chore(ci): skip fips builds and tests on fork PRs
Proposed changes (including videos or screenshots)
The fips base image (rocketchat/dhi-node) lives in a private DockerHub repo,
and secrets are unavailable to fork PRs, so the pull can never succeed there.
This prevents fork PRs from running tests, as the image building jobs that handle
FIPS images break and the workflow doesn't move forward.
Centralize the decision in a release-versions 'fips-skip' output with three
states -- 'all' (fork PRs: build no images, run no fips tests), 'ui-suite'
(default: build images, run the api suites, skip the expensive UI shards) and
'none' ('fips' label present: run everything) -- and gate the docker matrix leg
and the three fips test jobs on it. tests-done now accepts 'skipped' from the
api fips jobs so a fork PR is not blocked from merging.
Behavior for non-fork events is unchanged.
Issue(s)
Steps to test or reproduce
Further comments
Evidence: https://github.com/RocketChat/Rocket.Chat/actions/runs/31507699587/job/93835989004?pr=40699
Summary by CodeRabbit
- Bug Fixes
- Improved continuous integration handling for FIPS builds and tests across forks and labeled runs.
- Prevented unnecessary FIPS test execution when conditions do not require it.
- Updated test result aggregation to correctly handle intentionally skipped FIPS jobs.