LMBQ-267: Security scanning improvements in Helpful Libraries and UI Testing Toolbox, running Windows builds on PR approves too

.github/workflows/build-and-test-windows.yml

@@ -10,6 +10,8 @@ on:
   push:
     branches:
       - dev
+  pull_request_review:
+    types: [submitted]
 
 jobs:
   remove-run-windows-build-label:
@@ -20,8 +22,7 @@ jobs:
     timeout-minutes: 2
     steps:
     - name: Remove Run Windows Build Label
-      # v2.0.0
-      uses: buildsville/add-remove-label@eeae411a9be2e173f2420e1644514edbecc4e835
+      uses: Lombiq/GitHub-Actions/.github/actions/add-remove-label@issue/LMBQ-267
       with:
         # The token is necessary to be able to remove the label even if the workflow is triggered by a pull request
         # coming from a fork.
@@ -31,7 +32,9 @@ jobs:
 
   build-and-test-larger-runners:
     if: github.ref_name != github.event.repository.default_branch &&
-        (github.event_name == 'workflow_dispatch' || github.event.label.name == 'run-windows-build')
+        (github.event_name == 'workflow_dispatch' ||
+            github.event.label.name == 'run-windows-build' ||
+            (github.event.review.state == 'APPROVED' && contains(github.event.pull_request.labels.*.name, 'requires-windows-build')))
     name: Build and Test Windows - root solution (larger runners)
     uses: Lombiq/GitHub-Actions/.github/workflows/build-and-test-orchard-core.yml@dev
     with:
@@ -48,12 +51,12 @@ jobs:
       test-filter: "FullyQualifiedName!~SecurityScanningTests"
 
   build-and-test-standard-runners:
-    # Since dev builds are not awaited by anyone, they can run on the slower free runners.
     if: github.ref_name == github.event.repository.default_branch
     name: Build and Test Windows - root solution (standard runners)
     uses: Lombiq/GitHub-Actions/.github/workflows/build-and-test-orchard-core.yml@dev
     with:
       parent-job-name: "root-solution-standard-runners"
+      # Since dev builds are not awaited by anyone, they can run on the slower free runners.
       machine-types: "['windows-2022']"
       timeout-minutes: 60
       set-up-sql-server: "true"
@@ -67,7 +70,8 @@ jobs:
   build-and-test-nuget-test:
     if: github.ref_name == github.event.repository.default_branch ||
         github.event_name == 'workflow_dispatch' ||
-        github.event.label.name == 'run-windows-build'
+        github.event.label.name == 'run-windows-build' ||
+        (github.event.review.state == 'APPROVED' && contains(github.event.pull_request.labels.*.name, 'requires-security-build'))
     name: Build and Test Windows - NuGetTest solution
     uses: Lombiq/GitHub-Actions/.github/workflows/build-and-test-orchard-core.yml@dev
     with:
@@ -83,7 +87,8 @@ jobs:
   powershell-static-code-analysis:
     if: github.ref_name == github.event.repository.default_branch ||
         github.event_name == 'workflow_dispatch' ||
-        github.event.label.name == 'run-windows-build'
+        github.event.label.name == 'run-windows-build' ||
+        (github.event.review.state == 'APPROVED' && contains(github.event.pull_request.labels.*.name, 'requires-security-build'))
     name: PowerShell Static Code Analysis Windows
     uses: Lombiq/PowerShell-Analyzers/.github/workflows/static-code-analysis.yml@dev
     with:
@@ -94,7 +99,7 @@ jobs:
     name: Post Pull Request Checks Automation
     needs: [build-and-test-larger-runners, build-and-test-nuget-test, powershell-static-code-analysis]
     if: github.event.pull_request != ''
-    uses: Lombiq/GitHub-Actions/.github/workflows/post-pull-request-checks-automation.yml@dev
+    uses: Lombiq/GitHub-Actions/.github/workflows/post-pull-request-checks-automation.yml@issue/LMBQ-267
     secrets:
       JIRA_BASE_URL: ${{ secrets.DEFAULT_JIRA_BASE_URL }}
       JIRA_USER_EMAIL: ${{ secrets.DEFAULT_JIRA_USER_EMAIL }}
@@ -108,8 +113,7 @@ jobs:
     needs: [build-and-test-larger-runners, build-and-test-nuget-test, powershell-static-code-analysis]
     steps:
     - name: Remove Windows Build Warning Label
-      # v2.0.0
-      uses: buildsville/add-remove-label@eeae411a9be2e173f2420e1644514edbecc4e835
+      uses: Lombiq/GitHub-Actions/.github/actions/add-remove-label@issue/LMBQ-267
       with:
         # The token is necessary to be able to remove the label even if the workflow is triggered by a pull request
         # coming from a fork.

.github/workflows/build-and-test.yml

@@ -25,11 +25,11 @@ jobs:
       build-enable-npm-caching: "true"
 
   build-and-test-standard-runners:
-    # Since dev builds are not awaited by anyone, they can run on the slower free runners.
     if: github.ref_name == github.event.repository.default_branch
     name: Build and Test - root solution (standard runners)
     uses: Lombiq/GitHub-Actions/.github/workflows/build-and-test-orchard-core.yml@dev
     with:
+      # Since dev builds are not awaited by anyone, they can run on the slower free runners.
       parent-job-name: "root-solution-standard-runners"
       timeout-minutes: 50
       set-up-sql-server: "true"
@@ -48,7 +48,7 @@ jobs:
 
   spelling:
     name: Spelling
-    uses: Lombiq/GitHub-Actions/.github/workflows/spelling.yml@dev
+    uses: Lombiq/GitHub-Actions/.github/workflows/spelling.yml@issue/LMBQ-267
     with:
       additional-dictionaries: |
         cspell:csharp/csharp.txt
@@ -60,9 +60,9 @@ jobs:
         cspell:node/dict/node.txt
         cspell:npm/dict/npm.txt
         lombiq-lgha:dictionaries/Liquid.txt
-        lombiq-lgha:dictionaries/Xml.txt
         lombiq-lgha:dictionaries/Lombiq.people.txt
         lombiq-lgha:dictionaries/Security.txt
+        lombiq-lgha:dictionaries/Xml.txt
 
   powershell-static-code-analysis:
     name: PowerShell Static Code Analysis
@@ -81,7 +81,7 @@ jobs:
     name: Post Pull Request Checks Automation
     needs: [build-and-test-larger-runners, build-and-test-nuget-test, spelling, powershell-static-code-analysis]
     if: github.event.pull_request != ''
-    uses: Lombiq/GitHub-Actions/.github/workflows/post-pull-request-checks-automation.yml@dev
+    uses: Lombiq/GitHub-Actions/.github/workflows/post-pull-request-checks-automation.yml@issue/LMBQ-267
     secrets:
       JIRA_BASE_URL: ${{ secrets.DEFAULT_JIRA_BASE_URL }}
       JIRA_USER_EMAIL: ${{ secrets.DEFAULT_JIRA_USER_EMAIL }}
@@ -95,8 +95,7 @@ jobs:
     needs: [build-and-test-larger-runners, build-and-test-nuget-test, powershell-static-code-analysis]
     steps:
     - name: Add Windows Build Warning Label
-      # v2.0.0
-      uses: buildsville/add-remove-label@eeae411a9be2e173f2420e1644514edbecc4e835
+      uses: Lombiq/GitHub-Actions/.github/actions/add-remove-label@issue/LMBQ-267
       with:
         # The token is necessary to be able to add the label even if the workflow is triggered by a pull request coming
         # from a fork.