Skip to content

Commit 2f08742

Browse files
hectorcast-dbhectorcast-db
authored
[Internal] Add test instructions for external contributors (#370)
## Changes Add test instructions for external contributors ## Tests See Go Changes databricks/databricks-sdk-go#1073
1 parent 779b6e3 commit 2f08742

File tree

2 files changed

+133
-2
lines changed

2 files changed

+133
-2
lines changed

‎.github/workflows/external-message.yml‎

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
name: PR Comment
2+
3+
# WARNING:
4+
# THIS WORKFLOW ALWAYS RUNS FOR EXTERNAL CONTRIBUTORS WITHOUT ANY APPROVAL.
5+
# THIS WORKFLOW RUNS FROM MAIN BRANCH, NOT FROM THE PR BRANCH.
6+
# DO NOT PULL THE PR OR EXECUTE ANY CODE FROM THE PR.
7+
8+
on:
9+
pull_request_target:
10+
types: [opened, reopened, synchronize]
11+
branches:
12+
- main
13+
14+
15+
jobs:
16+
comment-on-pr:
17+
runs-on: ubuntu-latest
18+
permissions:
19+
pull-requests: write
20+
21+
steps:
22+
# NOTE: The following checks may not be accurate depending on Org or Repo settings.
23+
- name: Check user and potential secret access
24+
id: check-secrets-access
25+
env:
26+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
27+
run: |
28+
USER_LOGIN="${{ github.event.pull_request.user.login }}"
29+
REPO_OWNER="${{ github.repository_owner }}"
30+
REPO_NAME="${{ github.event.repository.name }}"
31+
32+
echo "Pull request opened by: $USER_LOGIN"
33+
34+
# Check if PR is from a fork
35+
IS_FORK=$([[ "${{ github.event.pull_request.head.repo.full_name }}" != "${{ github.repository }}" ]] && echo "true" || echo "false")
36+
37+
HAS_ACCESS="false"
38+
39+
# Check user's permission level on the repository
40+
USER_PERMISSION=$(gh api repos/$REPO_OWNER/$REPO_NAME/collaborators/$USER_LOGIN/permission --jq '.permission')
41+
42+
if [[ "$USER_PERMISSION" == "admin" || "$USER_PERMISSION" == "write" ]]; then
43+
HAS_ACCESS="true"
44+
elif [[ "$USER_PERMISSION" == "read" ]]; then
45+
# For read access, we need to check if the user has been explicitly granted secret access
46+
# This information is not directly available via API, so we'll make an assumption
47+
# that read access does not imply secret access
48+
HAS_ACCESS="false"
49+
fi
50+
51+
# Check if repo owner is an organization
52+
IS_ORG=$(gh api users/$REPO_OWNER --jq '.type == "Organization"')
53+
54+
if [[ "$IS_ORG" == "true" && "$HAS_ACCESS" == "false" ]]; then
55+
# Check if user is a member of any team with write or admin access to the repo
56+
TEAMS_WITH_ACCESS=$(gh api repos/$REPO_OWNER/$REPO_NAME/teams --jq '.[] | select(.permission == "push" or .permission == "admin") | .slug')
57+
for team in $TEAMS_WITH_ACCESS; do
58+
IS_TEAM_MEMBER=$(gh api orgs/$REPO_OWNER/teams/$team/memberships/$USER_LOGIN --silent && echo "true" || echo "false")
59+
if [[ "$IS_TEAM_MEMBER" == "true" ]]; then
60+
HAS_ACCESS="true"
61+
break
62+
fi
63+
done
64+
fi
65+
66+
# If it's a fork, set HAS_ACCESS to false regardless of other checks
67+
if [[ "$IS_FORK" == "true" ]]; then
68+
HAS_ACCESS="false"
69+
fi
70+
71+
echo "has_secrets_access=$HAS_ACCESS" >> $GITHUB_OUTPUT
72+
if [[ "$HAS_ACCESS" == "true" ]]; then
73+
echo "User $USER_LOGIN likely has access to secrets"
74+
else
75+
echo "User $USER_LOGIN likely does not have access to secrets"
76+
fi
77+
78+
79+
- uses: actions/checkout@v4
80+
81+
- name: Delete old comments
82+
if: steps.check-secrets-access.outputs.has_secrets_access != 'true'
83+
env:
84+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
85+
run: |
86+
# Delete previous comment if it exists
87+
previous_comment_ids=$(gh api "repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/comments" \
88+
--jq '.[] | select(.body | startswith("<!-- INTEGRATION_TESTS -->")) | .id')
89+
echo "Previous comment IDs: $previous_comment_ids"
90+
# Iterate over each comment ID and delete the comment
91+
if [ ! -z "$previous_comment_ids" ]; then
92+
echo "$previous_comment_ids" | while read -r comment_id; do
93+
echo "Deleting comment with ID: $comment_id"
94+
gh api "repos/${{ github.repository }}/issues/comments/$comment_id" -X DELETE
95+
done
96+
fi
97+
98+
- name: Comment on PR
99+
if: steps.check-secrets-access.outputs.has_secrets_access != 'true'
100+
env:
101+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
102+
COMMIT_SHA: ${{ github.event.pull_request.head.sha }}
103+
run: |
104+
gh pr comment ${{ github.event.pull_request.number }} --body \
105+
"<!-- INTEGRATION_TESTS -->
106+
Run integration tests manually:
107+
[go/deco-tests-run/sdk-java](https://go/deco-tests-run/sdk-java)
108+
109+
Inputs:
110+
* PR number: ${{github.event.pull_request.number}}
111+
* Commit SHA: \`${{ env.COMMIT_SHA }}\`
112+
113+
Checks will be approved automatically on success.
114+
"

‎.github/workflows/integration-tests.yml‎

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,29 @@ on:
77
merge_group:
88

99
jobs:
10+
check-token:
11+
name: Check secrets access
12+
runs-on: ubuntu-latest
13+
outputs:
14+
has_token: ${{ steps.set-token-status.outputs.has_token }}
15+
steps:
16+
- name: Check if GITHUB_TOKEN is set
17+
id: set-token-status
18+
run: |
19+
if [ -z "${{ secrets.GITHUB_TOKEN }}" ]; then
20+
echo "GITHUB_TOKEN is empty. User has no access to tokens."
21+
echo "::set-output name=has_token::false"
22+
else
23+
echo "GITHUB_TOKEN is set. User has no access to tokens."
24+
echo "::set-output name=has_token::true"
25+
fi
26+
1027
trigger-tests:
11-
if: github.event_name == 'pull_request'
1228
name: Trigger Tests
1329
runs-on: ubuntu-latest
30+
needs: check-token
31+
if: github.event_name == 'pull_request' && needs.check-token.outputs.has_token == 'true'
1432
environment: "test-trigger-is"
15-
1633
steps:
1734
- uses: actions/checkout@v3
1835

0 commit comments

Comments
 (0)