Conditional Workflow Authentication

[MGatner]

This is what I finally settled on for my libraries. It duplicates the Composer installation step and makes them conditional, basically: "only use the secret during Composer updates when it is not a fork pull request".

[MGatner]

Since the limited workflow is not authenticated I'm pretty sure failures are still related to cached Composer files. We can rerun this in a week to verify, or YOLO it and hope this the real fix this time. Disclaimer: it is working for me

[MGatner]

Aha! Figured it out. setup-php does its own cache of Composer files, and when it runs without a token it causes the later workflow step to fail.

For now I believe we still want to use our own cache, but it is something to investigate for the future if setup-php is actually handling part of this.

[lonnieezell]

Oh nice! Thanks for figuring that out. That's awesome.