mirror of
https://github.com/GreptimeTeam/greptimedb.git
synced 2026-09-08 06:29:04 +00:00
localhost
4d65e8984a
* Implement `/query-regression` command handling and admission workflow - Add `query-regression-slash.py` script for processing `/query-regression` commands in PR comments, validating case arguments, and checking permissions. - Update `checks.yml` to include tests for the new slash command functionality. - Modify `query-regression-comment.yml` to trigger on the new `Query Regression Command` workflow. - Create `query-regression-slash.yml` to handle the dispatched command, validate allowlist and permissions, and initiate the regression workflow. - Enhance `query-regression.yml` to support additional inputs for PR admission and SHA verification. - Introduce `slash-command-dispatch.yml` to parse and dispatch commands from PR comments. - Document the new command admission process in `AGENTS.md` and `README.md`. - Add unit tests in `test_query_regression_slash.py` to cover command parsing and admission logic. * refactor: enhance query-regression command handling with comment validation and identity checks * feat: implement admission identity handling for query regression workflows * refactor: update PR admission logic in query regression workflow * refactor: update token usage in slash command dispatch and README for clarity * test: add cases for handling re-run failed jobs and stale runner artifacts * refactor: improve repository metadata handling in query regression scripts * chore: enable overwrite for artifact uploads to handle re-run failed jobs * chore: enable overwrite for query regression admission uploads * feat: enhance query-regression admission with HMAC signing and verification - Introduced HMAC signing for admission markers in query-regression workflows to ensure integrity and authenticity. - Updated `query-regression-comment.test.cjs` to include tests for signing and verifying admission markers. - Modified `query-regression-slash.py` to handle admission marker signing and verification, including checks for dispatch sender and head SHA consistency. - Enhanced workflows to securely manage admission markers and HMAC secrets, ensuring they are not exposed to untrusted contexts. - Improved documentation to clarify the admission process and the role of HMAC in securing the workflow. * test: add case to find newly posted marker among newer comments * test: add case to verify multiline output handling in write_outputs function
104 lines
3.7 KiB
YAML
104 lines
3.7 KiB
YAML
name: Query Regression Comment
|
|
|
|
on:
|
|
workflow_run:
|
|
workflows:
|
|
- Query Regression Command
|
|
types: [completed]
|
|
|
|
permissions:
|
|
contents: read
|
|
actions: read
|
|
issues: read
|
|
pull-requests: write
|
|
|
|
jobs:
|
|
comment:
|
|
if: >-
|
|
${{ github.event.workflow_run.conclusion != 'cancelled' &&
|
|
github.event.workflow_run.conclusion != 'skipped' &&
|
|
github.event.workflow_run.event == 'repository_dispatch' }}
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
steps:
|
|
- name: Checkout trusted scripts
|
|
uses: actions/checkout@v4
|
|
with:
|
|
ref: ${{ github.event.repository.default_branch }}
|
|
persist-credentials: false
|
|
|
|
- name: Locate query regression artifacts
|
|
id: artifact
|
|
uses: actions/github-script@v7
|
|
with:
|
|
script: |
|
|
const { owner, repo } = context.repo;
|
|
const run_id = context.payload.workflow_run.id;
|
|
const { data } = await github.rest.actions.listWorkflowRunArtifacts({
|
|
owner,
|
|
repo,
|
|
run_id,
|
|
per_page: 100,
|
|
});
|
|
const admission = data.artifacts.find(
|
|
item => item.name === 'query-regression-admission' && !item.expired
|
|
);
|
|
const comment = data.artifacts.find(
|
|
item => item.name === 'query-regression-comment' && !item.expired
|
|
);
|
|
if (!admission || !comment) {
|
|
core.info('Trusted admission identity or comment artifact missing; skipping.');
|
|
core.setOutput('found', 'false');
|
|
return;
|
|
}
|
|
core.setOutput('found', 'true');
|
|
core.setOutput('admission_id', String(admission.id));
|
|
core.setOutput('comment_id', String(comment.id));
|
|
|
|
- name: Download admission identity
|
|
id: download-admission
|
|
if: ${{ steps.artifact.outputs.found == 'true' }}
|
|
uses: actions/download-artifact@v4
|
|
continue-on-error: true
|
|
with:
|
|
artifact-ids: ${{ steps.artifact.outputs.admission_id }}
|
|
path: query-regression-admission
|
|
repository: ${{ github.repository }}
|
|
github-token: ${{ secrets.GITHUB_TOKEN }}
|
|
run-id: ${{ github.event.workflow_run.id }}
|
|
merge-multiple: true
|
|
|
|
- name: Download query regression comment artifact
|
|
id: download
|
|
if: ${{ steps.download-admission.outcome == 'success' }}
|
|
uses: actions/download-artifact@v4
|
|
continue-on-error: true
|
|
with:
|
|
artifact-ids: ${{ steps.artifact.outputs.comment_id }}
|
|
path: query-regression-comment
|
|
repository: ${{ github.repository }}
|
|
github-token: ${{ secrets.GITHUB_TOKEN }}
|
|
run-id: ${{ github.event.workflow_run.id }}
|
|
merge-multiple: true
|
|
|
|
- name: Validate PR metadata and prepare comment
|
|
id: validate
|
|
if: ${{ steps.download.outcome == 'success' }}
|
|
uses: actions/github-script@v7
|
|
env:
|
|
WORKFLOW_RUN_ID: ${{ github.event.workflow_run.id }}
|
|
WORKFLOW_RUN_ATTEMPT: ${{ github.event.workflow_run.run_attempt }}
|
|
QUERY_REGRESSION_ADMISSION_HMAC: ${{ secrets.QUERY_REGRESSION_ADMISSION_HMAC }}
|
|
with:
|
|
script: |
|
|
const validate = require('./.github/scripts/query-regression-comment.cjs');
|
|
await validate({ github, context, core });
|
|
|
|
- name: Post sticky PR comment
|
|
if: ${{ steps.validate.outputs.should_post == 'true' }}
|
|
uses: marocchino/sticky-pull-request-comment@v2
|
|
with:
|
|
header: query-regression-report
|
|
number: ${{ steps.validate.outputs.pr_number }}
|
|
path: ${{ steps.validate.outputs.summary_path }}
|