Trusted external sweep - PR #1362
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Trusted External Sweep Dispatch | ||
|
Check warning on line 1 in .github/workflows/trusted-external-sweep.yml
|
||
| run-name: Trusted external sweep - PR #${{ github.event.pull_request.number }} @ ${{ github.event.pull_request.head.sha }} | ||
| # This workflow is intentionally control-plane only. It never checks out or | ||
| # executes pull-request code. A write-authorized collaborator applies one primary | ||
| # sweep label to approve the exact external head SHA, then this trusted event | ||
| # dispatches the existing e2e workflow from main with repository secrets. | ||
| # Each authorized label event approves an exact PR head; no event may cancel another. | ||
| on: # zizmor: ignore[concurrency-limits] | ||
| # Control plane only: verifies writer permission and the exact labeled head, never executes PR code. | ||
| pull_request_target: # zizmor: ignore[dangerous-triggers] | ||
| branches: | ||
| - main | ||
| types: | ||
| - labeled | ||
| permissions: {} | ||
| jobs: | ||
| dispatch: | ||
| name: dispatch | ||
| permissions: | ||
| actions: write # Dispatch authorized sweeps. | ||
| contents: read | ||
| pull-requests: write # Publish PR feedback. | ||
| if: >- | ||
| github.event.pull_request.head.repo.full_name != github.repository && | ||
| contains( | ||
| fromJson('["sweep-enabled","full-sweep-enabled","non-canary-full-sweep-enabled","full-sweep-fail-fast","full-sweep-fail-fast-no-canary"]'), | ||
| github.event.label.name | ||
| ) | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Authorize exact external revision and dispatch | ||
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | ||
| with: | ||
| github-token: ${{ github.token }} | ||
| script: | | ||
| const primaryLabels = new Set([ | ||
| 'sweep-enabled', | ||
| 'full-sweep-enabled', | ||
| 'non-canary-full-sweep-enabled', | ||
| 'full-sweep-fail-fast', | ||
| 'full-sweep-fail-fast-no-canary', | ||
| ]); | ||
| const {data: access} = await github.rest.repos.getCollaboratorPermissionLevel({ | ||
| owner: context.repo.owner, | ||
| repo: context.repo.repo, | ||
| username: context.actor, | ||
| }); | ||
| if (typeof access?.permission !== 'string' || !access.permission || | ||
| typeof access?.role_name !== 'string' || !access.role_name) { | ||
| throw new Error('Invalid repository permission response.'); | ||
| } | ||
| const {permission, role_name: role} = access; | ||
| const trustedPermissions = ['admin', 'maintain', 'write']; | ||
| if (!trustedPermissions.includes(permission) || !trustedPermissions.includes(role)) { | ||
| core.setFailed( | ||
| `@${context.actor} has repository permission "${permission}" and role "${role}"; ` + | ||
| 'both must be write, maintain, or admin to authorize external code.', | ||
| ); | ||
| return; | ||
| } | ||
| const eventPull = context.payload.pull_request; | ||
| const {data: pull} = await github.rest.pulls.get({ | ||
| owner: context.repo.owner, | ||
| repo: context.repo.repo, | ||
| pull_number: eventPull.number, | ||
| }); | ||
| if (pull.state !== 'open' || pull.draft) { | ||
| core.setFailed('The pull request must be open and ready for review.'); | ||
| return; | ||
| } | ||
| if (pull.head.repo?.full_name === context.payload.repository.full_name) { | ||
| core.setFailed('Trusted external dispatch is only for fork pull requests.'); | ||
| return; | ||
| } | ||
| if (pull.head.sha !== eventPull.head.sha) { | ||
| core.setFailed( | ||
| `The PR advanced from ${eventPull.head.sha} to ${pull.head.sha}; ` + | ||
| 'remove and re-add the sweep label to approve the new revision.', | ||
| ); | ||
| return; | ||
| } | ||
| const labels = pull.labels.map((label) => label.name); | ||
| const primary = labels.filter((label) => primaryLabels.has(label)); | ||
| if (primary.length !== 1 || primary[0] !== context.payload.label.name) { | ||
| core.setFailed(`Expected exactly the newly applied primary sweep label; found ${primary}.`); | ||
| return; | ||
| } | ||
| if (!pull.merge_commit_sha) { | ||
| core.setFailed('GitHub has not produced a merge commit; resolve conflicts and re-add the label.'); | ||
| return; | ||
| } | ||
| const marker = `External PR #${pull.number} @ ${pull.head.sha.slice(0, 12)}`; | ||
| const dispatchStarted = Date.now(); | ||
| await github.rest.actions.createWorkflowDispatch({ | ||
| owner: context.repo.owner, | ||
| repo: context.repo.repo, | ||
| workflow_id: 'e2e-tests.yml', | ||
| ref: context.payload.repository.default_branch, | ||
| inputs: { | ||
| 'test-name': marker, | ||
| 'ref': pull.merge_commit_sha, | ||
| 'changelog-base-ref': pull.base.sha, | ||
| 'changelog-head-ref': pull.head.sha, | ||
| 'trim-conc': String(primary[0] === 'sweep-enabled'), | ||
| 'all-evals': String(labels.includes('all-evals')), | ||
| 'evals-only': String(labels.includes('evals-only')), | ||
| 'fail-fast': String(primary[0].includes('fail-fast')), | ||
| 'agentx-fast': String(labels.includes('agentx-fast')), | ||
| 'pr-labels-json': JSON.stringify(labels), | ||
| }, | ||
| }); | ||
| let dispatchedRun; | ||
| for (let attempt = 0; attempt < 15 && !dispatchedRun; attempt += 1) { | ||
| await new Promise((resolve) => setTimeout(resolve, 2000)); | ||
| const runs = await github.rest.actions.listWorkflowRuns({ | ||
| owner: context.repo.owner, | ||
| repo: context.repo.repo, | ||
| workflow_id: 'e2e-tests.yml', | ||
| event: 'workflow_dispatch', | ||
| per_page: 20, | ||
| }); | ||
| dispatchedRun = runs.data.workflow_runs.find((run) => | ||
| run.display_title === `e2e Test - ${marker}` && | ||
| Date.parse(run.created_at) >= dispatchStarted - 5000 | ||
| ); | ||
| } | ||
| const runLink = dispatchedRun | ||
| ? `[trusted sweep run](${dispatchedRun.html_url})` | ||
| : '[End-to-End Tests workflow](https://github.com/SemiAnalysisAI/InferenceX/actions/workflows/e2e-tests.yml)'; | ||
| const body = [ | ||
| `Dispatched ${runLink} for approved external revision \`${pull.head.sha}\`.`, | ||
| 'New commits are not trusted automatically; remove and re-add the primary sweep label to approve a new SHA.', | ||
| '', | ||
| `已为获批的外部提交 \`${pull.head.sha}\` 调度${runLink}。`, | ||
| '后续新提交不会自动获得信任；如需批准新的 SHA，请移除并重新添加主扫描标签。', | ||
| ].join('\n'); | ||
| try { | ||
| await github.rest.issues.createComment({ | ||
| owner: context.repo.owner, | ||
| repo: context.repo.repo, | ||
| issue_number: pull.number, | ||
| body, | ||
| }); | ||
| } catch (error) { | ||
| core.warning( | ||
| `Sweep dispatched successfully, but the PR comment failed: ${error.message}`, | ||
| ); | ||
| } | ||
