mirror of
https://github.com/openobserve/openobserve.git
synced 2026-11-04 16:09:05 +00:00
98 lines
4.3 KiB
YAML
98 lines
4.3 KiB
YAML
name: Query Agent Caller (openobserve)
|
|
|
|
# Thin caller: watches openobserve (OSS) PRs and forwards to the reusable
|
|
# Query Agent engine in o2-enterprise. All real logic (triage, build, test,
|
|
# generation) lives in the engine; this file only gates (allowlist + command
|
|
# detection) and forwards.
|
|
#
|
|
# WHY A CALLER (not self-contained): a reusable workflow runs in the CALLER's
|
|
# context, so triggering from here makes the run use openobserve's own
|
|
# GITHUB_TOKEN / github-actions[bot] — which can comment on OSS PRs, push
|
|
# to OSS branches (for Phase B autoqa commits), and create OSS PRs. The
|
|
# engine file in o2-enterprise would run in ENT context and could NOT do any
|
|
# of these for OSS.
|
|
#
|
|
# TWO ENTRY POINTS:
|
|
# - issue_comment → an allowlisted engineer comments /query-agent or
|
|
# /qa-generate on an OSS PR.
|
|
# - workflow_dispatch → manual "Run workflow" button against a PR number.
|
|
# Dispatch is inherently restricted to repo write access.
|
|
#
|
|
# ACCESS CONTROL (comment path): gate on the commenter being in the hardcoded
|
|
# engineering-team allowlist. This is checked here AND re-validated in the
|
|
# engine's triage job (harmless double-check).
|
|
#
|
|
# SECRETS: DEEPSEEK_API_KEY_E2E and ORG_ADMIN_TOKEN must exist in
|
|
# openobserve secrets. E2E_DEV_CI_TOKEN is forwarded as CROSS_REPO_TOKEN
|
|
# for any ENT-side cross-repo operations.
|
|
|
|
on:
|
|
issue_comment:
|
|
types: [created]
|
|
workflow_dispatch:
|
|
inputs:
|
|
pr_number:
|
|
description: "OSS PR number to run Query Agent on"
|
|
required: true
|
|
dry_run:
|
|
description: "Triage only — skip tests and generation"
|
|
type: boolean
|
|
default: true
|
|
generation_mode:
|
|
description: "Phase B: generate new SQL queries for this PR"
|
|
type: choice
|
|
required: false
|
|
default: "none"
|
|
options:
|
|
- none
|
|
- full
|
|
|
|
permissions:
|
|
contents: read
|
|
pull-requests: write
|
|
issues: write
|
|
|
|
concurrency:
|
|
group: query-agent-openobserve-${{ github.event.issue.number || github.event.inputs.pr_number || github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
# Validate workflow_dispatch inputs before forwarding to the engine.
|
|
# Skipped for issue_comment events (no inputs to validate).
|
|
validate_inputs:
|
|
if: github.event_name == 'workflow_dispatch'
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Validate pr_number is a positive integer
|
|
env:
|
|
PR_NUMBER: ${{ inputs.pr_number }}
|
|
run: |
|
|
if ! echo "$PR_NUMBER" | grep -qE '^[0-9]+$'; then
|
|
echo "::error::pr_number must be a positive integer, got: $PR_NUMBER"
|
|
exit 1
|
|
fi
|
|
|
|
call-query-agent:
|
|
needs: [validate_inputs]
|
|
# Manual dispatch: always run (restricted to repo write access by GitHub).
|
|
# Comment: only if the commenter is on the allowlist AND the command matches.
|
|
if: >
|
|
github.event_name == 'workflow_dispatch' ||
|
|
(github.event.issue.pull_request &&
|
|
contains(fromJSON('["/query-agent","/qa-generate"]'), github.event.comment.body) &&
|
|
contains(fromJSON('["bjp232004","hengfeiyang","prabhatsharma","uddhavdave","oasisk","haohuaijin","Subhra264","Loaki07","007harshmahajan","chaitanya-sistla","ktx-kirtan","omkarK06","ktx-vaidehi","ktx-abhay","neha00290","ktx-akshay","ktx-sadhna","nikhilsaikethe","YashodhanJoshi1","ktx-riya","mmosarafO2","Shrinath-O2","ktx-mihir","vamsikarthikr","pr1sm8"]'), github.actor))
|
|
uses: openobserve/o2-enterprise/.github/workflows/query-agent.yml@cb74bab8b9da410f525f7931a9396ec8cd885665
|
|
with:
|
|
source_repo: openobserve
|
|
# dispatch supplies pr_number directly; comment path uses the commented PR number.
|
|
pr_number: ${{ inputs.pr_number || github.event.issue.number }}
|
|
# generation_mode: dispatch uses the typed choice; comment path: /qa-generate → full.
|
|
generation_mode: ${{ github.event_name == 'workflow_dispatch' && (inputs.generation_mode || 'none') || (github.event.comment.body == '/qa-generate' && 'full' || 'none') }}
|
|
# dry_run: dispatch honors the typed boolean; comment path always runs (not dry).
|
|
dry_run: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run || false }}
|
|
actor: ${{ github.actor }}
|
|
secrets:
|
|
DEEPSEEK_API_KEY_E2E: ${{ secrets.DEEPSEEK_API_KEY_E2E }}
|
|
ORG_ADMIN_TOKEN: ${{ secrets.ORG_ADMIN_TOKEN }}
|
|
CROSS_REPO_TOKEN: ${{ secrets.E2E_DEV_CI_TOKEN }}
|