webhook proxy should support PRs from forked repositories

[tbugfinder]

Is your feature request related to a problem? Please describe.
Development teams might rely on a contribution workflow based on forked repositories.
PullRequest are not created from branch-a to e.g. master but from forked-repo/branch to master.

Describe the solution you'd like
It would be beneficial if the webhook proxy creates a Jenkins project which can deal with forked repos so that we can run pipelines based on Pull Requests of forked repos (just like github actions).
The purpose of the pipeline is to run additional checks on the code changes of the PR.

Describe alternatives you've considered
Use Github Actions.

Additional context
The webhook proxy has some configuration parameters however I'm not sure if one of these would apply.
At least extending ALLOWED_EXTERNAL_PROJECTS doesn't apply.
https://www.opendevstack.org/ods-documentation/opendevstack/4.x/jenkins/webhook-proxy.html

using GIT_ASKPASS to set credentials myprj-cd-cd-user-with-password
 > git fetch --tags --force --progress -- https://bbb/scm/myprj/myrepo.git +refs/heads/*:refs/remotes/origin/* # timeout=10
 > git rev-parse refs/remotes/origin/pr_user.com/Jenkinsfile-1657545807085^{commit} # timeout=10
 > git rev-parse pr_user.com/Jenkinsfile-1657545807085^{commit} # timeout=10
 > git rev-parse pr_user.com/Jenkinsfile-1657545807085^{commit} # timeout=10
ERROR: Couldn't find any revision to build. Verify the repository and branch configuration for this job.
ERROR: Maximum checkout retry attempts reached, aborting
Finished: FAILURE

[tbugfinder]

The template might need some additional settings:
https://github.com/opendevstack/ods-core/blob/master/jenkins/webhook-proxy/pipeline.json.tmpl#L22-L25
like
https://stackoverflow.com/questions/49114011/how-to-check-out-a-pull-request-with-jenkins-pipeline

[tbugfinder]

I've tested quite some refs however wasn't able to get this from bitbucket if the PR relates to a forked repo.
It looks like BB would still rely on the forked repo.

@michaelsauter any thoughts?

[michaelsauter]

Hmm. TBH I am not sure if the webhook proxy really should support this.

Can you expand on "At least extending ALLOWED_EXTERNAL_PROJECTS doesn't apply"? Did you try and it did not work? The env var exists to allows the following scenario: say you have project "foo" and namespaces "foo-cd", "foo-dev" and "foo-test". by default the proxy only builds repos located in the "foo" project of bitbucket. configuring ALLOWED_EXTERNAL_PROJECTS=bar would also allow to build from the "bar" project. So on the surface it looks relevant to your use case. Did you setup a webhook in the fork?

[tbugfinder]

By design the webhook cannot be configured on the fork.
Ah, I had a misunderstanding of the option ALLOWED_EXTERNAL_PROJECTS, I thought it might grab code from the forked repository - so we can forget about that.

[michaelsauter]

By design the webhook cannot be configured on the fork.

Oh I see. Well then this would require some work, probably along what the links you shared earlier suggest.

I will not work on this feature, but will review contribution. First though, I wonder if we really need this? I think the contribution flow via forked repo is not too common in a company setting.