|
1 | 1 | name: CI (Namespace shadow) |
2 | 2 |
|
| 3 | +# Fire-and-forget dispatcher for the Namespace shadow benchmark (INFRA-3631). |
| 4 | +# |
| 5 | +# This workflow does NOT use `workflow_call`. Instead, it dispatches `ci.yml` |
| 6 | +# as a separate `workflow_dispatch` run with `runner_provider=namespace`. |
| 7 | +# |
| 8 | +# Why a dispatch instead of a call: |
| 9 | +# - `workflow_call` nests the called workflow's jobs into THIS workflow's |
| 10 | +# check suite on the PR. With the repo's merge queue ALLGREEN policy, |
| 11 | +# any shadow flake would block merges. |
| 12 | +# - `workflow_dispatch` runs live in the Actions tab only -- invisible to |
| 13 | +# PR checks. The shadow can fail freely; it never blocks the queue, |
| 14 | +# never duplicates commit statuses, never posts PR comments. |
| 15 | +# |
| 16 | +# Correlation back to the originating PR: |
| 17 | +# - The dispatched run's display name is set via `run-name` in ci.yml to |
| 18 | +# `ci [shadow PR #<num> @ <sha>]`, so it's identifiable in the Actions |
| 19 | +# tab at a glance. |
| 20 | +# - The dispatcher job posts a GitHub Actions step summary linking the PR |
| 21 | +# to the dispatched shadow run URL, reachable from the PR Checks tab. |
| 22 | +# |
| 23 | +# Authentication: Token Exchange Service (same pattern as triage-forwarder.yml |
| 24 | +# and shared-services-workflows deploy.yml — OIDC → POST /api/exchange/token). |
| 25 | +# |
| 26 | +# Prerequisites: |
| 27 | +# - Repo/org Actions variable: TOKEN_EXCHANGE_URL (already used elsewhere in |
| 28 | +# metamask-mobile, e.g. triage-forwarder). |
| 29 | +# - Rego policy in token-exchange-service: explicit policy |
| 30 | +# mm-metamask-mobile-namespace-shadow-ci-token-exchange (matches OIDC |
| 31 | +# `workflow_ref` claim for .github/workflows/ci-namespace-shadow.yml). |
| 32 | +# |
| 33 | +# Fork PRs: the job `if` below skips the entire job for fork head repos, so OIDC |
| 34 | +# exchange never runs for untrusted forks (same model as not exposing secrets). |
| 35 | + |
3 | 36 | on: |
4 | 37 | pull_request: |
5 | 38 | types: [opened, synchronize, reopened, ready_for_review] |
6 | 39 | paths-ignore: |
7 | | - - 'docs/**' |
8 | | - - '**/*.md' |
9 | | - - '.github/CODEOWNERS' |
| 40 | + - "docs/**" |
| 41 | + - "**/*.md" |
| 42 | + - ".github/CODEOWNERS" |
10 | 43 | push: |
11 | 44 | branches: [main] |
12 | 45 | schedule: |
13 | | - - cron: '0 * * * *' |
| 46 | + - cron: "0 * * * *" |
14 | 47 | workflow_dispatch: |
15 | 48 |
|
16 | 49 | concurrency: |
17 | 50 | group: ns-shadow-${{ github.workflow }}-${{ github.ref }} |
18 | 51 | cancel-in-progress: true |
19 | 52 |
|
| 53 | +permissions: |
| 54 | + contents: read |
| 55 | + id-token: write |
| 56 | + |
20 | 57 | jobs: |
21 | | - shadow-ci: |
22 | | - name: '[shadow] CI' |
23 | | - uses: ./.github/workflows/ci.yml |
24 | | - with: |
25 | | - runner_provider: namespace |
26 | | - secrets: inherit |
| 58 | + dispatch-shadow: |
| 59 | + name: "[shadow] Dispatch" |
| 60 | + runs-on: ubuntu-latest |
| 61 | + # Fork PRs use head.repo != github.repository — skip (no shadow, no token exchange). |
| 62 | + if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }} |
| 63 | + steps: |
| 64 | + - name: Get OIDC token for token-exchange-service |
| 65 | + id: oidc |
| 66 | + run: | |
| 67 | + set -euo pipefail |
| 68 | + OIDC_TOKEN=$(curl -sSf -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \ |
| 69 | + "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=api://token-exchange-service" | jq -r '.value') |
| 70 | + echo "::add-mask::$OIDC_TOKEN" |
| 71 | + echo "oidc_token=$OIDC_TOKEN" >> "$GITHUB_OUTPUT" |
| 72 | +
|
| 73 | + - name: Exchange for installation token (scoped permissions) |
| 74 | + id: exchange |
| 75 | + env: |
| 76 | + OIDC_TOKEN: ${{ steps.oidc.outputs.oidc_token }} |
| 77 | + TOKEN_EXCHANGE_URL: ${{ vars.TOKEN_EXCHANGE_URL }} |
| 78 | + run: | |
| 79 | + set -euo pipefail |
| 80 | + if [ -z "${TOKEN_EXCHANGE_URL}" ]; then |
| 81 | + echo "::error::TOKEN_EXCHANGE_URL Actions variable is not set. Configure it at org or repo level (see triage-forwarder.yml)." |
| 82 | + exit 1 |
| 83 | + fi |
| 84 | + RESPONSE=$(curl -sSf -X POST "${TOKEN_EXCHANGE_URL}/api/exchange/token" \ |
| 85 | + -H "Content-Type: application/json" \ |
| 86 | + -d "$(jq -cn \ |
| 87 | + --arg oidcToken "$OIDC_TOKEN" \ |
| 88 | + --arg targetRepo "${{ github.repository }}" \ |
| 89 | + '{oidcToken: $oidcToken, targetRepo: $targetRepo, requested_permissions: {metadata: "read", contents: "read", actions: "write"}}')") |
| 90 | + STATUS=$(echo "$RESPONSE" | jq -r '.status // "ok"') |
| 91 | + if [[ "$STATUS" == "fail" ]]; then |
| 92 | + MSG=$(echo "$RESPONSE" | jq -r '.message // "unknown"') |
| 93 | + echo "::error::Token exchange failed: ${MSG}" |
| 94 | + echo "::notice::Ensure token-exchange-service policy mm-metamask-mobile-namespace-shadow-ci-token-exchange is deployed (INFRA-3631)." |
| 95 | + exit 1 |
| 96 | + fi |
| 97 | + TOKEN=$(echo "$RESPONSE" | jq -r '.token // empty') |
| 98 | + if [[ -z "$TOKEN" || "$TOKEN" == "null" ]]; then |
| 99 | + echo "::error::Token exchange returned no token" |
| 100 | + exit 1 |
| 101 | + fi |
| 102 | + echo "::add-mask::$TOKEN" |
| 103 | + echo "token=$TOKEN" >> "$GITHUB_OUTPUT" |
| 104 | +
|
| 105 | + - name: Dispatch ci.yml on Namespace |
| 106 | + id: dispatch |
| 107 | + env: |
| 108 | + GH_TOKEN: ${{ steps.exchange.outputs.token }} |
| 109 | + REPO: ${{ github.repository }} |
| 110 | + REF: ${{ github.head_ref || github.ref_name }} |
| 111 | + PR_NUMBER: ${{ github.event.pull_request.number || '' }} |
| 112 | + HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }} |
| 113 | + run: | |
| 114 | + set -euo pipefail |
| 115 | + echo "Dispatching ci.yml on ref='${REF}' (PR='${PR_NUMBER:-none}', sha='${HEAD_SHA}')" |
| 116 | + gh workflow run ci.yml \ |
| 117 | + --repo "$REPO" \ |
| 118 | + --ref "$REF" \ |
| 119 | + -f runner_provider=namespace \ |
| 120 | + -f pr_number="$PR_NUMBER" \ |
| 121 | + -f head_sha="$HEAD_SHA" |
| 122 | +
|
| 123 | + # gh workflow run returns immediately with no run ID. Find the run |
| 124 | + # we just created so we can link to it from the step summary. |
| 125 | + # Best-effort: poll briefly for a queued/in_progress dispatch on this ref. |
| 126 | + RUN_URL="" |
| 127 | + for _ in $(seq 1 10); do |
| 128 | + RUN_URL=$(gh run list \ |
| 129 | + --repo "$REPO" \ |
| 130 | + --workflow ci.yml \ |
| 131 | + --event workflow_dispatch \ |
| 132 | + --branch "$REF" \ |
| 133 | + --limit 1 \ |
| 134 | + --json url,createdAt \ |
| 135 | + --jq '.[0].url' 2>/dev/null || true) |
| 136 | + if [ -n "$RUN_URL" ] && [ "$RUN_URL" != "null" ]; then |
| 137 | + break |
| 138 | + fi |
| 139 | + sleep 2 |
| 140 | + done |
| 141 | + echo "run_url=${RUN_URL}" >> "$GITHUB_OUTPUT" |
| 142 | +
|
| 143 | + - name: Step summary |
| 144 | + env: |
| 145 | + PR_NUMBER: ${{ github.event.pull_request.number || '' }} |
| 146 | + PR_URL: ${{ github.event.pull_request.html_url || '' }} |
| 147 | + HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }} |
| 148 | + REF: ${{ github.head_ref || github.ref_name }} |
| 149 | + RUN_URL: ${{ steps.dispatch.outputs.run_url }} |
| 150 | + run: | |
| 151 | + { |
| 152 | + echo "## Namespace shadow CI dispatched" |
| 153 | + echo |
| 154 | + echo "| Field | Value |" |
| 155 | + echo "|---|---|" |
| 156 | + if [ -n "$PR_NUMBER" ]; then |
| 157 | + echo "| PR | [#${PR_NUMBER}](${PR_URL}) |" |
| 158 | + fi |
| 159 | + echo "| Ref | \`${REF}\` |" |
| 160 | + echo "| Head SHA | \`${HEAD_SHA}\` |" |
| 161 | + if [ -n "${RUN_URL}" ]; then |
| 162 | + echo "| Shadow run | ${RUN_URL} |" |
| 163 | + else |
| 164 | + echo "| Shadow run | (not yet visible — check the Actions tab) |" |
| 165 | + fi |
| 166 | + echo |
| 167 | + echo "_Shadow CI runs **fire-and-forget**: it does not appear in this PR's checks and never blocks the merge queue. Benchmark data is collected by \`scripts/namespace-benchmark.sh\`._" |
| 168 | + } >> "$GITHUB_STEP_SUMMARY" |
0 commit comments