Reworked fork PR status check reporting

The extra workflow did not work out because the workflow_dispatch inputs of the IT workflow are not accessible.

Added a 'Report fork PR status' step to every IT which reports the IT status on the fork PR. Needed only for fork PRs because their ITs have to run in the context of the main repo to grant access to secrets.

Author: stephanme

.github/actions/report-fork-status/action.yml

@@ -0,0 +1,27 @@
+name: Report fork PR integration test status
+description: Post a GitHub commit status for a single job back to a fork PR head SHA
+
+inputs:
+  pr_ref:
+    description: 'SHA of the fork PR head commit'
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Post commit status
+      shell: bash
+      env:
+        GH_TOKEN: ${{ github.token }}
+      run: |
+        case "${{ job.status }}" in
+          success)             state="success" ;;
+          cancelled|timed_out) state="error"   ;;
+          skipped)             exit 0          ;;
+          *)                   state="failure" ;;
+        esac
+        gh api --method POST "repos/${{ github.repository }}/statuses/${{ inputs.pr_ref }}" \
+          -f state="$state" \
+          -f context="${{ job.name }}" \
+          -f target_url="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+          -f description="${{ job.status }}"

.github/workflows/alioss-integration.yml

@@ -25,6 +25,8 @@ jobs:
       github.event_name == 'push' ||
       github.event_name == 'workflow_dispatch' ||
       (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository)
+    permissions:
+      statuses: write
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
@@ -53,4 +55,9 @@ jobs:
         run: |
             export access_key_id="${{ secrets.ALI_ACCESS_KEY_ID }}"
             export access_key_secret="${{ secrets.ALI_ACCESS_KEY_SECRET }}"
-            ./.github/scripts/alioss/teardown.sh
+            ./.github/scripts/alioss/teardown.sh
+      - name: Report fork PR status
+        if: always() && inputs.pr_ref != ''
+        uses: ./.github/actions/report-fork-status
+        with:
+          pr_ref: ${{ inputs.pr_ref }}

.github/workflows/azurebs-integration.yml

@@ -25,6 +25,8 @@ jobs:
       github.event_name == 'push' ||
       github.event_name == 'workflow_dispatch' ||
       (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository)
+    permissions:
+      statuses: write
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
@@ -52,4 +54,8 @@ jobs:
             export azure_storage_account="${{ secrets.AZURE_STORAGE_ACCOUNT }}"
             export azure_storage_key="${{ secrets.AZURE_STORAGE_KEY }}"
             ./.github/scripts/azurebs/teardown.sh
-  
+      - name: Report fork PR status
+        if: always() && inputs.pr_ref != ''
+        uses: ./.github/actions/report-fork-status
+        with:
+          pr_ref: ${{ inputs.pr_ref }}

.github/workflows/dav-integration.yml

@@ -24,7 +24,8 @@ jobs:
       github.event_name == 'push' ||
       github.event_name == 'workflow_dispatch' ||
       (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository)
-
+    permissions:
+      statuses: write
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
@@ -41,3 +42,9 @@ jobs:
 
       - name: Run DAV Integration Tests
         run: ginkgo -r dav/integration/
+
+      - name: Report fork PR status
+        if: always() && inputs.pr_ref != ''
+        uses: ./.github/actions/report-fork-status
+        with:
+          pr_ref: ${{ inputs.pr_ref }}

.github/workflows/fork-integration-status-reporter.yml

@@ -45,9 +45,6 @@ jobs:
             -f content=rocket
 
       - name: Trigger integration tests
-        env:
-          # need bot token, otherwise the IT workflows won't trigger fork-integration-status-reporter.yml
-          GH_TOKEN: ${{ secrets.BOT_GH_TOKEN }}
         run: |
           # run all integration test workflows in context of main branch, passing the PR head SHA as an input
           for workflow in s3-integration.yml gcs-integration.yml alioss-integration.yml azurebs-integration.yml dav-integration.yml; do

.github/workflows/fork-integration-trigger.yml

@@ -25,6 +25,8 @@ jobs:
       github.event_name == 'push' ||
       github.event_name == 'workflow_dispatch' ||
       (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository)
+    permissions:
+      statuses: write
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
@@ -40,7 +42,7 @@ jobs:
         run: |
             echo "${{ secrets.GCP_SERVICE_ACCOUNT_BASE64 }}" | base64 -d > /tmp/gcp-key.json
             export google_json_key_data="$(cat /tmp/gcp-key.json)"
-            ./.github/scripts/gcs/setup.sh       
+            ./.github/scripts/gcs/setup.sh
       - name: Run Fast Tests
         run: |
           echo "${{ secrets.GCP_SERVICE_ACCOUNT_BASE64 }}" | base64 -d > /tmp/gcp-key.json
@@ -53,6 +55,11 @@ jobs:
             echo "${{ secrets.GCP_SERVICE_ACCOUNT_BASE64 }}" | base64 -d > /tmp/gcp-key.json
             export google_json_key_data="$(cat /tmp/gcp-key.json)"
             ./.github/scripts/gcs/teardown.sh
+      - name: Report fork PR status
+        if: always() && inputs.pr_ref != ''
+        uses: ./.github/actions/report-fork-status
+        with:
+          pr_ref: ${{ inputs.pr_ref }}
 
   gcs-integration-all-tests:
     name:  GCS Integation All Tests
@@ -62,11 +69,13 @@ jobs:
       github.event_name == 'push' ||
       github.event_name == 'workflow_dispatch' ||
       (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository)
+    permissions:
+      statuses: write
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
         with:
-          ref: ${{ inputs.pr_ref || github.sha }} 
+          ref: ${{ inputs.pr_ref || github.sha }}
       - name: Set up Go
         uses: actions/setup-go@v6
         with:
@@ -77,7 +86,7 @@ jobs:
         run: |
             echo "${{ secrets.GCP_SERVICE_ACCOUNT_BASE64 }}" | base64 -d > /tmp/gcp-key.json
             export google_json_key_data="$(cat /tmp/gcp-key.json)"
-            ./.github/scripts/gcs/setup.sh  
+            ./.github/scripts/gcs/setup.sh
       - name: Run All Tests
         run: |
           echo "${{ secrets.GCP_SERVICE_ACCOUNT_BASE64 }}" | base64 -d > /tmp/gcp-key.json
@@ -89,4 +98,8 @@ jobs:
             echo "${{ secrets.GCP_SERVICE_ACCOUNT_BASE64 }}" | base64 -d > /tmp/gcp-key.json
             export google_json_key_data="$(cat /tmp/gcp-key.json)"
             ./.github/scripts/gcs/teardown.sh
-
+      - name: Report fork PR status
+        if: always() && inputs.pr_ref != ''
+        uses: ./.github/actions/report-fork-status
+        with:
+          pr_ref: ${{ inputs.pr_ref }}

.github/workflows/gcs-integration.yml

@@ -25,6 +25,8 @@ jobs:
       github.event_name == 'push' ||
       github.event_name == 'workflow_dispatch' ||
       (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository)
+    permissions:
+      statuses: write
     env:
       REGION_NAME: us-east-1
       STACK_NAME: s3cli-iam
@@ -87,6 +89,12 @@ jobs:
           region_name: ${{ env.REGION_NAME }}
           stack_name: ${{ env.STACK_NAME }}
 
+      - name: Report fork PR status
+        if: always() && inputs.pr_ref != ''
+        uses: ./.github/actions/report-fork-status
+        with:
+          pr_ref: ${{ inputs.pr_ref }}
+
   aws-s3-regional-integration:
     name: AWS S3 ${{ matrix.name }} Integration
     runs-on: ubuntu-latest
@@ -95,6 +103,8 @@ jobs:
       github.event_name == 'push' ||
       github.event_name == 'workflow_dispatch' ||
       (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository)
+    permissions:
+      statuses: write
     strategy:
       fail-fast: false
       matrix:
@@ -154,29 +164,44 @@ jobs:
           region_name: ${{ matrix.region_name }}
           stack_name: ${{ matrix.stack_name }}
 
+      - name: Report fork PR status
+        if: always() && inputs.pr_ref != ''
+        uses: ./.github/actions/report-fork-status
+        with:
+          pr_ref: ${{ inputs.pr_ref }}
+
   s3-compatible-integration:
-   name: S3 Compatible Integration
-   runs-on: ubuntu-latest
-   # Run on push/workflow_dispatch, skip fork PRs
-   if: |
-     github.event_name == 'push' ||
-     github.event_name == 'workflow_dispatch' ||
-     (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository)
-   steps:
-     - name: Checkout code
-       uses: actions/checkout@v7
-       with:
-         ref: ${{ inputs.pr_ref || github.sha }}
-
-     - name: Set up test environment
-       uses: ./.github/actions/go-test-bootstrap
-
-     - name: Run GCS S3 compatible tests
-       run: |
-         export access_key_id="${{ secrets.GCP_ACCESS_KEY_ID }}"
-         export secret_access_key="${{ secrets.GCP_SECRET_ACCESS_KEY }}"
-         export bucket_name=storage-cli-test-aws-compat
-         export s3_endpoint_host=storage.googleapis.com
-         export s3_endpoint_port=443
-         export label_filter='s3-compatible'
-         ./.github/scripts/s3/run-integration-s3-compat.sh
+    name: S3 Compatible Integration
+    runs-on: ubuntu-latest
+    # Run on push/workflow_dispatch, skip fork PRs
+    if: |
+      github.event_name == 'push' ||
+      github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository)
+    permissions:
+      statuses: write
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ inputs.pr_ref || github.sha }}
+
+      - name: Set up test environment
+        uses: ./.github/actions/go-test-bootstrap
+
+      - name: Run GCS S3 compatible tests
+        run: |
+          export access_key_id="${{ secrets.GCP_ACCESS_KEY_ID }}"
+          export secret_access_key="${{ secrets.GCP_SECRET_ACCESS_KEY }}"
+          export bucket_name=storage-cli-test-aws-compat
+          export s3_endpoint_host=storage.googleapis.com
+          export s3_endpoint_port=443
+          export label_filter='s3-compatible'
+          ./.github/scripts/s3/run-integration-s3-compat.sh
+
+      - name: Report fork PR status
+        if: always() && inputs.pr_ref != ''
+        uses: ./.github/actions/report-fork-status
+        with:
+          pr_ref: ${{ inputs.pr_ref }}
+