Skip to content

Commit 1674215

Browse files
richmrichm
committed
ci: do not run ci tests by default, require citest comment or label [citest_skip]
github action ci jobs are a precious resource - we only have 20 jobs - when multiple PRs are submitted we may have to wait hours to get results. We need to be explicit about where and when to run ci jobs. With this change, when a PR is created or updated, CI tests will not run automatically. A role maintainer (OWNER, MEMBER, COLLABORATOR, or systemroller) must either comment on the PR or add a label: * `[citest_all]` comment or `citest_all` label - run all CI tests, including checks and Testing Farm integration tests * `[citest_$test]` comment or `citest_$test` label - run only that test - for example, `[citest_ansible-lint]` or the `citest_ansible-lint` label * For Testing Farm, `[citest_tft]` / `citest_tft` runs those tests. `[citest]` / `citest` is still accepted for Testing Farm for backward compatibility. Comments work on issue_comment; labels take effect when the PR is opened, when new commits are pushed, or when the label is added. These labels are managed by system roles .github automation. See linux-system-roles/.github#186 If you use the `gh` command to interact with github, you can use `gh pr comment $PRNUM -b '[citest_all]'` or `gh pr edit $PRNUM --add-label citest_all` Signed-off-by: Rich Megginson <rmeggins@redhat.com>
1 parent 294d867 commit 1674215

14 files changed

Lines changed: 683 additions & 38 deletions

‎.github/workflows/ansible-lint.yml‎

Lines changed: 54 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,13 @@
22
name: Ansible Lint
33
on: # yamllint disable-line rule:truthy
44
pull_request:
5+
types:
6+
- opened
7+
- synchronize
8+
- labeled
9+
issue_comment:
10+
types:
11+
- created
512
merge_group:
613
branches:
714
- main
@@ -16,11 +23,43 @@ env:
1623
LSR_ROLE2COLL_NAME: linux_system_roles
1724
permissions:
1825
contents: read
26+
pull-requests: read
1927
jobs:
2028
ansible_lint:
2129
if: |
22-
!((github.event_name == 'pull_request' && contains(github.event.pull_request.title, '[citest_skip]')) ||
23-
(github.event_name == 'push' && contains(github.event.head_commit.message, '[citest_skip]')))
30+
(
31+
github.event_name == 'issue_comment'
32+
&& github.event.issue.pull_request
33+
&& (contains(github.event.comment.body, '[citest_all]')
34+
|| contains(github.event.comment.body, '[citest_ansible-lint]'))
35+
&& (contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'),
36+
github.event.comment.author_association)
37+
|| github.event.comment.user.login == 'systemroller')
38+
) || (
39+
github.event_name == 'pull_request'
40+
&& github.event.action == 'opened'
41+
&& (contains(github.event.pull_request.labels.*.name, 'citest_all')
42+
|| contains(github.event.pull_request.labels.*.name, 'citest_ansible-lint'))
43+
&& (contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'),
44+
github.event.pull_request.author_association)
45+
|| github.event.pull_request.user.login == 'systemroller')
46+
) || (
47+
github.event_name == 'pull_request'
48+
&& github.event.action == 'synchronize'
49+
&& (contains(github.event.pull_request.labels.*.name, 'citest_all')
50+
|| contains(github.event.pull_request.labels.*.name, 'citest_ansible-lint'))
51+
&& (contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'),
52+
github.event.pull_request.author_association)
53+
|| github.event.sender.login == 'systemroller')
54+
) || (
55+
github.event_name == 'pull_request'
56+
&& github.event.action == 'labeled'
57+
&& (github.event.label.name == 'citest_all'
58+
|| github.event.label.name == 'citest_ansible-lint')
59+
&& (contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'),
60+
github.event.pull_request.author_association)
61+
|| github.event.sender.login == 'systemroller')
62+
)
2463
runs-on: ubuntu-latest
2564
strategy:
2665
fail-fast: false
@@ -38,10 +77,23 @@ jobs:
3877
sudo apt update
3978
sudo apt install -y git
4079
80+
- name: Get PR head SHA
81+
if: github.event_name == 'issue_comment'
82+
id: head_sha
83+
env:
84+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
85+
REPO: ${{ github.repository }}
86+
PR_NUMBER: ${{ github.event.issue.number }}
87+
run: |
88+
set -euxo pipefail
89+
head_sha=$(gh api "repos/$REPO/pulls/$PR_NUMBER" --jq '.head.sha')
90+
echo "head_sha=$head_sha" >> "$GITHUB_OUTPUT"
91+
4192
- name: Checkout repo
4293
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
4394
with:
4495
persist-credentials: false
96+
ref: ${{ steps.head_sha.outputs.head_sha || github.sha }}
4597

4698
- name: Install tox, tox-lsr
4799
run: |

‎.github/workflows/ansible-managed-var-comment.yml‎

Lines changed: 54 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,13 @@
22
name: Check for ansible_managed variable use in comments
33
on: # yamllint disable-line rule:truthy
44
pull_request:
5+
types:
6+
- opened
7+
- synchronize
8+
- labeled
9+
issue_comment:
10+
types:
11+
- created
512
merge_group:
613
branches:
714
- main
@@ -13,11 +20,43 @@ on: # yamllint disable-line rule:truthy
1320
workflow_dispatch:
1421
permissions:
1522
contents: read
23+
pull-requests: read
1624
jobs:
1725
ansible_managed_var_comment:
1826
if: |
19-
!((github.event_name == 'pull_request' && contains(github.event.pull_request.title, '[citest_skip]')) ||
20-
(github.event_name == 'push' && contains(github.event.head_commit.message, '[citest_skip]')))
27+
(
28+
github.event_name == 'issue_comment'
29+
&& github.event.issue.pull_request
30+
&& (contains(github.event.comment.body, '[citest_all]')
31+
|| contains(github.event.comment.body, '[citest_ansible-managed-var-comment]'))
32+
&& (contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'),
33+
github.event.comment.author_association)
34+
|| github.event.comment.user.login == 'systemroller')
35+
) || (
36+
github.event_name == 'pull_request'
37+
&& github.event.action == 'opened'
38+
&& (contains(github.event.pull_request.labels.*.name, 'citest_all')
39+
|| contains(github.event.pull_request.labels.*.name, 'citest_ansible-managed-var-comment'))
40+
&& (contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'),
41+
github.event.pull_request.author_association)
42+
|| github.event.pull_request.user.login == 'systemroller')
43+
) || (
44+
github.event_name == 'pull_request'
45+
&& github.event.action == 'synchronize'
46+
&& (contains(github.event.pull_request.labels.*.name, 'citest_all')
47+
|| contains(github.event.pull_request.labels.*.name, 'citest_ansible-managed-var-comment'))
48+
&& (contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'),
49+
github.event.pull_request.author_association)
50+
|| github.event.sender.login == 'systemroller')
51+
) || (
52+
github.event_name == 'pull_request'
53+
&& github.event.action == 'labeled'
54+
&& (github.event.label.name == 'citest_all'
55+
|| github.event.label.name == 'citest_ansible-managed-var-comment')
56+
&& (contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'),
57+
github.event.pull_request.author_association)
58+
|| github.event.sender.login == 'systemroller')
59+
)
2160
runs-on: ubuntu-latest
2261
steps:
2362
- name: Update pip, git
@@ -27,10 +66,23 @@ jobs:
2766
sudo apt update
2867
sudo apt install -y git
2968
69+
- name: Get PR head SHA
70+
if: github.event_name == 'issue_comment'
71+
id: head_sha
72+
env:
73+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
74+
REPO: ${{ github.repository }}
75+
PR_NUMBER: ${{ github.event.issue.number }}
76+
run: |
77+
set -euxo pipefail
78+
head_sha=$(gh api "repos/$REPO/pulls/$PR_NUMBER" --jq '.head.sha')
79+
echo "head_sha=$head_sha" >> "$GITHUB_OUTPUT"
80+
3081
- name: Checkout repo
3182
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
3283
with:
3384
persist-credentials: false
85+
ref: ${{ steps.head_sha.outputs.head_sha || github.sha }}
3486

3587
- name: Install tox, tox-lsr
3688
run: |

‎.github/workflows/ansible-test.yml‎

Lines changed: 54 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,13 @@
22
name: Ansible Test
33
on: # yamllint disable-line rule:truthy
44
pull_request:
5+
types:
6+
- opened
7+
- synchronize
8+
- labeled
9+
issue_comment:
10+
types:
11+
- created
512
merge_group:
613
branches:
714
- main
@@ -16,11 +23,43 @@ env:
1623
LSR_ROLE2COLL_NAME: linux_system_roles
1724
permissions:
1825
contents: read
26+
pull-requests: read
1927
jobs:
2028
ansible_test:
2129
if: |
22-
!((github.event_name == 'pull_request' && contains(github.event.pull_request.title, '[citest_skip]')) ||
23-
(github.event_name == 'push' && contains(github.event.head_commit.message, '[citest_skip]')))
30+
(
31+
github.event_name == 'issue_comment'
32+
&& github.event.issue.pull_request
33+
&& (contains(github.event.comment.body, '[citest_all]')
34+
|| contains(github.event.comment.body, '[citest_ansible-test]'))
35+
&& (contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'),
36+
github.event.comment.author_association)
37+
|| github.event.comment.user.login == 'systemroller')
38+
) || (
39+
github.event_name == 'pull_request'
40+
&& github.event.action == 'opened'
41+
&& (contains(github.event.pull_request.labels.*.name, 'citest_all')
42+
|| contains(github.event.pull_request.labels.*.name, 'citest_ansible-test'))
43+
&& (contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'),
44+
github.event.pull_request.author_association)
45+
|| github.event.pull_request.user.login == 'systemroller')
46+
) || (
47+
github.event_name == 'pull_request'
48+
&& github.event.action == 'synchronize'
49+
&& (contains(github.event.pull_request.labels.*.name, 'citest_all')
50+
|| contains(github.event.pull_request.labels.*.name, 'citest_ansible-test'))
51+
&& (contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'),
52+
github.event.pull_request.author_association)
53+
|| github.event.sender.login == 'systemroller')
54+
) || (
55+
github.event_name == 'pull_request'
56+
&& github.event.action == 'labeled'
57+
&& (github.event.label.name == 'citest_all'
58+
|| github.event.label.name == 'citest_ansible-test')
59+
&& (contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'),
60+
github.event.pull_request.author_association)
61+
|| github.event.sender.login == 'systemroller')
62+
)
2463
runs-on: ubuntu-latest
2564
strategy:
2665
fail-fast: false # get all results, not just the first failure
@@ -41,10 +80,23 @@ jobs:
4180
sudo apt update
4281
sudo apt install -y git
4382
83+
- name: Get PR head SHA
84+
if: github.event_name == 'issue_comment'
85+
id: head_sha
86+
env:
87+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
88+
REPO: ${{ github.repository }}
89+
PR_NUMBER: ${{ github.event.issue.number }}
90+
run: |
91+
set -euxo pipefail
92+
head_sha=$(gh api "repos/$REPO/pulls/$PR_NUMBER" --jq '.head.sha')
93+
echo "head_sha=$head_sha" >> "$GITHUB_OUTPUT"
94+
4495
- name: Checkout repo
4596
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
4697
with:
4798
persist-credentials: false
99+
ref: ${{ steps.head_sha.outputs.head_sha || github.sha }}
48100

49101
- name: Install tox, tox-lsr
50102
run: |

‎.github/workflows/codeql.yml‎

Lines changed: 57 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,21 +5,63 @@ on: # yamllint disable-line rule:truthy
55
branches: ["main"]
66
pull_request:
77
branches: ["main"]
8+
types:
9+
- opened
10+
- synchronize
11+
- labeled
12+
issue_comment:
13+
types:
14+
- created
815
merge_group:
916
branches:
1017
- main
1118
types:
1219
- checks_requested
1320
schedule:
1421
- cron: 39 10 * * 0
22+
permissions:
23+
contents: read
24+
pull-requests: read
1525
jobs:
1626
analyze:
1727
if: |
18-
!((github.event_name == 'pull_request' && contains(github.event.pull_request.title, '[citest_skip]')) ||
19-
(github.event_name == 'push' && contains(github.event.head_commit.message, '[citest_skip]')))
28+
(
29+
github.event_name == 'issue_comment'
30+
&& github.event.issue.pull_request
31+
&& (contains(github.event.comment.body, '[citest_all]')
32+
|| contains(github.event.comment.body, '[citest_codeql]'))
33+
&& (contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'),
34+
github.event.comment.author_association)
35+
|| github.event.comment.user.login == 'systemroller')
36+
) || (
37+
github.event_name == 'pull_request'
38+
&& github.event.action == 'opened'
39+
&& (contains(github.event.pull_request.labels.*.name, 'citest_all')
40+
|| contains(github.event.pull_request.labels.*.name, 'citest_codeql'))
41+
&& (contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'),
42+
github.event.pull_request.author_association)
43+
|| github.event.pull_request.user.login == 'systemroller')
44+
) || (
45+
github.event_name == 'pull_request'
46+
&& github.event.action == 'synchronize'
47+
&& (contains(github.event.pull_request.labels.*.name, 'citest_all')
48+
|| contains(github.event.pull_request.labels.*.name, 'citest_codeql'))
49+
&& (contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'),
50+
github.event.pull_request.author_association)
51+
|| github.event.sender.login == 'systemroller')
52+
) || (
53+
github.event_name == 'pull_request'
54+
&& github.event.action == 'labeled'
55+
&& (github.event.label.name == 'citest_all'
56+
|| github.event.label.name == 'citest_codeql')
57+
&& (contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'),
58+
github.event.pull_request.author_association)
59+
|| github.event.sender.login == 'systemroller')
60+
)
2061
name: Analyze
2162
runs-on: ubuntu-latest
2263
permissions:
64+
pull-requests: read
2365
actions: read
2466
contents: read
2567
security-events: write
@@ -33,10 +75,23 @@ jobs:
3375
set -euxo pipefail
3476
sudo apt update
3577
sudo apt install -y git
78+
- name: Get PR head SHA
79+
if: github.event_name == 'issue_comment'
80+
id: head_sha
81+
env:
82+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
83+
REPO: ${{ github.repository }}
84+
PR_NUMBER: ${{ github.event.issue.number }}
85+
run: |
86+
set -euxo pipefail
87+
head_sha=$(gh api "repos/$REPO/pulls/$PR_NUMBER" --jq '.head.sha')
88+
echo "head_sha=$head_sha" >> "$GITHUB_OUTPUT"
89+
3690
- name: Checkout
3791
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
3892
with:
3993
persist-credentials: false
94+
ref: ${{ steps.head_sha.outputs.head_sha || github.sha }}
4095

4196
- name: Initialize CodeQL
4297
uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9

0 commit comments

Comments
 (0)