ci: scope the PR path to the ci-temp-images robot

Review feedback: the PR path should use the narrowly-scoped credential, not
the one that publishes releases.

Correct, and it applies to the build job as well as the tests. Everything on
this path writes exactly one repository, quay.io/kairos/ci-temp-images: the
factory pushes the image under test there, and reusable-qemu-test pulls it
back and pushes a bundles-test image alongside it. The kairos+prci robot has
Write on that repository and nothing else, which is the whole requirement.

QUAY_USERNAME/QUAY_PASSWORD is the credential release.yaml uses to publish
permanent images to quay.io/kairos/<flavor>. Sharing it with a path that
builds contributor code was already more exposure than the work needed, and
it becomes the difference between a bounded and an unbounded leak once
kairos#4307 makes that path reachable from a fork.

Signed-off-by: Mauro Morales <contact@mauromorales.com>

Author: mauromorales

.github/workflows/image-pr.yaml

@@ -16,8 +16,12 @@ jobs:
     name: ${{ matrix.image_name }}
     uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@8952c3a5f4f6255cc63af88cb3637a9684970c8d # v1.1.3
     secrets:
-      registry_username: ${{ secrets.QUAY_USERNAME }}
-      registry_password: ${{ secrets.QUAY_PASSWORD }}
+      # The PR path only ever writes quay.io/kairos/ci-temp-images, so it uses
+      # the kairos+prci robot, which has Write on that repository and nothing
+      # else. QUAY_USERNAME/QUAY_PASSWORD is the credential release.yaml uses to
+      # publish permanent images and does not belong on a PR path.
+      registry_username: ${{ secrets.QUAY_PR_USERNAME }}
+      registry_password: ${{ secrets.QUAY_PR_PASSWORD }}
     strategy:
       fail-fast: false
       matrix:
@@ -53,12 +57,13 @@ jobs:
       kubernetes_distro: ${{ matrix.kubernetes_distro }}
   core-tests:
     name: ${{ format('core-tests (hadron, amd64, generic) {0}', matrix.test) }}
-    # Explicit rather than `secrets: inherit`. reusable-qemu-test.yaml only ever
-    # reads these two, and these jobs boot an image built from the pull request
-    # under review -- so they get the registry credential and nothing else.
+    # Explicit rather than `secrets: inherit`, and scoped to the ci-temp-images
+    # robot. These jobs boot an image built from the pull request under review;
+    # they pull it from ci-temp-images and push a bundles-test image back there,
+    # so Write on that one repository is all they need.
     secrets:
-      QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
-      QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
+      QUAY_USERNAME: ${{ secrets.QUAY_PR_USERNAME }}
+      QUAY_PASSWORD: ${{ secrets.QUAY_PR_PASSWORD }}
     uses: ./.github/workflows/reusable-qemu-test.yaml
     with:
       base_image: "ghcr.io/kairos-io/hadron:v0.5.1"
@@ -86,12 +91,13 @@ jobs:
   standard-tests:
     name: ${{ format('standard-tests (hadron, amd64, generic) {0}', matrix.test) }}
     uses: ./.github/workflows/reusable-qemu-test.yaml
-    # Explicit rather than `secrets: inherit`. reusable-qemu-test.yaml only ever
-    # reads these two, and these jobs boot an image built from the pull request
-    # under review -- so they get the registry credential and nothing else.
+    # Explicit rather than `secrets: inherit`, and scoped to the ci-temp-images
+    # robot. These jobs boot an image built from the pull request under review;
+    # they pull it from ci-temp-images and push a bundles-test image back there,
+    # so Write on that one repository is all they need.
     secrets:
-      QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
-      QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
+      QUAY_USERNAME: ${{ secrets.QUAY_PR_USERNAME }}
+      QUAY_PASSWORD: ${{ secrets.QUAY_PR_PASSWORD }}
     permissions:
       contents: write
       security-events: write