Review

This PR has already been reviewed in https://dev.azure.com/dnceng/internal/_git/dotnet-sdk/pullrequest/56422 and other places. Please feel free to confirm the change list is the same but note that we already have approval from 3+ people.

This improves upon 3 actions which are currently disabled in the repo until this is merged, and we have already confirmed the fix plan in public as this PR.

Testing:

I've tested the actions in nagilson/sdk-private which is a private copy of the SDK repo.
There, I was able to demonstrate these tasks work:

Update XLF

Fix Completions

Update Static Web Assets

This has never been used once since it was created to my knowledge. I've looped in the owning team and they are aware of the changes.

Accomplishes

• Separates the main job of each workflow into multiple jobs. The jobs with write access our team owns now only interact with git. The jobs that run code/scripts only have read access. A simple changelog artifact is passed from the read-only job to the write-allowed job.

We don't remove the call to build.sh or use build.sh from main because a user could still inject MS Build logic to modify build behavior, and we must build the local copy because we need to run the tests/target to fix the intended problem the action is trying to resolve (test snapshots or xlf.)

• Moves to v6 of checkout tasks to prevent .git/config from having any tokens, although persist-token is set to false. This is the simpler remedy applied to the update-static-web-assets action.

• Blocks persistent credentials on checkout and empties environment variables to prevent scripts from taking tokens.

• Enforces contributor authority for comments, which is now needed to trigger the workflow in a PR to prevent non-contributors from trying to trigger the action on a malicious PR.

• Only pushes if the expected file types are changed per the action.

❗ Review Note:
There is plenty of duplicated logic in these workflows. However, the amount of overhead to pass arguments to a "sub-action" is quite substantial - to the point where the code ends up being about the same size. While it's good to reduce duplicated areas that will need modification, most of the logic is quite simple and replaceable via ctrl-f.

The exception to that is the logic to decide if we should commit or not by looking if the files changed are only of the expected extensions. (E.g. /updatexlf should only change .xlf files - otherwise we should block the change.)

What I've done is make a sub-action, but I don't use it yet because we don't want to rely on the user's forked copy of the action. Instead, we will point to dotnet/sdk ... @main to call the sub action. It's not possible to write that and have the workflow work until it's already been merged, so after this is merged I'll delete the code and call the sub action.