mirror of
https://github.com/GreptimeTeam/greptimedb.git
synced 2026-09-08 06:29:04 +00:00
localhost
4d65e8984a
* Implement `/query-regression` command handling and admission workflow - Add `query-regression-slash.py` script for processing `/query-regression` commands in PR comments, validating case arguments, and checking permissions. - Update `checks.yml` to include tests for the new slash command functionality. - Modify `query-regression-comment.yml` to trigger on the new `Query Regression Command` workflow. - Create `query-regression-slash.yml` to handle the dispatched command, validate allowlist and permissions, and initiate the regression workflow. - Enhance `query-regression.yml` to support additional inputs for PR admission and SHA verification. - Introduce `slash-command-dispatch.yml` to parse and dispatch commands from PR comments. - Document the new command admission process in `AGENTS.md` and `README.md`. - Add unit tests in `test_query_regression_slash.py` to cover command parsing and admission logic. * refactor: enhance query-regression command handling with comment validation and identity checks * feat: implement admission identity handling for query regression workflows * refactor: update PR admission logic in query regression workflow * refactor: update token usage in slash command dispatch and README for clarity * test: add cases for handling re-run failed jobs and stale runner artifacts * refactor: improve repository metadata handling in query regression scripts * chore: enable overwrite for artifact uploads to handle re-run failed jobs * chore: enable overwrite for query regression admission uploads * feat: enhance query-regression admission with HMAC signing and verification - Introduced HMAC signing for admission markers in query-regression workflows to ensure integrity and authenticity. - Updated `query-regression-comment.test.cjs` to include tests for signing and verifying admission markers. - Modified `query-regression-slash.py` to handle admission marker signing and verification, including checks for dispatch sender and head SHA consistency. - Enhanced workflows to securely manage admission markers and HMAC secrets, ensuring they are not exposed to untrusted contexts. - Improved documentation to clarify the admission process and the role of HMAC in securing the workflow. * test: add case to find newly posted marker among newer comments * test: add case to verify multiline output handling in write_outputs function
139 lines
4.3 KiB
YAML
139 lines
4.3 KiB
YAML
on:
|
|
schedule:
|
|
- cron: "0 15 * * 1-5"
|
|
merge_group:
|
|
pull_request:
|
|
types: [ opened, synchronize, reopened, ready_for_review ]
|
|
paths-ignore:
|
|
- 'docs/**'
|
|
- 'config/**'
|
|
- '**.md'
|
|
- '.dockerignore'
|
|
- 'docker/**'
|
|
- '.gitignore'
|
|
- 'grafana/**'
|
|
- 'Makefile'
|
|
workflow_dispatch:
|
|
|
|
name: Checks
|
|
|
|
env:
|
|
TAPLO_VERSION: "0.9.3"
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
check-typos-and-docs:
|
|
if: ${{ github.repository == 'GreptimeTeam/greptimedb' }}
|
|
name: Check typos and docs
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
persist-credentials: false
|
|
- uses: crate-ci/typos@master
|
|
- name: Check the config docs
|
|
run: |
|
|
make config-docs && \
|
|
git diff --name-only --exit-code ./config/config.md \
|
|
|| (echo "'config/config.md' is not up-to-date, please run 'make config-docs'." && exit 1)
|
|
|
|
license-header-check:
|
|
if: ${{ github.repository == 'GreptimeTeam/greptimedb' }}
|
|
runs-on: ubuntu-latest
|
|
name: Check License Header
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
persist-credentials: false
|
|
- name: Check enterprise license lists
|
|
run: make check-enterprise-license
|
|
- uses: korandoru/hawkeye@v5
|
|
- name: Check enterprise license header
|
|
uses: korandoru/hawkeye@v5
|
|
with:
|
|
config: licenserc-enterprise.toml
|
|
|
|
github-script-tests:
|
|
if: ${{ github.repository == 'GreptimeTeam/greptimedb' }}
|
|
name: GitHub Script Tests
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
persist-credentials: false
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 24
|
|
- name: Run Node GitHub script tests
|
|
run: node --test .github/scripts/query-regression-comment.test.cjs
|
|
- name: Setup uv
|
|
uses: astral-sh/setup-uv@v3
|
|
with:
|
|
version: "latest"
|
|
- name: Run check-version script tests
|
|
run: uv run --no-project python .github/scripts/check-version-test.py
|
|
- name: Run enterprise license check tests
|
|
run: python3 scripts/check-enterprise-license-test.py
|
|
- name: Run fuzz orchestration script tests
|
|
run: .github/scripts/run-fuzz-targets-test.sh
|
|
- name: Run query-regression Python tooling tests
|
|
run: |
|
|
python3 tests/perf/test_query_regression_runner_compaction_toctou.py
|
|
python3 tests/perf/test_query_regression_runner_otlp_trace_load.py
|
|
python3 tests/perf/test_query_regression_summary_otlp.py
|
|
python3 tests/perf/test_query_regression_case_selection.py
|
|
python3 tests/perf/test_query_regression_nightly_refs.py
|
|
python3 tests/perf/test_query_regression_slash.py
|
|
python3 tests/perf/test_aliyun_ecs_runner_scripts.py
|
|
|
|
check:
|
|
if: ${{ github.repository == 'GreptimeTeam/greptimedb' }}
|
|
name: Check
|
|
runs-on: ${{ matrix.os }}
|
|
strategy:
|
|
matrix:
|
|
os: [ ubuntu-latest ]
|
|
timeout-minutes: 60
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
persist-credentials: false
|
|
- uses: arduino/setup-protoc@v3
|
|
with:
|
|
repo-token: ${{ secrets.GITHUB_TOKEN }}
|
|
- uses: actions-rust-lang/setup-rust-toolchain@v1
|
|
- name: Rust Cache
|
|
uses: Swatinem/rust-cache@v2
|
|
with:
|
|
# Shares across multiple jobs
|
|
# Shares with `Clippy` job
|
|
shared-key: "check-lint"
|
|
cache-all-crates: "true"
|
|
save-if: ${{ github.ref == 'refs/heads/main' }}
|
|
- name: Run cargo check
|
|
run: cargo check --locked --workspace --all-targets
|
|
- name: Run cargo check (all features)
|
|
run: cargo check --locked --workspace --all-targets --all-features
|
|
|
|
toml:
|
|
if: ${{ github.repository == 'GreptimeTeam/greptimedb' }}
|
|
name: Toml Check
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 60
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
persist-credentials: false
|
|
- uses: actions-rust-lang/setup-rust-toolchain@v1
|
|
- name: Install taplo
|
|
uses: taiki-e/install-action@v2
|
|
with:
|
|
tool: taplo@${{ env.TAPLO_VERSION }}
|
|
fallback: none
|
|
- name: Run taplo
|
|
run: taplo format --check
|