CI checks fail for pull requests from forks

[zcorpan]

More information about the failure:

/usr/bin/git -c protocol.version=2 fetch --no-tags --prune --progress --no-recurse-submodules --depth=1 origin +refs/heads/docs-remove-outdated-invitation*:refs/remotes/origin/docs-remove-outdated-invitation* +refs/tags/docs-remove-outdated-invitation*:refs/tags/docs-remove-outdated-invitation*
The process '/usr/bin/git' failed with exit code 1

I submitted this pull request from a fork of the W3C-owned repository. It's tough to say from the output alone (which, for those unfamiliar, is available by clicking the button labeled "0 / 2 checks OK"), but the continuous integration process may be incorrectly attempting to fetch the fork's branch as if it were present in the W3C-owned repository. The CI process may not be configured to support contributions issued from forks. In the past month, just two other pull requests have been submitted like that (gh-434 and gh-441), and they both exhibit the same error.

Originally posted by @jugglinmike in #433 (comment)

Is there something we can fix in how the GitHub Actions are set up to succeed for PRs from forks? (And not introduce new security holes)

[jscholes]

I discussed this briefly with @s3ththompson earlier today, forks make testing and contributions unnecessarily complicated so my vote is to have all PRs use a branch in this repo. Any technical or logistical objections? My reasons include:

1. With an existing clone of the repo, switching to a fork is more involved than just checking out a new branch.
2. If people have write or other non-default permissions under this repo, they don't apply to forks.

[jugglinmike]

Only people who have been explicitly granted "write" access to the repository will be able to create branches there. That requirement will increase friction for new contributors.

[jscholes]

@jugglinmike That's fair. So the policy should be, if someone already has write access, they should create a branch under this repo. Otherwise, a fork is their only option and shouldn't be forbidden. Members of the Bocoup and PAC teams should always be creating branches here.