ci: simplify e2e workflow - remove workflow_call complexity #55
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI - OpenShift E2E Gate | ||
| on: | ||
| pull_request: | ||
| branches: | ||
| - main | ||
| - dev | ||
| issue_comment: | ||
| types: [created] | ||
| # Permissions needed for nested e2e workflow to push images to GHCR | ||
| permissions: | ||
| contents: read | ||
| packages: write | ||
| pull-requests: write | ||
| issues: write | ||
| jobs: | ||
| # Post a comment on new PRs explaining the ok-to-test requirement | ||
| post-instructions: | ||
| if: github.event_name == 'pull_request' | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Check if author is admin/maintainer | ||
| id: check-permission | ||
| uses: actions/github-script@v7 | ||
| with: | ||
| script: | | ||
| const { data: permission } = await github.rest.repos.getCollaboratorPermissionLevel({ | ||
| owner: context.repo.owner, | ||
| repo: context.repo.repo, | ||
| username: context.payload.pull_request.user.login | ||
| }); | ||
| // Privileged roles that can trigger e2e tests | ||
| // NOTE: This list is duplicated in check-ok-to-test and run-for-privileged jobs | ||
| // Update all occurrences if changing the allowed permission levels | ||
| const privilegedRoles = ['admin', 'maintain', 'write']; | ||
| const isPrivileged = privilegedRoles.includes(permission.permission); | ||
| console.log(`User ${context.payload.pull_request.user.login} has permission: ${permission.permission}, privileged: ${isPrivileged}`); | ||
| core.setOutput('is_privileged', isPrivileged); | ||
| return isPrivileged; | ||
| - name: Post ok-to-test instructions | ||
| if: steps.check-permission.outputs.is_privileged != 'true' | ||
| uses: actions/github-script@v7 | ||
| with: | ||
| script: | | ||
| // Check if we already posted instructions | ||
| const comments = await github.rest.issues.listComments({ | ||
| owner: context.repo.owner, | ||
| repo: context.repo.repo, | ||
| issue_number: context.payload.pull_request.number | ||
| }); | ||
| const botComment = comments.data.find(c => | ||
| c.user.type === 'Bot' && | ||
| c.body.includes('OpenShift E2E tests require approval') | ||
| ); | ||
| if (!botComment) { | ||
| await github.rest.issues.createComment({ | ||
| owner: context.repo.owner, | ||
| repo: context.repo.repo, | ||
| issue_number: context.payload.pull_request.number, | ||
| body: `## OpenShift E2E Tests | ||
| OpenShift E2E tests require approval before running on external contributions. | ||
| **For maintainers/admins:** Comment \`/ok-to-test\` to approve and run the OpenShift E2E tests. | ||
| **For contributors:** Please wait for a maintainer to review and approve your PR for E2E testing. | ||
| _This check uses GPU resources on a shared OpenShift cluster._` | ||
| }); | ||
| } | ||
| # Check for /ok-to-test comment and run tests | ||
| check-ok-to-test: | ||
| if: | | ||
| github.event_name == 'issue_comment' && | ||
| github.event.issue.pull_request && | ||
| contains(github.event.comment.body, '/ok-to-test') | ||
| runs-on: ubuntu-latest | ||
| outputs: | ||
| approved: ${{ steps.check.outputs.approved }} | ||
| pr_number: ${{ steps.get-pr.outputs.pr_number }} | ||
| pr_sha: ${{ steps.get-pr.outputs.pr_sha }} | ||
| steps: | ||
| - name: Check commenter permission | ||
| id: check | ||
| uses: actions/github-script@v7 | ||
| with: | ||
| script: | | ||
| const { data: permission } = await github.rest.repos.getCollaboratorPermissionLevel({ | ||
| owner: context.repo.owner, | ||
| repo: context.repo.repo, | ||
| username: context.payload.comment.user.login | ||
| }); | ||
| // Privileged roles - see post-instructions job for documentation | ||
| const privilegedRoles = ['admin', 'maintain', 'write']; | ||
| const isPrivileged = privilegedRoles.includes(permission.permission); | ||
| console.log(`User ${context.payload.comment.user.login} has permission: ${permission.permission}, approved: ${isPrivileged}`); | ||
| if (isPrivileged) { | ||
| // Add reaction to indicate approval | ||
| await github.rest.reactions.createForIssueComment({ | ||
| owner: context.repo.owner, | ||
| repo: context.repo.repo, | ||
| comment_id: context.payload.comment.id, | ||
| content: 'rocket' | ||
| }); | ||
| } else { | ||
| await github.rest.reactions.createForIssueComment({ | ||
| owner: context.repo.owner, | ||
| repo: context.repo.repo, | ||
| comment_id: context.payload.comment.id, | ||
| content: '-1' | ||
| }); | ||
| } | ||
| core.setOutput('approved', isPrivileged); | ||
| - name: Get PR details | ||
| id: get-pr | ||
| if: steps.check.outputs.approved == 'true' | ||
| uses: actions/github-script@v7 | ||
| with: | ||
| script: | | ||
| const { data: pr } = await github.rest.pulls.get({ | ||
| owner: context.repo.owner, | ||
| repo: context.repo.repo, | ||
| pull_number: context.payload.issue.number | ||
| }); | ||
| core.setOutput('pr_number', pr.number); | ||
| core.setOutput('pr_sha', pr.head.sha); | ||
| console.log(`PR #${pr.number} at SHA ${pr.head.sha}`); | ||
| # Run tests for privileged PR authors (automatic) | ||
| run-for-privileged: | ||
| if: github.event_name == 'pull_request' | ||
| runs-on: ubuntu-latest | ||
| outputs: | ||
| should_run: ${{ steps.check.outputs.is_privileged }} | ||
| steps: | ||
| - name: Check if author is privileged | ||
| id: check | ||
| uses: actions/github-script@v7 | ||
| with: | ||
| script: | | ||
| const { data: permission } = await github.rest.repos.getCollaboratorPermissionLevel({ | ||
| owner: context.repo.owner, | ||
| repo: context.repo.repo, | ||
| username: context.payload.pull_request.user.login | ||
| }); | ||
| // Privileged roles - see post-instructions job for documentation | ||
| const privilegedRoles = ['admin', 'maintain', 'write']; | ||
| const isPrivileged = privilegedRoles.includes(permission.permission); | ||
| console.log(`Author ${context.payload.pull_request.user.login} is privileged: ${isPrivileged}`); | ||
| core.setOutput('is_privileged', isPrivileged); | ||
| # Trigger the actual e2e tests | ||
| trigger-e2e: | ||
| needs: [run-for-privileged] | ||
| if: | | ||
| github.event_name == 'pull_request' && | ||
| needs.run-for-privileged.outputs.should_run == 'true' | ||
| uses: ./.github/workflows/ci-e2e-openshift.yaml | ||
| with: | ||
| ref: ${{ github.event.pull_request.head.sha }} | ||
| secrets: inherit | ||
| trigger-e2e-approved: | ||
| needs: [check-ok-to-test] | ||
| if: | | ||
| github.event_name == 'issue_comment' && | ||
| needs.check-ok-to-test.outputs.approved == 'true' | ||
| uses: ./.github/workflows/ci-e2e-openshift.yaml | ||
| with: | ||
| ref: ${{ needs.check-ok-to-test.outputs.pr_sha }} | ||
| secrets: inherit | ||
