Address docker images for PRs failing to build for external PRs

[asimpson]

Currently we build a Docker image and push it to Docker Hub for every PR (#496). This works great. However, this doesn't work for PRs from external forks (example failed run) since secrets are not passed to Github Actions in that context.

There are two things to fix:

1. Prevent PRs from public forks from trying to build and push the image.

2. Come up with a workaround for PRs from external forks so that someone reviewing theh PR can easily spin up a Docker image.

The first point is easy enough to fix by only attempting to push to Dockerhub if the PR is not from a fork.

The second is more difficult and ramps up the complexity.

I previously attempted to migrate to Github Container Registry since that uses the GITHUB_TOKEN which is the only secret that is available in PRs from external forks. However that case only allows read access.

The solution I've settled on is to use docker save to generate a tarball of the image and then persist that as an artifact. The steps to use that artifact locally are then:

1. Download artifact and unzip it (Github Actions automatically zips all artifacts, see issue)
2. Use docker load to load the tarfile as a Docker image, e.g. docker load < /path/to/image.tar
3. docker run -p 3000:3000 imagename

[github-actions]

Use the following command to run this PR with Docker at http://localhost:3000:

docker run --rm -p 3000:3000 grafana/plugin-builds:a2a400d31a9486a13cd8bd0bcf2b5d9adacc44f7pre

[aangelisc]

LGTM, a couple questions:

• Is it possible to remove the condition on the build step and then only add a condition for the push? Can build and push be separated? It'll probably make the workflow more readable.
• Shall we add a PR comment detailing that the image has been saved as an artifact and how to run it?

[asimpson]

@aangelisc

Good questions!

1. The step for building also pushes which would then fail for PRs from forks
2. Adding a comment also requires escalated privileges which aren't given for PRs from forks (see this note). I toyed around with adding a comment using pull_request_target and a separate workflow to do that commenting but it didn't seem worth the effort.

[aangelisc]

LGTM!