Skip to content

Commit f262fde

Browse files
rauchyrauchy
committed
migrate to Checks API for integration tests
Use GitHub Checks API instead of Statuses API to report integration test results. This enables the use of GitHub App authentication and eliminates the need for monthly PAT rotation. Changes: - Generate a second GitHub App token for check creation - Create check run before triggering tests in eng-dev-ecosystem - Pass check_run_id to the workflow for status updates - Update get_status() to query Checks API instead of Statuses API
1 parent 819274c commit f262fde

File tree

3 files changed

+201
-25
lines changed

3 files changed

+201
-25
lines changed

‎.github/workflows/integration-tests.yml‎

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
name: Integration Tests
2+
3+
on:
4+
5+
pull_request:
6+
types: [opened, synchronize]
7+
8+
merge_group:
9+
10+
11+
jobs:
12+
check-token:
13+
name: Check secrets access
14+
15+
runs-on:
16+
group: databricks-deco-testing-runner-group
17+
labels: ubuntu-latest-deco
18+
19+
environment: "test-trigger-is"
20+
outputs:
21+
has_token: ${{ steps.set-token-status.outputs.has_token }}
22+
steps:
23+
- name: Check if required secrets are set
24+
id: set-token-status
25+
run: |
26+
if [ -z "${{ secrets.DECO_WORKFLOW_TRIGGER_APP_ID }}" ] || [ -z "${{ secrets.DECO_TEST_APPROVAL_APP_ID }}" ]; then
27+
echo "Required secrets are missing. User has no access to secrets."
28+
echo "has_token=false" >> $GITHUB_OUTPUT
29+
else
30+
echo "All required secrets are set. User has access to secrets."
31+
echo "has_token=true" >> $GITHUB_OUTPUT
32+
fi
33+
34+
trigger-tests:
35+
name: Trigger Tests
36+
37+
runs-on:
38+
group: databricks-deco-testing-runner-group
39+
labels: ubuntu-latest-deco
40+
41+
needs: check-token
42+
if: github.event_name == 'pull_request' && needs.check-token.outputs.has_token == 'true'
43+
environment: "test-trigger-is"
44+
45+
steps:
46+
- uses: actions/checkout@v4
47+
48+
- name: Generate GitHub App Token for Check Updates
49+
id: generate-check-token
50+
uses: actions/create-github-app-token@v1
51+
with:
52+
app-id: ${{ secrets.DECO_TEST_APPROVAL_APP_ID }}
53+
private-key: ${{ secrets.DECO_TEST_APPROVAL_PRIVATE_KEY }}
54+
owner: databricks
55+
56+
- name: Create Check Run
57+
id: create-check
58+
env:
59+
GH_TOKEN: ${{ steps.generate-check-token.outputs.token }}
60+
run: |
61+
response=$(gh api -X POST \
62+
/repos/${{ github.repository }}/check-runs \
63+
-f name="Integration Tests" \
64+
-f head_sha="${{ github.event.pull_request.head.sha }}" \
65+
-f status="queued" \
66+
-f output[title]="Integration Tests" \
67+
-f output[summary]="Tests queued and will be triggered shortly...")
68+
69+
check_run_id=$(echo "$response" | jq -r .id)
70+
echo "check_run_id=$check_run_id" >> $GITHUB_OUTPUT
71+
72+
- name: Generate GitHub App Token for Workflow Trigger
73+
id: generate-token
74+
uses: actions/create-github-app-token@v1
75+
with:
76+
app-id: ${{ secrets.DECO_WORKFLOW_TRIGGER_APP_ID }}
77+
private-key: ${{ secrets.DECO_WORKFLOW_TRIGGER_PRIVATE_KEY }}
78+
owner: ${{ secrets.ORG_NAME }}
79+
repositories: ${{secrets.REPO_NAME}}
80+
81+
- name: Trigger Workflow in Another Repo
82+
env:
83+
GH_TOKEN: ${{ steps.generate-token.outputs.token }}
84+
run: |
85+
gh workflow run cli-isolated-pr.yml -R ${{ secrets.ORG_NAME }}/${{secrets.REPO_NAME}} \
86+
--ref omer-lachish_data/deco-26060-cli-checks-api \
87+
-f pull_request_number=${{ github.event.pull_request.number }} \
88+
-f commit_sha=${{ github.event.pull_request.head.sha }} \
89+
-f check_run_id=${{ steps.create-check.outputs.check_run_id }}
90+
91+
92+
# The hash for the merge queue may not be the same as the hash for the PR.
93+
# Auto approve the check for the merge queue to avoid running integration tests twice.
94+
auto-approve:
95+
if: github.event_name == 'merge_group'
96+
97+
runs-on:
98+
group: databricks-deco-testing-runner-group
99+
labels: ubuntu-latest-deco
100+
101+
permissions:
102+
checks: write
103+
contents: read
104+
105+
steps:
106+
- name: Auto-approve Check for Merge Queue
107+
uses: actions/github-script@v7
108+
with:
109+
script: |
110+
await github.rest.checks.create({
111+
owner: context.repo.owner,
112+
repo: context.repo.repo,
113+
name: 'Integration Tests',
114+
head_sha: context.sha,
115+
status: 'completed',
116+
conclusion: 'success',
117+
output: {
118+
title: 'Integration Tests',
119+
summary: 'Auto-approved for merge queue (tests already passed on PR)'
120+
}
121+
});

‎.github/workflows/start-integration-tests.yml‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ jobs:
2222
if: "${{ !github.event.pull_request.head.repo.fork }}"
2323

2424
steps:
25-
- name: Generate GitHub App Token
25+
- name: Generate GitHub App Token for Workflow Trigger
2626
id: generate-token
2727
uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
2828
with:
@@ -31,11 +31,20 @@ jobs:
3131
owner: ${{ secrets.ORG_NAME }}
3232
repositories: ${{secrets.REPO_NAME}}
3333

34+
- name: Generate GitHub App Token for Check Updates
35+
id: generate-check-token
36+
uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
37+
with:
38+
app-id: ${{ secrets.DECO_TEST_APPROVAL_APP_ID }}
39+
private-key: ${{ secrets.DECO_TEST_APPROVAL_PRIVATE_KEY }}
40+
owner: databricks
41+
3442
- name: Fetch start_integration_tests.py
3543
run: wget https://raw.githubusercontent.com/databricks/cli/refs/heads/main/tools/start_integration_tests.py
3644

3745
- name: Run start_integration_tests.py
3846
env:
3947
GH_TOKEN: ${{ steps.generate-token.outputs.token }}
48+
GH_CHECK_TOKEN: ${{ steps.generate-check-token.outputs.token }}
4049
run: |-
4150
python3 ./start_integration_tests.py -R ${{ secrets.ORG_NAME }}/${{secrets.REPO_NAME}} --yes

‎tools/start_integration_tests.py‎

Lines changed: 70 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,9 @@
88

99
import argparse
1010
import json
11+
import os
1112
import subprocess
1213
import sys
13-
from pathlib import Path
14-
import re
1514

1615

1716
CLI_REPO = "databricks/cli"
@@ -20,14 +19,17 @@
2019
ALLOWED_HEAD_OWNER = {"id": "MDEyOk9yZ2FuaXphdGlvbjQ5OTgwNTI=", "login": "databricks"}
2120

2221

23-
def run(cmd):
22+
def run(cmd, env=None):
2423
sys.stderr.write("+ " + " ".join(cmd) + "\n")
25-
return subprocess.run(cmd, check=True)
24+
return subprocess.run(cmd, check=True, env=env)
2625

2726

28-
def run_json(cmd):
27+
def run_json(cmd, env=None):
2928
sys.stderr.write("+ " + " ".join(cmd) + "\n")
30-
result = subprocess.run(cmd, stdout=subprocess.PIPE, encoding="utf-8", check=True)
29+
run_env = os.environ.copy()
30+
if env:
31+
run_env.update(env)
32+
result = subprocess.run(cmd, stdout=subprocess.PIPE, encoding="utf-8", check=True, env=run_env)
3133

3234
try:
3335
return json.loads(result.stdout)
@@ -36,6 +38,38 @@ def run_json(cmd):
3638
raise
3739

3840

41+
def create_check(commit_sha):
42+
"""Create a check run for the given commit and return the check_run_id."""
43+
check_token = os.environ.get("GH_CHECK_TOKEN")
44+
if not check_token:
45+
print("Warning: GH_CHECK_TOKEN not set, skipping check creation")
46+
return None
47+
48+
response = run_json(
49+
[
50+
"gh",
51+
"api",
52+
"-X",
53+
"POST",
54+
f"/repos/{CLI_REPO}/check-runs",
55+
"-f",
56+
"name=Integration Tests",
57+
"-f",
58+
f"head_sha={commit_sha}",
59+
"-f",
60+
"status=queued",
61+
"-f",
62+
"output[title]=Integration Tests",
63+
"-f",
64+
"output[summary]=Tests queued and will be triggered shortly...",
65+
],
66+
env={"GH_TOKEN": check_token},
67+
)
68+
check_run_id = response.get("id")
69+
print(f"Created check run: {check_run_id}")
70+
return check_run_id
71+
72+
3973
def get_approved_prs_by_non_team():
4074
prs = run_json(
4175
[
@@ -108,30 +142,42 @@ def start_job(pr_number, commit_sha, author, approved_by, workflow, repo, force=
108142
response = input("Start integration tests? (y/n): ")
109143

110144
if response.lower() == "y":
111-
result = run(
112-
[
113-
"gh",
114-
"workflow",
115-
"run",
116-
workflow,
117-
"-R",
118-
repo,
119-
"-F",
120-
f"pull_request_number={pr_number}",
121-
"-F",
122-
f"commit_sha={commit_sha}",
123-
],
124-
)
145+
check_run_id = create_check(commit_sha)
146+
147+
cmd = [
148+
"gh",
149+
"workflow",
150+
"run",
151+
workflow,
152+
"-R",
153+
repo,
154+
"--ref",
155+
"omer-lachish_data/deco-26060-cli-checks-api", # TODO: remove after testing
156+
"-F",
157+
f"pull_request_number={pr_number}",
158+
"-F",
159+
f"commit_sha={commit_sha}",
160+
]
161+
if check_run_id:
162+
cmd.extend(["-F", f"check_run_id={check_run_id}"])
163+
164+
run(cmd)
125165
print(f"Started integration tests for PR #{pr_number}")
126166

127167

128168
def get_status(commit_sha):
129-
statuses = run_json(["gh", "api", f"repos/{CLI_REPO}/commits/{commit_sha}/statuses"])
169+
response = run_json(["gh", "api", f"repos/{CLI_REPO}/commits/{commit_sha}/check-runs"])
130170
result = []
131-
for st in statuses:
132-
if st["context"] != "Integration Tests Check":
171+
for check in response.get("check_runs", []):
172+
if check["name"] != "Integration Tests":
133173
continue
134-
result.append(f"{st['state']} {st['target_url']}")
174+
status = check["status"]
175+
conclusion = check.get("conclusion", "")
176+
details_url = check.get("details_url", "")
177+
if conclusion:
178+
result.append(f"{conclusion} {details_url}")
179+
else:
180+
result.append(f"{status} {details_url}")
135181
return result
136182

137183

0 commit comments

Comments
 (0)