. Runs on every push and every pull request
+  # (including fork PRs) so external contributors get PR feedback.
+  local_integration_8_8:
     runs-on: ubuntu-latest
-    environment:
-      name: selfhosted
     steps:
       - name: Check out the repo
         uses: actions/checkout@v6
@@ -49,37 +50,39 @@ jobs:
       - name: Remove mono blocking 8084 port
         run: sudo lsof -t -i:8084 | xargs -r sudo kill -9
 
-      - name: Set up Docker
+      - name: Set up Docker Compose
         run: |
-          echo ${{ secrets.DOCKER_PASSWORD }} | docker login --username joshua.wulf --password-stdin registry.camunda.cloud
+          docker compose -f docker/docker-compose-8.8.yaml up -d
 
-      - name: Set up Docker Compose
+      - name: Wait for Services Healthy
         run: |
-          docker compose -f docker/docker-compose.yaml -f docker/docker-compose-modeler.yaml up -d
-        timeout-minutes: 10
+          set -e
+          attempts=0
+          max_attempts=60
+          while [ $attempts -lt $max_attempts ]; do
+            code=$(curl -s -o /dev/null -w "%{http_code}" http://localhost:9600/actuator/health/status || true)
+            [ "$code" = "200" ] && echo "Broker healthy" && break
+            attempts=$((attempts+1))
+            sleep 5
+          done
+          [ $attempts -ge $max_attempts ] && echo "Broker not healthy" && exit 1 || true
 
       - name: Run Integration Tests
         run: |
-          npm run test:8.7:sm
+          npm run test:8.8:sm
         env:
           ZEEBE_GRPC_ADDRESS: grpc://localhost:26500
-          ZEEBE_CLIENT_ID: zeebe
-          ZEEBE_CLIENT_SECRET: zecret
-          CAMUNDA_OAUTH_URL: http://localhost:18080/auth/realms/camunda-platform/protocol/openid-connect/token
-          CAMUNDA_TASKLIST_BASE_URL: http://localhost:8082
-          CAMUNDA_OPERATE_BASE_URL: http://localhost:8081
-          CAMUNDA_OPTIMIZE_BASE_URL: http://localhost:8083
-          CAMUNDA_MODELER_BASE_URL: http://localhost:8070/api
+          CAMUNDA_AUTH_STRATEGY: NONE
+          CAMUNDA_TENANT_ID: <default>
 
       - name: Cleanup
         if: always()
-        run: docker compose -f docker/docker-compose.yaml -f docker/docker-compose-modeler.yaml down
+        run: docker compose -f docker/docker-compose-8.8.yaml down
 
-  local_multitenancy_integration:
-    if: github.actor != 'dependabot[bot]'
+  # 8.8 test suite run against an 8.9 self-managed broker. Public stack — no
+  # secrets required. Runs on every push and every pull request.
+  local_integration_8_8_against_8_9:
     runs-on: ubuntu-latest
-    environment:
-      name: selfhosted
     steps:
       - name: Check out the repo
         uses: actions/checkout@v6
@@ -96,36 +99,41 @@ jobs:
       - name: Remove mono blocking 8084 port
         run: sudo lsof -t -i:8084 | xargs -r sudo kill -9
 
-      - name: Set up Docker
+      - name: Set up Docker Compose
         run: |
-          echo ${{ secrets.DOCKER_PASSWORD }} | docker login --username joshua.wulf --password-stdin registry.camunda.cloud
+          docker compose -f docker/8.9/docker-compose.yaml up -d
 
-      - name: Set up Docker Compose
+      - name: Wait for Services Healthy
         run: |
-          docker compose -f docker/docker-compose-multitenancy.yaml -f docker/docker-compose-modeler.yaml up -d
-        timeout-minutes: 10
+          set -e
+          attempts=0
+          max_attempts=60
+          while [ $attempts -lt $max_attempts ]; do
+            code=$(curl -s -o /dev/null -w "%{http_code}" http://localhost:9600/actuator/health/status || true)
+            [ "$code" = "200" ] && echo "Broker healthy" && break
+            attempts=$((attempts+1))
+            sleep 5
+          done
+          [ $attempts -ge $max_attempts ] && echo "Broker not healthy" && exit 1 || true
 
-      - name: Run Integration Tests
+      - name: Run Integration Tests (8.8 tests against 8.9 server)
         run: |
-          npm run test:8.7:mt
+          npm run test:8.8:sm
         env:
           ZEEBE_GRPC_ADDRESS: grpc://localhost:26500
-          ZEEBE_CLIENT_ID: zeebe
-          ZEEBE_CLIENT_SECRET: zecret
-          CAMUNDA_OAUTH_URL: http://localhost:18080/auth/realms/camunda-platform/protocol/openid-connect/token
-          CAMUNDA_TASKLIST_BASE_URL: http://localhost:8082
-          CAMUNDA_OPERATE_BASE_URL: http://localhost:8081
-          CAMUNDA_OPTIMIZE_BASE_URL: http://localhost:8083
-          CAMUNDA_MODELER_BASE_URL: http://localhost:8070/api
-          # Needed for Multi-Tenancy
+          CAMUNDA_AUTH_STRATEGY: NONE
           CAMUNDA_TENANT_ID: <default>
 
       - name: Cleanup
         if: always()
-        run: docker compose -f docker/docker-compose-multitenancy.yaml -f docker/docker-compose-modeler.yaml down
+        run: docker compose -f docker/8.9/docker-compose.yaml down
 
+  # SaaS integration tests hit real SaaS endpoints and require environment
+  # secrets. To protect secret material and avoid running untrusted code
+  # against production-like infrastructure, these only run on pushes to
+  # `main` — i.e. after a PR has been reviewed and merged.
   saas_integration:
-    if: github.actor != 'dependabot[bot]'
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     environment: integration
     steps:
@@ -160,8 +168,9 @@ jobs:
           CAMUNDA_CONSOLE_BASE_URL: ${{ vars.CAMUNDA_CONSOLE_BASE_URL }}
           CAMUNDA_CONSOLE_OAUTH_AUDIENCE: ${{ vars.CAMUNDA_CONSOLE_OAUTH_AUDIENCE}}
 
+  # SaaS 8.8 integration. Same policy as saas_integration — main pushes only.
   saas_integration_8_8:
-    if: github.actor != 'dependabot[bot]'
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     environment: integration-8.8
     steps:
@@ -194,98 +203,3 @@ jobs:
           CAMUNDA_CONSOLE_CLIENT_ID: ${{ secrets.CAMUNDA_CONSOLE_CLIENT_ID }}
           CAMUNDA_CONSOLE_CLIENT_SECRET: ${{ secrets.CAMUNDA_CONSOLE_CLIENT_SECRET }}
           CAMUNDA_CONSOLE_BASE_URL: ${{ vars.CAMUNDA_CONSOLE_BASE_URL }}
-          CAMUNDA_CONSOLE_OAUTH_AUDIENCE: ${{ vars.CAMUNDA_CONSOLE_OAUTH_AUDIENCE }}
-
-  local_integration_8_8:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out the repo
-        uses: actions/checkout@v6
-
-      - name: Use Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: "22"
-
-      - name: Install dependencies
-        run: npm install
-
-      # Workaround for https://github.com/actions/runner-images/issues/2821
-      - name: Remove mono blocking 8084 port
-        run: sudo lsof -t -i:8084 | xargs -r sudo kill -9
-
-      - name: Set up Docker Compose
-        run: |
-          docker compose -f docker/docker-compose-8.8.yaml up -d
-
-      - name: Wait for Services Healthy
-        run: |
-          set -e
-          attempts=0
-          max_attempts=60
-          while [ $attempts -lt $max_attempts ]; do
-            code=$(curl -s -o /dev/null -w "%{http_code}" http://localhost:9600/actuator/health/status || true)
-            [ "$code" = "200" ] && echo "Broker healthy" && break
-            attempts=$((attempts+1))
-            sleep 5
-          done
-          [ $attempts -ge $max_attempts ] && echo "Broker not healthy" && exit 1 || true
-
-      - name: Run Integration Tests
-        run: |
-          npm run test:8.8:sm
-        env:
-          ZEEBE_GRPC_ADDRESS: grpc://localhost:26500
-          CAMUNDA_AUTH_STRATEGY: NONE
-          CAMUNDA_TENANT_ID: <default>
-
-      - name: Cleanup
-        if: always()
-        run: docker compose -f docker/docker-compose-8.8.yaml down
-
-  local_integration_8_8_against_8_9:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out the repo
-        uses: actions/checkout@v6
-
-      - name: Use Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: "22"
-
-      - name: Install dependencies
-        run: npm install
-
-      # Workaround for https://github.com/actions/runner-images/issues/2821
-      - name: Remove mono blocking 8084 port
-        run: sudo lsof -t -i:8084 | xargs -r sudo kill -9
-
-      - name: Set up Docker Compose
-        run: |
-          docker compose -f docker/8.9/docker-compose.yaml up -d
-
-      - name: Wait for Services Healthy
-        run: |
-          set -e
-          attempts=0
-          max_attempts=60
-          while [ $attempts -lt $max_attempts ]; do
-            code=$(curl -s -o /dev/null -w "%{http_code}" http://localhost:9600/actuator/health/status || true)
-            [ "$code" = "200" ] && echo "Broker healthy" && break
-            attempts=$((attempts+1))
-            sleep 5
-          done
-          [ $attempts -ge $max_attempts ] && echo "Broker not healthy" && exit 1 || true
-
-      - name: Run Integration Tests (8.8 tests against 8.9 server)
-        run: |
-          npm run test:8.8:sm
-        env:
-          ZEEBE_GRPC_ADDRESS: grpc://localhost:26500
-          CAMUNDA_AUTH_STRATEGY: NONE
-          CAMUNDA_TENANT_ID: <default>
-
-      - name: Cleanup
-        if: always()
-        run: docker compose -f docker/8.9/docker-compose.yaml down