fix auth gate for e2e tests (#2458) #3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Separate job: GitHub sends job-level secrets to the runner as soon as that job starts. | ||
| name: Authorize E2E secrets access | ||
| on: | ||
| workflow_call: | ||
| outputs: | ||
| authorized: | ||
| description: true if e2e may run with repository secrets | ||
| value: ${{ jobs.authorize.outputs.authorized }} | ||
| jobs: | ||
| authorize: | ||
| name: Check repository access | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 2 | ||
| if: github.event.action != 'labeled' || github.event.label.name == 'ok-to-test' | ||
| permissions: | ||
| contents: read | ||
| members: read | ||
| outputs: | ||
| authorized: ${{ steps.check.outputs.authorized }} | ||
| steps: | ||
| - name: Allow repo members, or ok-to-test from an owner | ||
| id: check | ||
| env: | ||
| GH_TOKEN: ${{ github.token }} | ||
| EVENT_NAME: ${{ github.event_name }} | ||
| EVENT_ACTION: ${{ github.event.action }} | ||
| USER: ${{ github.event.pull_request.user.login || github.actor }} | ||
| ACTOR: ${{ github.actor }} | ||
| REPOSITORY: ${{ github.repository }} | ||
| run: | | ||
| set -euo pipefail | ||
| allow() { echo "$1"; echo "authorized=true" >> "$GITHUB_OUTPUT"; exit 0; } | ||
| deny() { echo "::warning::$1"; echo "authorized=false" >> "$GITHUB_OUTPUT"; exit 0; } | ||
| encode() { jq -nr --arg u "$1" '$u|@uri'; } | ||
| # True if the user is on this repository or an org owner/member. | ||
| is_repo_user_or_member() { | ||
| local encoded org role | ||
| encoded=$(encode "$1") | ||
| if gh api --silent "repos/${REPOSITORY}/collaborators/${encoded}"; then | ||
| return 0 | ||
| fi | ||
| org="${REPOSITORY%%/*}" | ||
| role=$(gh api "orgs/${org}/memberships/${encoded}" \ | ||
| --jq 'if .state == "active" then .role else "none" end' 2>/dev/null || echo none) | ||
| [ "$role" = "admin" ] || [ "$role" = "member" ] | ||
| } | ||
| repo_permission() { | ||
| gh api "repos/${REPOSITORY}/collaborators/$(encode "$1")/permission" --jq .permission 2>/dev/null || echo none | ||
| } | ||
| [ "$EVENT_NAME" = "schedule" ] && allow "Scheduled run." | ||
| echo "executor=$USER" | ||
| if is_repo_user_or_member "$USER"; then | ||
| allow "$USER is a user or member of ${REPOSITORY}." | ||
| fi | ||
| [ "$EVENT_ACTION" = "labeled" ] || deny "$USER is not a user or member of ${REPOSITORY}." | ||
| LABELER_PERM=$(repo_permission "$ACTOR") | ||
| echo "ok-to-test labeler=$ACTOR permission=$LABELER_PERM" | ||
| [ "$LABELER_PERM" = "admin" ] && allow "Owner $ACTOR added ok-to-test." | ||
| deny "ok-to-test must be added by a repository owner." | ||
