🐛 fix: checkout PR head SHA for issue_comment triggered workflows by clubanderson · Pull Request #832 · llm-d/llm-d-workload-variant-autoscaler

clubanderson · 2026-03-03T17:20:31Z

Problem

Fixes #831

When /trigger-e2e-full is used on a PR, the workflow triggers via issue_comment event. For this event type, github.sha points to main (the default branch), not the PR head. This caused the e2e-tests job to build and test code from main instead of the PR changes.

Root Cause

The check-code-changes job already correctly resolves the PR head SHA and checks it out, but e2e-tests did a bare actions/checkout@v4 with no ref:, defaulting to github.sha (main for issue_comment events).

Fix

check-code-changes: Export pr_head_sha as a job output (already computed but not exposed)
e2e-tests: Use needs.check-code-changes.outputs.pr_head_sha in checkout ref, with a validation step that fails fast if the SHA is empty (prevents silent fallback to main)
lint-and-test: Skip entirely for issue_comment events — it already runs on pull_request triggers, so re-running on comments is unnecessary and would allow untrusted commenters to execute PR code
e2e-tests gate: Tightened so issue_comment events only run when check-full-tests validates an approved trigger from a trusted collaborator AND check-code-changes succeeds
workflow_dispatch: Preserved smoke-test path — runs when run_full_tests=true OR when code changes are detected (matching existing behavior)

When /trigger-e2e-full is used on a PR, the workflow is triggered via issue_comment event. For this event type, github.sha points to the default branch (main), not the PR head. This caused e2e-tests and lint-and-test jobs to build/test main instead of the PR changes. Fix: - Export pr_head_sha from check-code-changes job (already computed) - e2e-tests: use pr_head_sha output in checkout (already depends on check-code-changes) - lint-and-test: add PR info step to resolve head SHA for issue_comment events - When ref is empty string, actions/checkout falls back to default behavior (correct for pull_request events) Signed-off-by: Andrew Anderson <andy@clubanderson.com>

clubanderson · 2026-03-03T17:20:38Z

/trigger-e2e-full

github-actions · 2026-03-03T17:20:51Z

🚀 Full E2E tests triggered by /trigger-e2e-full

View the Kind E2E workflow run

github-actions · 2026-03-03T17:23:28Z

GPU Pre-flight Check ✅

GPUs are available for e2e-openshift tests. Proceeding with deployment.

Resource	Total	Allocated	Available
GPUs	50	12	38

Cluster	Value
Nodes	16 (7 with GPUs)
Total CPU	993 cores
Total Memory	10383 Gi
GPUs required	4 (min) / 6 (recommended)

Copilot

Pull request overview

Fixes CI correctness for issue_comment-triggered runs by ensuring jobs checkout the PR head commit (instead of main, which github.sha points to for issue_comment events).

Changes:

Export pr_head_sha from check-code-changes as a job output.
Update e2e-tests to checkout needs.check-code-changes.outputs.pr_head_sha.
Update lint-and-test to resolve the PR head SHA on issue_comment events and checkout that ref.

Copilot · 2026-03-03T17:23:38Z

      - name: Checkout source
        uses: actions/checkout@v4
+        with:
+          ref: ${{ needs.check-code-changes.outputs.pr_head_sha || '' }}


e2e-tests now checks out needs.check-code-changes.outputs.pr_head_sha (PR code) even on issue_comment runs, but the job-level if: condition still allows the job to run when has_code_changes == 'true' (which can be true for ordinary comments). This enables untrusted commenters to trigger execution of PR code (and expensive Kind E2E runs). Tighten the e2e-tests if: logic so that issue_comment runs only proceed when check-full-tests has validated an approved trigger comment from a trusted collaborator.

Signed-off-by: Andrew Anderson <andy@clubanderson.com>

github-actions · 2026-03-03T17:28:31Z

GPU Pre-flight Check ✅

GPUs are available for e2e-openshift tests. Proceeding with deployment.

Resource	Total	Allocated	Available
GPUs	50	12	38

Cluster	Value
Nodes	16 (7 with GPUs)
Total CPU	993 cores
Total Memory	10383 Gi
GPUs required	4 (min) / 6 (recommended)

- Skip lint-and-test for issue_comment events (already runs on pull_request) - Remove duplicated PR head SHA resolution from lint-and-test - Tighten e2e-tests gate: issue_comment only runs when check-full-tests validates an approved trigger from a trusted collaborator - Explicitly handle workflow_dispatch and pull_request event types Signed-off-by: Andrew Anderson <andy@clubanderson.com>

github-actions · 2026-03-03T17:56:07Z

GPU Pre-flight Check ✅

GPUs are available for e2e-openshift tests. Proceeding with deployment.

Resource	Total	Allocated	Available
GPUs	50	12	38

Cluster	Value
Nodes	16 (7 with GPUs)
Total CPU	993 cores
Total Memory	10383 Gi
GPUs required	4 (min) / 6 (recommended)

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 3 comments.

Copilot · 2026-03-03T17:56:06Z

+    if: >-
+      always() && (
+        (github.event_name == 'issue_comment' && needs.check-full-tests.outputs.run_full == 'true') ||
+        (github.event_name == 'workflow_dispatch' && needs.check-full-tests.outputs.run_full == 'true') ||


The updated if: condition removes the previous fallback that allowed smoke tests to run on workflow_dispatch when run_full_tests is false. With this change, a manual dispatch with default inputs will run no e2e tests, which contradicts the workflow_dispatch input description (“default: smoke tests only”) and the comment above e2e-tests (“smoke tests run automatically”). Consider restoring the smoke-test path for workflow_dispatch (e.g., reuse the has_code_changes/default-true behavior) or update the input/inline documentation to match the new behavior.

Suggested change

(github.event_name == 'workflow_dispatch' && needs.check-full-tests.outputs.run_full == 'true') ||

(github.event_name == 'workflow_dispatch' && (

needs.check-full-tests.outputs.run_full == 'true' ||

(needs.check-code-changes.result == 'success' && needs.check-code-changes.outputs.has_code_changes == 'true')

)) ||

Copilot · 2026-03-03T17:56:06Z

+    if: >-
+      always() && (
+        (github.event_name == 'issue_comment' && needs.check-full-tests.outputs.run_full == 'true') ||
+        (github.event_name == 'workflow_dispatch' && needs.check-full-tests.outputs.run_full == 'true') ||
+        (github.event_name == 'pull_request' && needs.check-code-changes.result == 'success' && needs.check-code-changes.outputs.has_code_changes == 'true')
+      )
    timeout-minutes: 60
    permissions:
      contents: read
    steps:
      - name: Checkout source
        uses: actions/checkout@v4
+        with:
+          ref: ${{ needs.check-code-changes.outputs.pr_head_sha || '' }}


For issue_comment triggers, e2e-tests can still run even if check-code-changes fails (because of always() and no needs.check-code-changes.result == 'success' guard). In that failure mode needs.check-code-changes.outputs.pr_head_sha will be empty, so the checkout falls back to the event default SHA (which is main for issue_comment) and reintroduces the original problem. Tighten the if: for the issue_comment branch to require check-code-changes success (and/or a non-empty pr_head_sha), or explicitly fail early when pr_head_sha is empty.

Copilot · 2026-03-03T17:56:06Z

+  # lint-and-test already runs on pull_request events; skip for issue_comment
+  # to avoid untrusted commenters triggering execution of PR code
  lint-and-test:
+    if: github.event_name != 'issue_comment'
    runs-on: ubuntu-latest


This change makes lint-and-test skip entirely for issue_comment events, but the PR description says the fix is to resolve PR info and check out the PR head SHA in lint-and-test. Please reconcile the implementation with the PR description (either implement the described checkout/ref behavior for trusted comment triggers, or update the PR description to reflect that lint is intentionally not run for issue_comment).

- Restore workflow_dispatch smoke-test path (run_full OR has_code_changes) - Require check-code-changes success for issue_comment e2e runs - Add explicit validation step to fail fast if pr_head_sha is empty Signed-off-by: Andrew Anderson <andy@clubanderson.com>

github-actions · 2026-03-03T18:25:02Z

GPU Pre-flight Check ✅

GPUs are available for e2e-openshift tests. Proceeding with deployment.

Resource	Total	Allocated	Available
GPUs	50	16	34

Cluster	Value
Nodes	16 (7 with GPUs)
Total CPU	993 cores
Total Memory	10383 Gi
GPUs required	4 (min) / 6 (recommended)

mamy-CS · 2026-03-03T19:22:23Z

@clubanderson can we also make the full tests required before pr merge? Thanks.

clubanderson · 2026-03-03T20:53:41Z

Is there an example of another test or action you would like to follow in wva?

mamy-CS · 2026-03-03T20:59:49Z

For example the CI openshift tests and the smoke tests are required right? Same
The smoke tests currently are labeled CI - PR Checks / e2e-tests (pull_request). We can label that SMOKE EMULATED and have another one for FULL Emulated?

clubanderson · 2026-03-04T01:29:33Z

@mamy-CS Making full e2e tests a required check is separate scope from this PR (which fixes the checkout ref bug for issue_comment triggers). Could you approve this one and open a new issue to track adding a required full e2e check? Happy to help with that next. Thanks!

mamy-CS

/lgtm

…lows (llm-d#832)" This reverts commit e69a146.

Copilot AI review requested due to automatic review settings March 3, 2026 17:20

Copilot started reviewing on behalf of clubanderson March 3, 2026 17:21 View session

Copilot AI reviewed Mar 3, 2026

View reviewed changes

github-actions bot mentioned this pull request Mar 3, 2026

[agentics] No-Op Runs #744

Closed

chore: re-trigger CI checks

71675b5

Signed-off-by: Andrew Anderson <andy@clubanderson.com>

Copilot AI review requested due to automatic review settings March 3, 2026 17:53

Copilot started reviewing on behalf of clubanderson March 3, 2026 17:53 View session

Copilot AI reviewed Mar 3, 2026

View reviewed changes

mamy-CS approved these changes Mar 4, 2026

View reviewed changes

mamy-CS merged commit e69a146 into main Mar 4, 2026
18 checks passed

mamy-CS deleted the fix/issue-comment-checkout-ref branch March 4, 2026 15:00

clubanderson mentioned this pull request Mar 4, 2026

🐛 fix: report e2e commit status to fork PR head SHA #840

Merged

zdtsw added a commit to zdtsw-forking/workload-variant-autoscaler that referenced this pull request Mar 10, 2026

Revert "🐛 fix: checkout PR head SHA for issue_comment triggered workf…

482a7a0

…lows (llm-d#832)" This reverts commit e69a146.

-        (github.event_name == 'workflow_dispatch' && needs.check-full-tests.outputs.run_full == 'true') ||
+        (github.event_name == 'workflow_dispatch' && (
+          needs.check-full-tests.outputs.run_full == 'true' ||
+          (needs.check-code-changes.result == 'success' && needs.check-code-changes.outputs.has_code_changes == 'true')
+        )) ||

Conversation

clubanderson commented Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Root Cause

Fix

Uh oh!

clubanderson commented Mar 3, 2026

Uh oh!

github-actions bot commented Mar 3, 2026

Uh oh!

github-actions bot commented Mar 3, 2026

GPU Pre-flight Check ✅

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Mar 3, 2026

GPU Pre-flight Check ✅

Uh oh!

github-actions bot commented Mar 3, 2026

GPU Pre-flight Check ✅

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Mar 3, 2026

GPU Pre-flight Check ✅

Uh oh!

mamy-CS commented Mar 3, 2026

Uh oh!

clubanderson commented Mar 3, 2026

Uh oh!

mamy-CS commented Mar 3, 2026

Uh oh!

clubanderson commented Mar 4, 2026

Uh oh!

mamy-CS left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

clubanderson commented Mar 3, 2026 •

edited

Loading