[13.4-stable] Separate Eden CI into untrusted Gate and trusted Runner workflows#5052
Merged
eriknordmark merged 1 commit intolf-edge:13.4-stablefrom Jul 7, 2025
Conversation
…flows.
Separate Eden test execution into two cooperating GitHub workflows: an
untrusted "PR Gate," triggered by PR approvals and build completions,
and a trusted "Eden Runner," triggered by the successful completion of
the gate. This change enables secure access to Docker Hub secrets and
streamlines test execution when PRs from forks are approved before the
build is ready.
Previously, Eden tests ran within a single workflow triggered by
`pull_request_review` events, which, when originating from forks, lacked
access to repository secrets. As a result, the workflow couldn't log in
to Docker Hub, causing test failures. The updated setup addresses this
by splitting the logic:
1. The "PR Gate" workflow (untrusted) triggers on two events:
- Submission of a PR review (specifically approval).
- Completion of the PR build workflow.
It always checks two conditions:
- The PR is approved.
- The necessary build artifact ("eve (amd64, kvm, generic)") exists and
succeeded.
Once both conditions are met, the PR Gate workflow creates a
`run-context.json` file containing relevant information (PR number, SHA,
original run ID, architecture details, etc.) and uploads it as an
artifact named "run-context". If conditions aren't met, it uploads a
sentinel string ("exit") to indicate tests shouldn't proceed.
2. The "Eden Runner" workflow (trusted) triggers upon the successful
completion of the "PR Gate" workflow using the `workflow_run` event,
thus gaining access to repository secrets. It downloads the
"run-context" artifact and verifies its content. If valid (i.e., doesn't
contain "exit"), it triggers the actual Eden test execution via the
reusable workflow lf-edge/eden/.github/workflows/test.yml.
Due to GitHub limitations, workflows triggered by `workflow_run` don't
automatically appear in the PR's check status list. To maintain
transparency, explicit manual status updates are performed at different
stages:
- Initially setting a "pending" status when tests start.
- Finalizing with "success," "failure," or "error" after completion.
Additionally, each Eden job result is surfaced individually to maintain
detailed test visibility within the PR.
Finally, this update eliminates a common bottleneck: Eden tests
previously required manual re-runs if PR approval occurred before the
build was ready. Now, the PR Gate automatically reevaluates whenever the
PR build finishes, enabling automated testing and quicker feedback
loops.
The obsolete monolithic workflow (eden.yml) has been removed to reflect
these structural improvements clearly.
Signed-off-by: Nikolay Martyanov <nikolay@zededa.com>
(cherry picked from commit 9c17dd5)
uncleDecart
approved these changes
Jul 7, 2025
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Backport of #5048
PR dependencies
None.
How to test and validate this PR
Don't need to be tested internally.
Changelog notes
No user-facing changes.
Checklist
check them.