Skip to content

Commit c30d443

Browse files
radofuchsRadovan Fuchs
radofuchs
and
Radovan Fuchs
authored
LCORE-3521: gate e2e tests by auth + disable unstable ITs for container lifecycle (#2440)
* gate e2e tests by auth * bind to latest commit based on coderabbit suggestion * disable ITs for container lifecycle until resolved --------- Co-authored-by: Radovan Fuchs <rfuchs@rfuchs-thinkpadp1gen7.tpb.csb>
1 parent ff24352 commit c30d443

6 files changed

Lines changed: 780 additions & 681 deletions

File tree

‎.github/workflows/e2e_authorize.yaml‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
# Separate job: GitHub sends job-level secrets to the runner as soon as that job starts.
2+
name: Authorize E2E secrets access
3+
4+
on:
5+
workflow_call:
6+
outputs:
7+
authorized:
8+
description: true if e2e may run with repository secrets
9+
value: ${{ jobs.authorize.outputs.authorized }}
10+
11+
jobs:
12+
authorize:
13+
name: Check owner or developer access
14+
runs-on: ubuntu-latest
15+
timeout-minutes: 2
16+
# Adding some other label must not start e2e.
17+
if: github.event.action != 'labeled' || github.event.label.name == 'ok-to-test'
18+
permissions:
19+
contents: read
20+
outputs:
21+
authorized: ${{ steps.check.outputs.authorized }}
22+
steps:
23+
- name: Verify executor is owner or developer
24+
id: check
25+
env:
26+
GH_TOKEN: ${{ github.token }}
27+
EVENT_NAME: ${{ github.event_name }}
28+
EVENT_ACTION: ${{ github.event.action }}
29+
USER: ${{ github.event.pull_request.user.login || github.actor }}
30+
ACTOR: ${{ github.actor }}
31+
REPOSITORY: ${{ github.repository }}
32+
run: |
33+
set -euo pipefail
34+
35+
allow() { echo "$1"; echo "authorized=true" >> "$GITHUB_OUTPUT"; exit 0; }
36+
deny() { echo "::warning::$1"; echo "authorized=false" >> "$GITHUB_OUTPUT"; exit 0; }
37+
38+
perm() {
39+
local encoded
40+
encoded=$(jq -nr --arg u "$1" '$u|@uri')
41+
gh api "repos/${REPOSITORY}/collaborators/${encoded}/permission" --jq .permission 2>/dev/null || echo none
42+
}
43+
44+
[ "$EVENT_NAME" = "schedule" ] && allow "Scheduled run."
45+
46+
USER_PERM=$(perm "$USER")
47+
echo "executor=$USER permission=$USER_PERM"
48+
if [ "$USER_PERM" = "admin" ] || [ "$USER_PERM" = "write" ]; then
49+
allow "$USER is an owner or developer."
50+
fi
51+
52+
# ok-to-test only counts on the labeled event, so a later push cannot
53+
# reuse an old owner approval against a new PR head.
54+
[ "$EVENT_ACTION" = "labeled" ] || deny "$USER is not an owner or developer."
55+
56+
LABELER_PERM=$(perm "$ACTOR")
57+
echo "ok-to-test labeler=$ACTOR permission=$LABELER_PERM"
58+
[ "$LABELER_PERM" = "admin" ] && allow "Owner $ACTOR added ok-to-test."
59+
60+
deny "ok-to-test was not added by an owner."

‎.github/workflows/e2e_tests.yaml‎

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,21 @@
11
# .github/workflows/e2e_tests.yml
22
name: E2E Tests
33

4-
on: [push, pull_request_target]
4+
on:
5+
push:
6+
pull_request_target:
7+
types: [opened, synchronize, reopened, labeled]
58

69
jobs:
10+
# Own job so repository secrets are never sent to a runner unless this passes.
11+
authorize:
12+
uses: ./.github/workflows/e2e_authorize.yaml
13+
permissions:
14+
contents: read
15+
716
e2e_tests:
17+
needs: authorize
18+
if: needs.authorize.outputs.authorized == 'true'
819
runs-on: ubuntu-latest
920
strategy:
1021
fail-fast: false
@@ -53,9 +64,9 @@ jobs:
5364
# On push → falls back to the current repository.
5465
repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
5566

56-
# On PR_TARGET → the PR head *commit* (reproducible).
67+
# On PR_TARGET → the PR head commit at event time (not the moving branch).
5768
# On push → the pushed commit that triggered the workflow.
58-
ref: ${{ github.event.pull_request.head.ref || github.sha }}
69+
ref: ${{ github.event.pull_request.head.sha || github.sha }}
5970

6071
# Tests need access to secrets.
6172
# This should be refactored if possible to mitigate the risk.

‎.github/workflows/e2e_tests_lightspeed_evaluation.yaml‎

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,20 @@
11
name: E2E Tests for Lightspeed Evaluation
22

3-
on: [push, pull_request_target]
3+
on:
4+
push:
5+
pull_request_target:
6+
types: [opened, synchronize, reopened, labeled]
47

58
jobs:
9+
# Own job so repository secrets are never sent to a runner unless this passes.
10+
authorize:
11+
uses: ./.github/workflows/e2e_authorize.yaml
12+
permissions:
13+
contents: read
14+
615
e2e_tests:
16+
needs: authorize
17+
if: needs.authorize.outputs.authorized == 'true'
718
runs-on: ubuntu-latest
819
strategy:
920
fail-fast: false
@@ -23,9 +34,9 @@ jobs:
2334
# On push → falls back to the current repository.
2435
repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
2536

26-
# On PR_TARGET → the PR head *commit* (reproducible).
37+
# On PR_TARGET → the PR head commit at event time (not the moving branch).
2738
# On push → the pushed commit that triggered the workflow.
28-
ref: ${{ github.event.pull_request.head.ref || github.sha }}
39+
ref: ${{ github.event.pull_request.head.sha || github.sha }}
2940

3041
# Don’t keep credentials when running untrusted PR code under PR_TARGET.
3142
persist-credentials: ${{ github.event_name != 'pull_request_target' }}

‎.github/workflows/e2e_tests_providers.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,15 @@ on:
77
workflow_dispatch:
88

99
jobs:
10+
# Own job so repository secrets are never sent to a runner unless this passes.
11+
authorize:
12+
uses: ./.github/workflows/e2e_authorize.yaml
13+
permissions:
14+
contents: read
15+
1016
e2e_tests:
17+
needs: authorize
18+
if: needs.authorize.outputs.authorized == 'true'
1119
runs-on: ubuntu-latest
1220
strategy:
1321
fail-fast: false

‎.github/workflows/e2e_tests_rhaiis.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,15 @@ on:
88

99

1010
jobs:
11+
# Own job so repository secrets are never sent to a runner unless this passes.
12+
authorize:
13+
uses: ./.github/workflows/e2e_authorize.yaml
14+
permissions:
15+
contents: read
16+
1117
e2e_tests:
18+
needs: authorize
19+
if: needs.authorize.outputs.authorized == 'true'
1220
runs-on: ubuntu-latest
1321
strategy:
1422
fail-fast: false

0 commit comments

Comments
 (0)