diff --git a/.github/WORKFLOWS.md b/.github/WORKFLOWS.md index 40a91304c54..e06bc7a3fff 100644 --- a/.github/WORKFLOWS.md +++ b/.github/WORKFLOWS.md @@ -236,14 +236,6 @@ parallelism). See the `--build-via-mcp` section in | PR merged to `release/*` | `release-publish.yml` | | PR closed with `codespace-preview` | `util-codespace-preview.yml` | -### Manual Triggers (PR Comments) - -| Command | Workflow | Permissions | -|--------------------|------------------------------|---------------------| -| `/test-workflows` | `test-workflows-callable.yml`| admin/write/maintain| - -**Why:** Re-run tests without pushing commits. Useful for flaky test investigation. - ### Label Triggers | Label | Workflow | Effect | @@ -454,10 +446,6 @@ test-sbom-nightly.yml test-workflows-nightly.yml (manual dispatch only — nightly schedule disabled, DEVP-544) └──────────────────────────▶ test-workflows-callable.yml - -PR Comment Dispatchers (triggered by /command in PR comments): -test-workflows-pr-comment.yml - └──────────────────────────▶ test-workflows-callable.yml ``` --- @@ -1267,12 +1255,6 @@ Adding a new channel requires inviting the bot first; the first run otherwise fa ## Future Vision -### Redundancy Review - -Comment trigger (`/test-workflows`) is a workaround. - -Long-term: Main CI should be reliable enough to not need these. - ### Workflow Testability - Tools like `act` for local testing diff --git a/.github/workflows/test-workflows-pr-comment.yml b/.github/workflows/test-workflows-pr-comment.yml deleted file mode 100644 index 4135cb2149e..00000000000 --- a/.github/workflows/test-workflows-pr-comment.yml +++ /dev/null @@ -1,110 +0,0 @@ -name: 'Test: Workflows PR Comment' - -on: - issue_comment: - types: [created] - -permissions: - pull-requests: read - contents: read - -jobs: - handle_comment_command: - name: Handle /test-workflows Command - if: github.event.issue.pull_request && startsWith(github.event.comment.body, '/test-workflows') - runs-on: ubuntu-latest - outputs: - permission_granted: ${{ steps.pr_check_and_details.outputs.permission_granted }} - git_ref: ${{ steps.pr_check_and_details.outputs.head_sha }} - pr_number: ${{ steps.pr_check_and_details.outputs.pr_number_string }} - - steps: - - name: Validate User, Get PR Details, and React - id: pr_check_and_details - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8 - with: - github-token: ${{ secrets.GITHUB_TOKEN }} - script: | - const commenter = context.actor; - const issueOwner = context.repo.owner; - const issueRepo = context.repo.repo; - const commentId = context.payload.comment.id; - const prNumber = context.issue.number; // In issue_comment on a PR, issue.number is the PR number - - // Function to add a reaction to the comment - async function addReaction(content) { - try { - await github.rest.reactions.createForIssueComment({ - owner: issueOwner, - repo: issueRepo, - comment_id: commentId, - content: content - }); - } catch (reactionError) { - // Log if reaction fails but don't fail the script for this - console.log(`Failed to add reaction '${content}': ${reactionError.message}`); - } - } - - // Initialize outputs to a non-triggering state - core.setOutput('permission_granted', 'false'); - core.setOutput('head_sha', ''); - core.setOutput('pr_number_string', ''); - - // 1. Check user permissions - try { - const { data: permissions } = await github.rest.repos.getCollaboratorPermissionLevel({ - owner: issueOwner, - repo: issueRepo, - username: commenter - }); - - const allowedPermissions = ['admin', 'write', 'maintain']; - if (!allowedPermissions.includes(permissions.permission)) { - console.log(`User @${commenter} has '${permissions.permission}' permission. Needs 'admin', 'write', or 'maintain'.`); - await addReaction('-1'); // User does not have permission - return; // Exit script, tests will not be triggered - } - console.log(`User @${commenter} has '${permissions.permission}' permission.`); - } catch (error) { - console.log(`Could not verify permissions for @${commenter}: ${error.message}`); - await addReaction('confused'); // Error checking permissions - return; // Exit script - } - - // 2. Fetch PR details (if permission check passed) - let headSha; - try { - const { data: pr } = await github.rest.pulls.get({ - owner: issueOwner, - repo: issueRepo, - pull_number: prNumber, - }); - headSha = pr.head.sha; - console.log(`Workspaced PR details: SHA - ${headSha}, PR Number - ${prNumber}`); - - // Set outputs for the next job - core.setOutput('permission_granted', 'true'); - core.setOutput('head_sha', headSha); - core.setOutput('pr_number_string', prNumber.toString()); - await addReaction('+1'); // Command accepted, tests will be triggered - - } catch (error) { - console.log(`Failed to fetch PR details for PR #${prNumber}: ${error.message}`); - core.setOutput('permission_granted', 'false'); // Ensure this is false if PR fetch fails - await addReaction('confused'); // Error fetching PR details - } - - trigger_reusable_tests: - name: Trigger Reusable Test Workflow - needs: handle_comment_command - - if: > - always() && - needs.handle_comment_command.result != 'skipped' && - needs.handle_comment_command.outputs.permission_granted == 'true' && - needs.handle_comment_command.outputs.git_ref != '' - uses: ./.github/workflows/test-workflows-callable.yml - with: - git_ref: ${{ needs.handle_comment_command.outputs.git_ref }} - secrets: inherit diff --git a/.poutine.yml b/.poutine.yml index 79061f0c1b0..fe587eb41d6 100644 --- a/.poutine.yml +++ b/.poutine.yml @@ -52,8 +52,8 @@ skip: # Uses merge commit SHA from GitHub - the code has already been reviewed # and merged, not arbitrary PR code. - .github/workflows/test-unit-reusable.yml - # Permission-gated: only maintainers (admin/write/maintain) can trigger - # via /test-workflows comment. Verified in test-workflows-pr-comment.yml. + # Reachable only from test-workflows-nightly.yml, which is + # workflow_dispatch-only, so the ref comes from a maintainer, not a PR. - .github/workflows/test-workflows-callable.yml # Reusable workflow reachable only via workflow_dispatch (manual) or from # ci-mcp-evals.yml, which is itself workflow_dispatch-only — never from a