Add testing for reusable workflows or pin versions

[clee2000]

This is in response to https://github.com/pytorch/test-infra/pull/4904 and incidents we've had with the builder repo.

Pytorch/pytorch and other repos generally use the main branch of test-infra and builder for workflows and other scripts, which can be hard to track down if there is a problem

We should have basic testing for the reusable (composite?) workflows in test-infra that are used by other repos, or pin the versions used

Discussion regarding pinning: Options: pin to a tag that we can update periodically, pin to commit, pin to version etc Pros: solves the problem Cons: we'd have to update the pin somehow, which might lead to lagging. Important fixes might get delayed

[zxiiro]

#4904 sounds like it would have been caught if there was better testing in place. Perhaps unit testing changes to the test-infra repo would be good to catch these issues at the PR level?

I'm new to this project so I'm not familiar yet with what kinda tests get run but IMO any repos sharing reusable workflows should try to have sufficient unit tests against those reusable workflows where applicable.

[huydhn]

AI: We need to have testing for reusable actions on GHA. This should be a requirement for those that we share with other repos. Tentatively @malfet @huydhn

AI: What is the role of builder repo? We need to document it. What to keep in builder, and what to keep in test-infra. @atalman

Additional thoughts: Security review for GHA on test-infra. File a separate issues to move mergebot to test-infra and require discussion. Need to solve the issue with internal usage of mergebot

[clee2000]

AI me: compile a list of reusable actions that don't have testing