mirror of
https://github.com/GreptimeTeam/greptimedb.git
synced 2026-09-08 06:29:04 +00:00
localhost
4d65e8984a
* Implement `/query-regression` command handling and admission workflow - Add `query-regression-slash.py` script for processing `/query-regression` commands in PR comments, validating case arguments, and checking permissions. - Update `checks.yml` to include tests for the new slash command functionality. - Modify `query-regression-comment.yml` to trigger on the new `Query Regression Command` workflow. - Create `query-regression-slash.yml` to handle the dispatched command, validate allowlist and permissions, and initiate the regression workflow. - Enhance `query-regression.yml` to support additional inputs for PR admission and SHA verification. - Introduce `slash-command-dispatch.yml` to parse and dispatch commands from PR comments. - Document the new command admission process in `AGENTS.md` and `README.md`. - Add unit tests in `test_query_regression_slash.py` to cover command parsing and admission logic. * refactor: enhance query-regression command handling with comment validation and identity checks * feat: implement admission identity handling for query regression workflows * refactor: update PR admission logic in query regression workflow * refactor: update token usage in slash command dispatch and README for clarity * test: add cases for handling re-run failed jobs and stale runner artifacts * refactor: improve repository metadata handling in query regression scripts * chore: enable overwrite for artifact uploads to handle re-run failed jobs * chore: enable overwrite for query regression admission uploads * feat: enhance query-regression admission with HMAC signing and verification - Introduced HMAC signing for admission markers in query-regression workflows to ensure integrity and authenticity. - Updated `query-regression-comment.test.cjs` to include tests for signing and verifying admission markers. - Modified `query-regression-slash.py` to handle admission marker signing and verification, including checks for dispatch sender and head SHA consistency. - Enhanced workflows to securely manage admission markers and HMAC secrets, ensuring they are not exposed to untrusted contexts. - Improved documentation to clarify the admission process and the role of HMAC in securing the workflow. * test: add case to find newly posted marker among newer comments * test: add case to verify multiline output handling in write_outputs function
37 lines
1.2 KiB
YAML
37 lines
1.2 KiB
YAML
name: Slash Command Dispatch
|
|
|
|
# ChatOps front door: parse `/command` on PR comments, check admin
|
|
# permission, and repository_dispatch to a per-command handler. Handlers
|
|
# own allowlists, SHA admission, and the actual work. Same-repo dispatch
|
|
# uses github.token with contents: write; GitHub starts the handler run
|
|
# for GITHUB_TOKEN-created repository_dispatch events. Do not pass the
|
|
# long-lived GH_PERSONAL_ACCESS_TOKEN into this third-party action.
|
|
#
|
|
# To add a command: list it under `commands` and add a workflow with
|
|
# `on.repository_dispatch.types: ["<command>-command"]`.
|
|
|
|
on:
|
|
issue_comment:
|
|
types: [created]
|
|
|
|
permissions:
|
|
contents: write
|
|
issues: write
|
|
pull-requests: write
|
|
|
|
jobs:
|
|
slash-command-dispatch:
|
|
name: Dispatch slash command
|
|
if: ${{ github.event.issue.pull_request && startsWith(github.event.comment.body, '/') }}
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
steps:
|
|
- name: Slash Command Dispatch
|
|
uses: peter-evans/slash-command-dispatch@9bdcd7914ec1b75590b790b844aa3b8eee7c683a # v5.0.2
|
|
with:
|
|
token: ${{ github.token }}
|
|
permission: admin
|
|
issue-type: pull-request
|
|
commands: |
|
|
query-regression
|