Skip to content

Commit cf29b5f

Browse files
shortstackedshortstacked
authored
fix: Fix jobs for secrets inherit (#15532)
1 parent 4d037ca commit cf29b5f

File tree

3 files changed

+88
-78
lines changed

3 files changed

+88
-78
lines changed

‎.github/workflows/test-workflows-nightly.yml

Lines changed: 8 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -11,35 +11,16 @@ on:
1111
type: string
1212
default: 'master'
1313

14+
1415
permissions:
1516
contents: read
1617

1718
jobs:
18-
run_tests:
19+
run_workflow_tests:
1920
name: Run Workflow Tests
20-
runs-on: blacksmith-2vcpu-ubuntu-2204
21-
timeout-minutes: 10
22-
23-
steps:
24-
- name: Determine Git Ref for Testing
25-
id: determine_ref
26-
shell: bash
27-
run: |
28-
if [[ "${{ github.event_name }}" == "schedule" ]]; then
29-
echo "EFFECTIVE_GIT_REF=master" >> $GITHUB_OUTPUT
30-
echo "Scheduled run: Using 'master' branch."
31-
elif [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
32-
echo "EFFECTIVE_GIT_REF=${{ github.event.inputs.git_ref_to_test }}" >> $GITHUB_OUTPUT
33-
echo "Manual dispatch: Using ref '${{ github.event.inputs.git_ref_to_test }}'."
34-
else
35-
echo "EFFECTIVE_GIT_REF=master" >> $GITHUB_OUTPUT
36-
echo "Warning: Unknown event type '${{ github.event_name }}', defaulting to 'master'."
37-
fi
38-
39-
- name: Call Reusable Test Workflow
40-
uses: ./.github/workflows/run-test-workflows.yml
41-
with:
42-
git_ref: ${{ steps.determine_ref.outputs.EFFECTIVE_GIT_REF }}
43-
send_webhook_report: false
44-
pr_number: ''
45-
secrets: inherit
21+
uses: ./.github/workflows/test-workflows-callable.yml
22+
with:
23+
git_ref: ${{ github.event_name == 'schedule' && 'master' || github.event.inputs.git_ref_to_test }}
24+
send_webhook_report: false
25+
pr_number: ''
26+
secrets: inherit

‎.github/workflows/test-workflows-pr-approved.yml

Lines changed: 7 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -9,17 +9,12 @@ permissions:
99
pull-requests: read
1010

1111
jobs:
12-
run_tests_after_approval:
12+
run_workflow_tests_after_approval:
1313
name: Run Tests on Approved PR
1414
if: github.event.review.state == 'approved'
15-
runs-on: blacksmith-2vcpu-ubuntu-2204
16-
timeout-minutes: 10
17-
18-
steps:
19-
- name: Call Reusable Test Workflow on Approved PR
20-
uses: ./.github/workflows/test-workflows-callable.yml
21-
with:
22-
git_ref: ${{ github.event.pull_request.head.sha }}
23-
send_webhook_report: true
24-
pr_number: ${{ github.event.pull_request.number }}
25-
secrets: inherit
15+
uses: ./.github/workflows/test-workflows-callable.yml
16+
with:
17+
git_ref: ${{ github.event.pull_request.head.sha }}
18+
send_webhook_report: true
19+
pr_number: ${{ github.event.pull_request.number }}
20+
secrets: inherit

‎.github/workflows/test-workflows-pr-comment.yml

Lines changed: 73 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -9,70 +9,104 @@ permissions:
99
contents: read
1010

1111
jobs:
12-
trigger_tests_on_comment:
13-
name: Handle /test-workflows command
12+
handle_comment_command:
13+
name: Handle /test-workflows Command
1414
if: github.event.issue.pull_request && startsWith(github.event.comment.body, '/test-workflows')
1515
runs-on: ubuntu-latest
16+
outputs:
17+
permission_granted: ${{ steps.pr_check_and_details.outputs.permission_granted }}
18+
git_ref: ${{ steps.pr_check_and_details.outputs.head_sha }}
19+
pr_number: ${{ steps.pr_check_and_details.outputs.pr_number_string }}
1620

1721
steps:
18-
- name: Check User Permission and Get PR Details
19-
id: pr_check
22+
- name: Validate User, Get PR Details, and React
23+
id: pr_check_and_details
2024
uses: actions/github-script@v7
2125
with:
2226
github-token: ${{ secrets.GITHUB_TOKEN }}
23-
result-encoding: json
2427
script: |
2528
const commenter = context.actor;
26-
const issue = context.issue;
27-
let hasPermission = false;
28-
let prDetails = null;
29+
const issueOwner = context.repo.owner;
30+
const issueRepo = context.repo.repo;
31+
const commentId = context.payload.comment.id;
32+
const prNumber = context.issue.number; // In issue_comment on a PR, issue.number is the PR number
2933
34+
// Function to add a reaction to the comment
35+
async function addReaction(content) {
36+
try {
37+
await github.rest.reactions.createForIssueComment({
38+
owner: issueOwner,
39+
repo: issueRepo,
40+
comment_id: commentId,
41+
content: content
42+
});
43+
} catch (reactionError) {
44+
// Log if reaction fails but don't fail the script for this
45+
console.log(`Failed to add reaction '${content}': ${reactionError.message}`);
46+
}
47+
}
48+
49+
// Initialize outputs to a non-triggering state
50+
core.setOutput('permission_granted', 'false');
51+
core.setOutput('head_sha', '');
52+
core.setOutput('pr_number_string', '');
53+
54+
// 1. Check user permissions
3055
try {
3156
const { data: permissions } = await github.rest.repos.getCollaboratorPermissionLevel({
32-
owner: issue.owner,
33-
repo: issue.repo,
57+
owner: issueOwner,
58+
repo: issueRepo,
3459
username: commenter
3560
});
3661
3762
const allowedPermissions = ['admin', 'write', 'maintain'];
38-
if (allowedPermissions.includes(permissions.permission)) {
39-
console.log(`User @${commenter} has '${permissions.permission}' permission.`);
40-
hasPermission = true;
41-
} else {
42-
core.setFailed(`User @${commenter} does not have sufficient permissions (admin/write/maintain) to trigger workflows.`);
63+
if (!allowedPermissions.includes(permissions.permission)) {
64+
console.log(`User @${commenter} has '${permissions.permission}' permission. Needs 'admin', 'write', or 'maintain'.`);
65+
await addReaction('-1'); // User does not have permission
66+
return; // Exit script, tests will not be triggered
4367
}
68+
console.log(`User @${commenter} has '${permissions.permission}' permission.`);
4469
} catch (error) {
45-
core.setFailed(`Could not verify permissions for @${commenter}: ${error.message}`);
70+
console.log(`Could not verify permissions for @${commenter}: ${error.message}`);
71+
await addReaction('confused'); // Error checking permissions
72+
return; // Exit script
4673
}
4774
48-
if (!hasPermission) {
49-
return { permission_granted: false };
50-
}
51-
52-
const prNumber = issue.number;
75+
// 2. Fetch PR details (if permission check passed)
76+
let headSha;
5377
try {
5478
const { data: pr } = await github.rest.pulls.get({
55-
owner: context.repo.owner,
56-
repo: context.repo.repo,
79+
owner: issueOwner,
80+
repo: issueRepo,
5781
pull_number: prNumber,
5882
});
59-
prDetails = {
60-
head_sha: pr.head.sha,
61-
pr_number_string: prNumber.toString()
62-
};
63-
console.log(`Workspaceed PR details: SHA - ${prDetails.head_sha}, PR Number - ${prDetails.pr_number_string}`);
83+
headSha = pr.head.sha;
84+
console.log(`Workspaced PR details: SHA - ${headSha}, PR Number - ${prNumber}`);
85+
86+
// Set outputs for the next job
87+
core.setOutput('permission_granted', 'true');
88+
core.setOutput('head_sha', headSha);
89+
core.setOutput('pr_number_string', prNumber.toString());
90+
await addReaction('+1'); // Command accepted, tests will be triggered
91+
6492
} catch (error) {
65-
core.setFailed(`Failed to fetch PR details for PR #${prNumber}: ${error.message}`);
66-
return { permission_granted: true, pr_fetch_error: true };
93+
console.log(`Failed to fetch PR details for PR #${prNumber}: ${error.message}`);
94+
core.setOutput('permission_granted', 'false'); // Ensure this is false if PR fetch fails
95+
await addReaction('confused'); // Error fetching PR details
6796
}
6897
69-
return { permission_granted: true, ...prDetails };
98+
trigger_reusable_tests:
99+
name: Trigger Reusable Test Workflow
100+
needs: handle_comment_command
70101

71-
- name: Call Reusable Test Workflow
72-
if: steps.pr_check.outcome == 'success' && fromJson(steps.pr_check.outputs.result).permission_granted == true && fromJson(steps.pr_check.outputs.result).head_sha
73-
uses: ./.github/workflows/test-workflows-callable.yml
74-
with:
75-
git_ref: ${{ fromJson(steps.pr_check.outputs.result).head_sha }}
76-
send_webhook_report: true
77-
pr_number: ${{ fromJson(steps.pr_check.outputs.result).pr_number_string }}
78-
secrets: inherit
102+
if: >
103+
always() &&
104+
needs.handle_comment_command.result != 'skipped' &&
105+
needs.handle_comment_command.outputs.permission_granted == 'true' &&
106+
needs.handle_comment_command.outputs.git_ref != ''
107+
uses: ./.github/workflows/test-workflows-callable.yml
108+
with:
109+
git_ref: ${{ needs.handle_comment_command.outputs.git_ref }}
110+
send_webhook_report: true
111+
pr_number: ${{ needs.handle_comment_command.outputs.pr_number }}
112+
secrets: inherit

0 commit comments

Comments
 (0)