Skip to content

Commit d893a5f

Browse files
devantlerCopilot
devantler
and
Copilot
authored
ci: migrate Docker system tests from merge queue to pull_request (#4435)
* ci: migrate Docker system tests from merge queue to pull_request Move warm-helm-cache, warm-mirror-cache, and system-test-docker jobs to run on pull_request instead of merge_group. This provides earlier feedback during the PR lifecycle and makes it easier for agents to hook into the CI feedback loop. - Update all three job conditions: merge_group → pull_request - Add system-test changes filter to build-artifact condition - Comment out merge_group trigger and cancel-stale-merge-queue job (preserved for easy re-enablement) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * ci: add fork guard and remove environment: ci deployment noise Address review feedback: - Add same-repo guard to warm-helm-cache, warm-mirror-cache, and system-test-docker to skip on fork PRs where secrets are unavailable - Remove environment: ci from system-test-docker to eliminate deployment notification spam (~31 entries per PR). The only secret it scoped (DOCKERHUB_TOKEN) is optional and already has a zizmor inline ignore annotation. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent 09efd29 commit d893a5f

1 file changed

Lines changed: 80 additions & 72 deletions

File tree

‎.github/workflows/ci.yaml‎

Lines changed: 80 additions & 72 deletions
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,11 @@ on:
44
push:
55
branches: [main]
66
pull_request:
7-
merge_group:
7+
# merge_group: # commented out — system tests moved to pull_request (re-enable if needed)
88
workflow_dispatch:
99
inputs:
1010
run_system_tests:
11-
description: "Run system tests (normally only runs in merge queue)"
11+
description: "Run system tests"
1212
required: false
1313
type: boolean
1414
default: true
@@ -31,71 +31,68 @@ concurrency:
3131
permissions: {}
3232

3333
jobs:
34-
# Cancel stale merge queue runs for the same PR.
35-
# Merge queue refs include a unique SHA suffix (gh-readonly-queue/<base>/pr-<id>-<sha>),
36-
# so the workflow-level concurrency group can't deduplicate them. This job strips the
37-
# SHA to find older runs for the same queue entry and cancels them.
38-
cancel-stale-merge-queue:
39-
name: 🧹 Cancel Stale Merge Queue Runs
40-
if: github.event_name == 'merge_group'
41-
runs-on: ubuntu-latest
42-
timeout-minutes: 2
43-
permissions:
44-
actions: write
45-
steps:
46-
- name: Cancel previous runs for same merge queue entry
47-
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
48-
with:
49-
script: |
50-
const ref = context.ref;
51-
const match = ref.match(/^(refs\/heads\/gh-readonly-queue\/.+)-[0-9a-f]+$/);
52-
if (!match) {
53-
console.log('Not a merge queue ref, skipping');
54-
return;
55-
}
56-
const stablePrefix = match[1];
57-
58-
for (const status of ['in_progress', 'queued']) {
59-
let page = 1;
60-
while (true) {
61-
const { data: { workflow_runs: runs } } = await github.rest.actions.listWorkflowRuns({
62-
owner: context.repo.owner,
63-
repo: context.repo.repo,
64-
workflow_id: 'ci.yaml',
65-
event: 'merge_group',
66-
status,
67-
per_page: 100,
68-
page,
69-
});
70-
71-
if (runs.length === 0) break;
72-
73-
for (const run of runs) {
74-
if (run.run_number >= context.runNumber) continue;
75-
const runRef = `refs/heads/${run.head_branch}`;
76-
const runMatch = runRef.match(/^(refs\/heads\/gh-readonly-queue\/.+)-[0-9a-f]+$/);
77-
if (runMatch && runMatch[1] === stablePrefix) {
78-
console.log(`Cancelling stale run ${run.id} (${runRef})`);
79-
try {
80-
await github.rest.actions.cancelWorkflowRun({
81-
owner: context.repo.owner,
82-
repo: context.repo.repo,
83-
run_id: run.id,
84-
});
85-
} catch (error) {
86-
if (error && (error.status === 409 || error.status === 422)) {
87-
console.log(`Skipping run ${run.id}; it is no longer cancellable (${error.status})`);
88-
continue;
89-
}
90-
throw error;
91-
}
92-
}
93-
}
94-
95-
if (runs.length < 100) break;
96-
page += 1;
97-
}
98-
}
34+
# cancel-stale-merge-queue — commented out: system tests moved to pull_request (re-enable if needed)
35+
# cancel-stale-merge-queue:
36+
# name: 🧹 Cancel Stale Merge Queue Runs
37+
# if: github.event_name == 'merge_group'
38+
# runs-on: ubuntu-latest
39+
# timeout-minutes: 2
40+
# permissions:
41+
# actions: write
42+
# steps:
43+
# - name: Cancel previous runs for same merge queue entry
44+
# uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
45+
# with:
46+
# script: |
47+
# const ref = context.ref;
48+
# const match = ref.match(/^(refs\/heads\/gh-readonly-queue\/.+)-[0-9a-f]+$/);
49+
# if (!match) {
50+
# console.log('Not a merge queue ref, skipping');
51+
# return;
52+
# }
53+
# const stablePrefix = match[1];
54+
#
55+
# for (const status of ['in_progress', 'queued']) {
56+
# let page = 1;
57+
# while (true) {
58+
# const { data: { workflow_runs: runs } } = await github.rest.actions.listWorkflowRuns({
59+
# owner: context.repo.owner,
60+
# repo: context.repo.repo,
61+
# workflow_id: 'ci.yaml',
62+
# event: 'merge_group',
63+
# status,
64+
# per_page: 100,
65+
# page,
66+
# });
67+
#
68+
# if (runs.length === 0) break;
69+
#
70+
# for (const run of runs) {
71+
# if (run.run_number >= context.runNumber) continue;
72+
# const runRef = `refs/heads/${run.head_branch}`;
73+
# const runMatch = runRef.match(/^(refs\/heads\/gh-readonly-queue\/.+)-[0-9a-f]+$/);
74+
# if (runMatch && runMatch[1] === stablePrefix) {
75+
# console.log(`Cancelling stale run ${run.id} (${runRef})`);
76+
# try {
77+
# await github.rest.actions.cancelWorkflowRun({
78+
# owner: context.repo.owner,
79+
# repo: context.repo.repo,
80+
# run_id: run.id,
81+
# });
82+
# } catch (error) {
83+
# if (error && (error.status === 409 || error.status === 422)) {
84+
# console.log(`Skipping run ${run.id}; it is no longer cancellable (${error.status})`);
85+
# continue;
86+
# }
87+
# throw error;
88+
# }
89+
# }
90+
# }
91+
#
92+
# if (runs.length < 100) break;
93+
# page += 1;
94+
# }
95+
# }
9996

10097
# Wait for sufficient GitHub API rate limit before proceeding
10198
rate-limit-gate:
@@ -212,7 +209,7 @@ jobs:
212209
runs-on: ubuntu-latest
213210
timeout-minutes: 20
214211
needs: [changes]
215-
if: github.event_name == 'workflow_dispatch' || ((github.event_name == 'pull_request' || github.event_name == 'merge_group') && (needs.changes.outputs.code == 'true' || needs.changes.outputs.cli == 'true'))
212+
if: github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && (needs.changes.outputs.code == 'true' || needs.changes.outputs.cli == 'true' || needs.changes.outputs.system-test == 'true'))
216213
permissions:
217214
contents: read
218215
steps:
@@ -602,7 +599,11 @@ jobs:
602599
runs-on: ubuntu-latest
603600
timeout-minutes: 20
604601
needs: [changes, build-artifact]
605-
if: (github.event_name == 'merge_group' && needs.changes.outputs.system-test == 'true') || (github.event_name == 'workflow_dispatch' && inputs.run_system_tests == true)
602+
if: >-
603+
(github.event_name == 'pull_request'
604+
&& needs.changes.outputs.system-test == 'true'
605+
&& github.event.pull_request.head.repo.full_name == github.repository)
606+
|| (github.event_name == 'workflow_dispatch' && inputs.run_system_tests == true)
606607
permissions:
607608
contents: read
608609
outputs:
@@ -636,7 +637,11 @@ jobs:
636637
runs-on: ubuntu-latest
637638
timeout-minutes: 30
638639
needs: [changes, build-artifact]
639-
if: (github.event_name == 'merge_group' && needs.changes.outputs.system-test == 'true') || (github.event_name == 'workflow_dispatch' && inputs.run_system_tests == true)
640+
if: >-
641+
(github.event_name == 'pull_request'
642+
&& needs.changes.outputs.system-test == 'true'
643+
&& github.event.pull_request.head.repo.full_name == github.repository)
644+
|| (github.event_name == 'workflow_dispatch' && inputs.run_system_tests == true)
640645
permissions:
641646
contents: read
642647
outputs:
@@ -672,8 +677,11 @@ jobs:
672677
runs-on: ubuntu-latest
673678
timeout-minutes: 45
674679
needs: [changes, build-artifact, warm-helm-cache, warm-mirror-cache]
675-
if: (github.event_name == 'merge_group' && needs.changes.outputs.system-test == 'true') || (github.event_name == 'workflow_dispatch' && inputs.run_system_tests == true)
676-
environment: ci
680+
if: >-
681+
(github.event_name == 'pull_request'
682+
&& needs.changes.outputs.system-test == 'true'
683+
&& github.event.pull_request.head.repo.full_name == github.repository)
684+
|| (github.event_name == 'workflow_dispatch' && inputs.run_system_tests == true)
677685
permissions:
678686
contents: read
679687
packages: write

0 commit comments

Comments
 (0)