From 56c0d461a23ff6e59932102c84683b35f3ac508c Mon Sep 17 00:00:00 2001 From: Jan Macku Date: Fri, 21 Aug 2026 13:41:41 +0200 Subject: [PATCH] ci: run all tests on pull_request_target event --- .github/workflows/base-test-pr-trigger.yml | 66 ---------------------- .github/workflows/base-test.yml | 62 ++++++++++++++++---- .github/workflows/secrets_test.yml | 37 +++++++++--- .github/workflows/timeout-test.yml | 37 +++++++++--- .github/workflows/variables_test.yml | 37 +++++++++--- 5 files changed, 138 insertions(+), 101 deletions(-) delete mode 100644 .github/workflows/base-test-pr-trigger.yml diff --git a/.github/workflows/base-test-pr-trigger.yml b/.github/workflows/base-test-pr-trigger.yml deleted file mode 100644 index 5995eb5..0000000 --- a/.github/workflows/base-test-pr-trigger.yml +++ /dev/null @@ -1,66 +0,0 @@ -# Inspired by https://github.com/osbuild/bootc-image-builder/blob/031df2b115743a87b6684d4894f3d1730afefc98/.github/workflows/testingfarm.yml -name: Testing farm PR triggered tests - -on: - pull_request_target: - types: [opened, synchronize, reopened] - -# To use testing farm we need the TF_API_KEY secret available inside the -# forked repo which requires the pull_request_target trigger. To protect -# the secrets we need to make sure only people with repo write access -# can trigger this workflow. This means that ouside contributors will -# get an initial failure when the workflow is run. But once someone from -# the team re-triggers it it will work. -# -# Note that "pull_requqest_target" events are always triggered even -# when the "Fork pull request workflows from outside collaborators" -# setting is restricted to "Require approval for all outside collaborators" -# (see https://docs.github.com/en/actions/managing-workflow-runs/approving-workflow-runs-from-public-forks) -# -# Note also that this precautions might be overkill because a fork -# cannot modify this workflow and all we do is run a branch inside -# testing farm. But a) the scope of workflow may expand over time -# b) it feels safer this way and is not a big burden in practise. -# -# This follows https://michaelheap.com/access-secrets-from-forks/ -jobs: - testingfarm: - name: "Smoke test for tfaga - pull_request_target" - runs-on: ubuntu-latest - - permissions: - contents: read - pull-requests: write - statuses: write - - steps: - - name: Get User Permission - id: checkAccess - uses: actions-cool/check-user-permission@v2 - with: - require: write - username: ${{ github.triggering_actor }} - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - - name: Check User Permission - if: steps.checkAccess.outputs.require-result == 'false' - run: | - echo "${{ github.triggering_actor }} does not have permissions on this repo." - echo "Current permission level is ${{ steps.checkAccess.outputs.user-permission }}" - echo "Job originally triggered by ${{ github.actor }}" - exit 1 - - - name: Check out code - uses: actions/checkout@v6 - with: - ref: ${{ github.event.pull_request.head.sha }} - - - name: Run the tests - uses: ./ - with: - api_key: ${{ secrets.TF_PUBLIC_API_KEY }} - tmt_plan_regex: "smoke_plan" - pull_request_status_name: "Smoke test - pull_request_target" - update_pull_request_status: "true" - create_issue_comment: "true" diff --git a/.github/workflows/base-test.yml b/.github/workflows/base-test.yml index 81bc318..45c1741 100644 --- a/.github/workflows/base-test.yml +++ b/.github/workflows/base-test.yml @@ -1,22 +1,62 @@ +# Inspired by https://github.com/osbuild/bootc-image-builder/blob/031df2b115743a87b6684d4894f3d1730afefc98/.github/workflows/testingfarm.yml on: - issue_comment: - types: - - created + pull_request_target: + types: [opened, synchronize, reopened] + +# To use testing farm we need the TF_API_KEY secret available inside the +# forked repo which requires the pull_request_target trigger. To protect +# the secrets we need to make sure only people with repo write access +# can trigger this workflow. This means that outside contributors will +# get an initial failure when the workflow is run. But once someone from +# the team re-triggers it it will work. +# +# Note that "pull_request_target" events are always triggered even +# when the "Fork pull request workflows from outside collaborators" +# setting is restricted to "Require approval for all outside collaborators" +# (see https://docs.github.com/en/actions/managing-workflow-runs/approving-workflow-runs-from-public-forks) +# +# Note also that these precautions might be overkill because a fork +# cannot modify this workflow and all we do is run a branch inside +# testing farm. But a) the scope of workflow may expand over time +# b) it feels safer this way and is not a big burden in practice. +# +# This follows https://michaelheap.com/access-secrets-from-forks/ jobs: - container-tests: - runs-on: ubuntu-latest + testingfarm: name: "Smoke test for testing farm as a github action" + runs-on: ubuntu-latest - if: | - github.event.issue.pull_request - && contains(github.event.comment.body, '[test]') - && contains(fromJson('["OWNER", "MEMBER"]'), github.event.comment.author_association) + permissions: + contents: read + pull-requests: write + statuses: write steps: - - name: Checkout repo + - name: Get User Permission + id: checkAccess + uses: actions-cool/check-user-permission@v2 + with: + require: write + username: ${{ github.triggering_actor }} + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + - name: Check User Permission + if: steps.checkAccess.outputs.require-result == 'false' + run: | + echo "${{ github.triggering_actor }} does not have permissions on this repo." + echo "Current permission level is ${{ steps.checkAccess.outputs.user-permission }}" + echo "Job originally triggered by ${{ github.actor }}" + exit 1 + + # This repo is the action under test, so we must check out the PR + # code to validate changes. The permission check above ensures only + # users with write access can reach this step. + - name: Check out code uses: actions/checkout@v6 with: - ref: "refs/pull/${{ github.event.issue.number }}/head" + ref: ${{ github.event.pull_request.head.sha }} + allow-unsafe-pr-checkout: true - name: Run the tests uses: ./ diff --git a/.github/workflows/secrets_test.yml b/.github/workflows/secrets_test.yml index b8d64c7..2e98bd5 100644 --- a/.github/workflows/secrets_test.yml +++ b/.github/workflows/secrets_test.yml @@ -1,22 +1,43 @@ on: - issue_comment: - types: - - created + pull_request_target: + types: [opened, synchronize, reopened] + jobs: container-tests: runs-on: ubuntu-latest name: "Secrets test for testing farm as a github action" - if: | - github.event.issue.pull_request - && contains(github.event.comment.body, '[test]') - && contains(fromJson('["OWNER", "MEMBER"]'), github.event.comment.author_association) + permissions: + contents: read + pull-requests: write + statuses: write steps: + - name: Get User Permission + id: checkAccess + uses: actions-cool/check-user-permission@v2 + with: + require: write + username: ${{ github.triggering_actor }} + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + - name: Check User Permission + if: steps.checkAccess.outputs.require-result == 'false' + run: | + echo "${{ github.triggering_actor }} does not have permissions on this repo." + echo "Current permission level is ${{ steps.checkAccess.outputs.user-permission }}" + echo "Job originally triggered by ${{ github.actor }}" + exit 1 + + # This repo is the action under test, so we must check out the PR + # code to validate changes. The permission check above ensures only + # users with write access can reach this step. - name: Checkout repo uses: actions/checkout@v6 with: - ref: "refs/pull/${{ github.event.issue.number }}/head" + ref: ${{ github.event.pull_request.head.sha }} + allow-unsafe-pr-checkout: true - name: Run the tests uses: ./ diff --git a/.github/workflows/timeout-test.yml b/.github/workflows/timeout-test.yml index 32c5427..70550af 100644 --- a/.github/workflows/timeout-test.yml +++ b/.github/workflows/timeout-test.yml @@ -1,22 +1,43 @@ on: - issue_comment: - types: - - created + pull_request_target: + types: [opened, synchronize, reopened] + jobs: container-tests: runs-on: ubuntu-latest name: "Timeout test for testing farm as a github action" - if: | - github.event.issue.pull_request - && contains(github.event.comment.body, '[test]') - && contains(fromJson('["OWNER", "MEMBER"]'), github.event.comment.author_association) + permissions: + contents: read + pull-requests: write + statuses: write steps: + - name: Get User Permission + id: checkAccess + uses: actions-cool/check-user-permission@v2 + with: + require: write + username: ${{ github.triggering_actor }} + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + - name: Check User Permission + if: steps.checkAccess.outputs.require-result == 'false' + run: | + echo "${{ github.triggering_actor }} does not have permissions on this repo." + echo "Current permission level is ${{ steps.checkAccess.outputs.user-permission }}" + echo "Job originally triggered by ${{ github.actor }}" + exit 1 + + # This repo is the action under test, so we must check out the PR + # code to validate changes. The permission check above ensures only + # users with write access can reach this step. - name: Checkout repo uses: actions/checkout@v6 with: - ref: "refs/pull/${{ github.event.issue.number }}/head" + ref: ${{ github.event.pull_request.head.sha }} + allow-unsafe-pr-checkout: true - name: Run the tests uses: ./ diff --git a/.github/workflows/variables_test.yml b/.github/workflows/variables_test.yml index afb4a6a..3c8c96c 100644 --- a/.github/workflows/variables_test.yml +++ b/.github/workflows/variables_test.yml @@ -1,22 +1,43 @@ on: - issue_comment: - types: - - created + pull_request_target: + types: [opened, synchronize, reopened] + jobs: container-tests: runs-on: ubuntu-latest name: "Variables test for testing farm as a github action" - if: | - github.event.issue.pull_request - && contains(github.event.comment.body, '[test]') - && contains(fromJson('["OWNER", "MEMBER"]'), github.event.comment.author_association) + permissions: + contents: read + pull-requests: write + statuses: write steps: + - name: Get User Permission + id: checkAccess + uses: actions-cool/check-user-permission@v2 + with: + require: write + username: ${{ github.triggering_actor }} + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + - name: Check User Permission + if: steps.checkAccess.outputs.require-result == 'false' + run: | + echo "${{ github.triggering_actor }} does not have permissions on this repo." + echo "Current permission level is ${{ steps.checkAccess.outputs.user-permission }}" + echo "Job originally triggered by ${{ github.actor }}" + exit 1 + + # This repo is the action under test, so we must check out the PR + # code to validate changes. The permission check above ensures only + # users with write access can reach this step. - name: Checkout repo uses: actions/checkout@v6 with: - ref: "refs/pull/${{ github.event.issue.number }}/head" + ref: ${{ github.event.pull_request.head.sha }} + allow-unsafe-pr-checkout: true - name: Run the tests uses: ./