feat(ci): allow PRs from repo forks to use depot (#15243)

Author: chakru-r

.github/workflows/docker-unified.yml

@@ -12,6 +12,7 @@ on:
       - master
       - releases/**
   pull_request:
+    types: [opened, synchronize, reopened, labeled]
     branches:
       - "**"
   release:
@@ -29,7 +30,9 @@ env:
   PROFILE_NAME: "${{ github.event.inputs.profileName || 'quickstart-consumers' }}"
 
   DOCKER_CACHE: "DEPOT"
-  DEPOT_PROJECT_ID: "${{ vars.DEPOT_PROJECT_ID }}"
+  DEPOT_PROJECT_ID: "s0gr1cr3jd"
+  HAS_DEPOT_LABEL: ${{ github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'depot') }}
+  IS_FORK: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository }}
   DEPOT_TOKEN: "${{ secrets.DEPOT_TOKEN }}"
 
 permissions:
@@ -39,6 +42,7 @@ permissions:
 jobs:
   setup:
     runs-on: depot-ubuntu-24.04-small
+    if: ${{ github.event_name != 'pull_request' || github.event.action != 'labeled' || github.event.label.name == 'depot' }}
     outputs:
       # TODO: Many of the vars below should not be required anymore.
       tag: ${{ steps.tag.outputs.tag }}
@@ -135,22 +139,25 @@ jobs:
       - name: Determine runner type
         id: set-runner
         # This needs to handle two scenarios:
-        # 1. Running on a PR from a fork. There are some auth issues that prevent us from using depot in that case.
-        #    So, Its easier to just use the regular github actions cache and build all images for each parallel job running smoke test.
-        #    Note, concurrency is lower when using github runners, queue times can be longer, test time is longer due to fewer parallel jobs.
-        # 2. Running on a PR from a branch in the datahub-project org and push/schedule events on master.
+        # 1. Running on a PR from a fork. We use github runners, unless the "depot" label exists -- in which case, we run
+        #    it on depotNote, concurrency is lower when using github runners, queue times can be longer, test time is longer
+        #    due to fewer parallel jobs.
+        # 3. Running on a PR from a branch in the datahub-project org and push/schedule events on master.
         #    Depot is used here for remote container builds in base_build and also for all runners. Depot runners support unlimited concurrency
         #    and hence short queue times and higher parallelism of smoke tests
-
         run: |
-          if [[ "${{ env.DOCKER_CACHE }}" == "DEPOT" && "${{ env.DEPOT_PROJECT_ID }}" != "" ]]; then
+          if [[ "${{ env.DOCKER_CACHE }}" == "DEPOT" && "${{ env.IS_FORK }}" == "false" ]]; then
             echo "build_runner_type=depot-ubuntu-24.04-4" >> "$GITHUB_OUTPUT"
             echo "test_runner_type=depot-ubuntu-24.04-4" >> "$GITHUB_OUTPUT"
             echo "test_runner_type_small=depot-ubuntu-24.04-small" >> "$GITHUB_OUTPUT"
             echo "use_depot_cache=true" >> "$GITHUB_OUTPUT"
           else
             echo "build_runner_type=ubuntu-latest" >> "$GITHUB_OUTPUT"
-            echo "test_runner_type=ubuntu-latest" >> "$GITHUB_OUTPUT"
+            if [[ "${{ env.HAS_DEPOT_LABEL }}" == "true" ]]; then
+              echo "test_runner_type=depot-ubuntu-24.04-4" >> "$GITHUB_OUTPUT"
+            else
+              echo "test_runner_type=ubuntu-latest" >> "$GITHUB_OUTPUT"
+            fi
             echo "test_runner_type_small=ubuntu-latest" >> "$GITHUB_OUTPUT"
             echo "use_depot_cache=false" >> "$GITHUB_OUTPUT"
             # publishing is currently only supported via depot
@@ -392,7 +399,7 @@ jobs:
         # python_batch_count is used to split pytests in the smoke-test (batches of actual test functions)
         # cypress_batch_count is used to split the collection of cypress test specs into batches.
         run: |
-          if [[ "${{ needs.setup.outputs.test_runner_type }}" == "ubuntu-latest" ]]; then
+          if [[ "${{ env.IS_FORK }}" == "true" ]]; then
             echo "cypress_batch_count=5" >> "$GITHUB_OUTPUT"
             echo "python_batch_count=3" >> "$GITHUB_OUTPUT"
           else