[WIP] Allowing Testing on External Forks

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,38 @@
+---
+name: Bug report
+about: Create a report to help us improve
+
+---
+
+<!-- This template is meant for GENERAL bug reports.
+
+Please be as descriptive as possible
+-->
+
+### Work environment
+
+<!-- Filling this table is mandatory -->
+
+| Questions                                | Answers
+|------------------------------------------|--------------------
+| System PANDA runs on OS/arch/bits        | panda-system-i386, panda-system-x86-64
+| PANDA module affected                    | dwarf2 plugin, taint2, PyPanda, etc.
+| Source of PANDA                          | `git clone`, pip, release binaries etc.
+| Version/git commit                       | v1.8.21, <commit hash>
+
+<!-- OTHER BUGS -->
+
+### Expected behavior
+
+### Actual behavior
+
+### Steps to reproduce the behavior
+
+- Use code markdown `CODE` to make your code visible
+
+<!-- ADDITIONAL CONTEXT -->
+
+### Additional Logs, screenshots, source code,  configuration dump, ...
+
+Drag and drop zip archives containing the Additional info here, don't use external services or link.
+Screenshots can be directly dropped here.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,18 @@
+---
+name: Feature request
+about: Suggest an idea for PANDA
+
+---
+
+### Feature
+
+- [ ] New PANDA plugin
+- [ ] Support for new architecture
+- [ ] Optimize PANDA performance
+- [ ] Other (elaborated below)
+
+**Describe the feature you'd like**
+A clear and concise description of what you want to happen.
+
+**Additional context**
+Add any other context about the feature request here.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,23 @@
+ <!-- Filling this template is mandatory -->
+
+**Your checklist for this pull request**
+- [ ] I've documented or updated the documentation of every API function and struct this PR changes.
+- [ ] I've added tests that prove my fix is effective or that my feature works (if possible)
+
+**Detailed description**
+
+<!-- Explain the **details** for making this change. Is a new feature implemented? What existing problem does the pull request solve? How does the pull request solve these issues? Please provide enough information so that others can review your pull request. -->
+
+...
+
+**Test plan**
+
+<!-- What steps should the reviewer take to test your pull request? Demonstrate the code is solid. Or what test cases you added. Ideally provide screenshots to show the your code changes work as expected -->
+
+...
+
+**Closing issues**
+
+<!-- put "closes #XXXX" in your comment to auto-close the issue that your PR fixes (if any). -->
+
+...

.github/labeler.yml

@@ -0,0 +1,36 @@
+PANDA-Build:
+  - Dockerfile
+  - ./panda/build.sh
+  - ./panda/build-llvm.sh
+  - ./panda/Makefile.panda
+  - ./panda/Makefile.panda.target
+  - Makefile
+  - Makefile.objs
+  - Makefile.target
+  - configure
+
+Documentation:
+  - '**/*.md'
+
+Github-files:
+  - .github/**
+
+PyPanda:
+  - ./panda/python/**/*.py
+
+Debian:
+  - ./panda/debian/**
+
+Plugins:
+  - ./panda/plugins/**
+
+LLVM:
+  - ./panda/llvm/**
+  - ./panda/include/panda/tcg-llvm.h
+
+PANDA-Core:
+  - ./panda/src/**
+
+PANDA-Tests:
+  - ./panda/tests/**
+  - ./panda/plugins/taint2/tests/**

.github/workflows/labeler.yml

@@ -0,0 +1,19 @@
+name: "Pull Request Labeler"
+on:
+- pull_request_target
+
+# Automatically cancel any previous workflow on new push.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
+  cancel-in-progress: true
+
+jobs:
+  triage:
+    permissions:
+      contents: read
+      pull-requests: write
+    runs-on: ubuntu-22.04
+    steps:
+    - uses: actions/labeler@v4
+      with:
+        repo-token: "${{ secrets.GITHUB_TOKEN }}"

.github/workflows/parallel_tests.yml

@@ -5,7 +5,9 @@ name: Parallel Tests
 on:
   # Allow to repo owner to manually run this workflow for external PRs once code is vetted
   workflow_dispatch:
-
+  pull_request_review:
+    types: [submitted]
+
   # Run automatically for internal PRs and pushes
   pull_request:
     branches:
@@ -20,6 +22,7 @@ on:
 jobs:
 
   test_installer: # test install_ubuntu.sh
+    if: github.event.review.state == 'approved'
     runs-on: panda-arc # Note 22.04 would work, but it requires docker > 20.10.7 which is not on our CI box (yet)
     container:
       image: ubuntu:20.04
@@ -44,9 +47,8 @@ jobs:
     - name: Run install_ubuntu.sh
       run: cd $GITHUB_WORKSPACE && ./panda/scripts/install_ubuntu.sh
 
-
   build_container:
-    if: github.repository  == 'panda-re/panda'
+    if: github.repository  == 'panda-re/panda' && github.event.review.state == 'approved'
     runs-on: panda-arc
     steps:
       - name: Install git
@@ -73,7 +75,7 @@ jobs:
         run: docker run --rm "ghcr.io/${{ github.repository_owner }}/panda_local:${{ github.sha }}" /bin/bash -c 'exit $(/panda/build/arm-softmmu/panda-system-arm -help | grep -q "usage. panda-system-arm")'
 
   tests:
-    if: github.repository  == 'panda-re/panda'
+    if: github.repository == 'panda-re/panda' && github.event.review.state == 'approved'
     runs-on: panda-arc
     needs: [build_container]
 
@@ -140,9 +142,9 @@ jobs:
 
   cleanup:
     # Cleanup after prior jobs finish - even if they fail
+    if: always()
     needs: [tests]
     runs-on: panda-arc
-    if: always()
 
     steps:
       # Note we leave the last 72hrs because caching is nice (first few panda image layers won't change often)
@@ -156,7 +158,7 @@ jobs:
 
   build_and_check_fork: # Forked repos can't use panda-arc test suite - just checkout and run make check
     if: github.repository != 'panda-re/panda'
-    runs-on: panda-arc
+    runs-on: ubuntu-20.04
 
     steps:
     - uses: actions/checkout@v4 # Clones code into to /home/runner/work/panda

.github/workflows/review-approval.yml

@@ -0,0 +1,19 @@
+name: Review Approval
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened, ready_for_review]
+  pull_request_review:
+    types: [submitted]
+
+jobs:
+  approve-workflow:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Check if review is approved
+      if: github.event_name == 'pull_request_review' && github.event.review.state == 'approved'
+      run: echo "Review approved"
+
+    - name: Require new approval for new pushes
+      if: github.event_name == 'pull_request_target'
+      run: echo "New push detected, approval required"