Merge pull request #1732 from kbenzie/benie/gha-fix-e2e-for-forks

[GHA] Fix e2e workflow for forks

Author: kbenzie

.github/workflows/cmake.yml

@@ -8,7 +8,6 @@ concurrency:
 
 permissions:
   contents: read
-  pull-requests: write
 
 jobs:
   ubuntu-build:
@@ -192,30 +191,6 @@ jobs:
     with:
       name: NATIVE_CPU
 
-  e2e-level-zero:
-    name: E2E L0
-    permissions:
-      contents: read
-      pull-requests: write
-    needs: [ubuntu-build, level-zero]
-    uses: ./.github/workflows/e2e_level_zero.yml
-
-  e2e-opencl:
-    name: E2E OpenCL
-    permissions:
-      contents: read
-      pull-requests: write
-    needs: [ubuntu-build, opencl]
-    uses: ./.github/workflows/e2e_opencl.yml
-
-  e2e-cuda:
-    name: E2E CUDA
-    permissions:
-      contents: read
-      pull-requests: write
-    needs: [ubuntu-build, cuda]
-    uses: ./.github/workflows/e2e_cuda.yml
-
   windows-build:
     name: Build - Windows
     strategy:

.github/workflows/e2e.yml

@@ -0,0 +1,39 @@
+---
+name: SYCL E2E
+
+# The e2e workflow adds a comment to the pull request in the final step which
+# requires the pull-request: write permission.
+# When a pull request originates from a fork using the pull_request trigger
+# will never grant write permissions due to security concerns.
+# Instead, the pull_request_target trigger is necessary to be granted the
+# pull-request: write permission.
+on: [push, pull_request_target]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  e2e-level-zero:
+    name: E2E L0
+    permissions:
+      contents: read
+      pull-requests: write
+    needs: [ubuntu-build, level-zero]
+    uses: ./.github/workflows/e2e_level_zero.yml
+
+  e2e-opencl:
+    name: E2E OpenCL
+    permissions:
+      contents: read
+      pull-requests: write
+    needs: [ubuntu-build, opencl]
+    uses: ./.github/workflows/e2e_opencl.yml
+
+  e2e-cuda:
+    name: E2E CUDA
+    permissions:
+      contents: read
+      pull-requests: write
+    needs: [ubuntu-build, cuda]
+    uses: ./.github/workflows/e2e_cuda.yml