Trigger AWS Lambda tests on label #2538
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
cc @asottile-sentry @mdtro in case you guys want to/have time to double check |
asottile-sentry
approved these changes
Nov 28, 2023
| from urllib.parse import quote | ||
| from urllib.request import Request, urlopen | ||
|
|
||
| LABEL = "Trigger: tests" |
There was a problem hiding this comment.
I would maybe make this more explicit that it's sensitive tests requiring secrets
There was a problem hiding this comment.
Changed to "Trigger: tests using secrets" (open to better names)
antonpirker
approved these changes
Nov 29, 2023
Co-authored-by: Anton Pirker <anton.pirker@sentry.io>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Our AWS Lambda test suite currently doesn't run properly on external contributor PRs because it needs access to repo secrets, which it currently doesn't have. This PR adds a label to grant access to the secrets, which is invalidated upon any new code changes.
How it works
For the AWS Lambda test suite (and any future test suites that need access to GH secrets):
check-permissionsjob that runs before all test jobscheck-permissionsjob runs a Python script (taken from here) that finishes with an error code if the PR was not made by someone with write permissions and there is noTrigger: tests using secretslabel on the PRTrigger: tests using secretslabel on any code changes before any code from the PR is checked outcheck-permissionsfinishing successfullypull_request_target(with access to secrets)Copied and adapted the approach from
sentry: https://github.com/getsentry/sentry/blob/master/.github/workflows/getsentry-dispatch.ymlThe test AWS account has been stripped down of all unnecessary permissions: #2493 (comment)
Since the workflow is now on
pull_request_targetit won't run until we've actually merged this PR. I tried the changes out in a test repo.Supersedes #2493