Skip to content

Make tests work on hardened runner #4875

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pietern merged 17 commits into from
Apr 1, 2026
Merged

Make tests work on hardened runner #4875

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
4007149
Evaluate hardened runner for CI
pietern Mar 31, 2026
62449de
Fix runner group name
pietern Mar 31, 2026
cc5cd36
Configure JFrog proxy for Go on hardened runner
pietern Mar 31, 2026
61ec386
Set GOPROXY and auth for JFrog Go proxy
pietern Mar 31, 2026
053cc50
Use manual OIDC token exchange for Go proxy auth
pietern Mar 31, 2026
0b8b171
Use JFrog CLI directly for Go module downloads
pietern Mar 31, 2026
3a06528
Empty commit to test hardened runner queue time
pietern Mar 31, 2026
2d5fc49
Revert Makefile to run full test suite
pietern Mar 31, 2026
5270413
Add setup-node to build environment
pietern Mar 31, 2026
c9b6413
Disable run-local-node test on hardened runner
pietern Apr 1, 2026
9831754
Remove setup-node; run-local-node is the only test needing it
pietern Apr 1, 2026
bccbb84
Revert runner group to existing large runners
pietern Apr 1, 2026
7363747
Enable JFrog proxy for Windows runners too
pietern Apr 1, 2026
9fca8f3
Use bash shell for JFrog module download step
pietern Apr 1, 2026
eacae04
Move JFrog proxy setup to shared setup-build-environment action
pietern Apr 1, 2026
c0cc672
Add setup-build-environment as testmask trigger and switch secondary …
pietern Apr 1, 2026
789e563
Fix YAML formatting for commented-out Windows matrix entry
pietern Apr 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions .github/actions/setup-build-environment/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,14 @@ runs:
- name: Checkout repository and submodules
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- name: Setup JFrog CLI with OIDC
if: runner.os != 'macOS'
uses: jfrog/setup-jfrog-cli@279b1f629f43dd5bc658d8361ac4802a7ef8d2d5 # v4.9.1
env:
JF_URL: https://databricks.jfrog.io
with:
oidc-provider-name: github-actions

- name: Create cache identifier
run: echo "${{ inputs.cache-key }}" > cache.txt
shell: bash
Expand All @@ -24,6 +32,14 @@ runs:
go.sum
cache.txt

- name: Download Go modules via JFrog
if: runner.os != 'macOS'
shell: bash
run: |
jf goc --repo-resolve=db-golang
jf go mod download
jf go mod download -modfile=tools/go.mod

- name: Setup Python
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
Expand Down
78 changes: 62 additions & 16 deletions .github/workflows/push.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,6 +80,10 @@ jobs:
name: "make test (${{matrix.os.name}}, ${{matrix.deployment}})"
runs-on: ${{ matrix.os.runner }}

permissions:
id-token: write
contents: read

strategy:
fail-fast: false
matrix:
Expand Down Expand Up @@ -160,17 +164,31 @@ jobs:

# Only run if the target is in the list of targets from testmask
if: ${{ contains(fromJSON(needs.testmask.outputs.targets), 'test-exp-aitools') }}
name: "make test-exp-aitools"
runs-on: ${{ matrix.os }}
name: "make test-exp-aitools (${{matrix.os.name}})"
runs-on: ${{ matrix.os.runner }}

permissions:
id-token: write
contents: read

strategy:
fail-fast: false
matrix:
os:
- macos-latest
- ubuntu-latest
# The Windows tests are broken; see https://github.com/databricks/cli/pull/4024.
# - windows-latest
- name: linux
runner:
group: databricks-protected-runner-group-large
labels: linux-ubuntu-latest-large

- name: macos
runner:
labels: macos-latest

# The Windows tests are broken; see https://github.com/databricks/cli/pull/4024.
# - name: windows
# runner:
# group: databricks-protected-runner-group-large
# labels: windows-server-latest-large

steps:
- name: Checkout repository and submodules
Expand All @@ -192,16 +210,30 @@ jobs:

# Only run if the target is in the list of targets from testmask
if: ${{ contains(fromJSON(needs.testmask.outputs.targets), 'test-exp-ssh') }}
name: "make test-exp-ssh"
runs-on: ${{ matrix.os }}
name: "make test-exp-ssh (${{matrix.os.name}})"
runs-on: ${{ matrix.os.runner }}

permissions:
id-token: write
contents: read

strategy:
fail-fast: false
matrix:
os:
- macos-latest
- ubuntu-latest
- windows-latest
- name: linux
runner:
group: databricks-protected-runner-group-large
labels: linux-ubuntu-latest-large

- name: windows
runner:
group: databricks-protected-runner-group-large
labels: windows-server-latest-large

- name: macos
runner:
labels: macos-latest

steps:
- name: Checkout repository and submodules
Expand All @@ -223,16 +255,30 @@ jobs:

# Only run if the target is in the list of targets from testmask
if: ${{ contains(fromJSON(needs.testmask.outputs.targets), 'test-pipelines') }}
name: "make test-pipelines"
runs-on: ${{ matrix.os }}
name: "make test-pipelines (${{matrix.os.name}})"
runs-on: ${{ matrix.os.runner }}

permissions:
id-token: write
contents: read

strategy:
fail-fast: false
matrix:
os:
- macos-latest
- ubuntu-latest
- windows-latest
- name: linux
runner:
group: databricks-protected-runner-group-large
labels: linux-ubuntu-latest-large

- name: windows
runner:
group: databricks-protected-runner-group-large
labels: windows-server-latest-large

- name: macos
runner:
labels: macos-latest

steps:
- name: Checkout repository and submodules
Expand Down
2 changes: 1 addition & 1 deletion acceptance/cmd/workspace/apps/run-local-node/out.test.toml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

3 changes: 2 additions & 1 deletion acceptance/cmd/workspace/apps/run-local-node/test.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
Badness = "need to enable NPM registry access"
Copy link
Copy Markdown
Contributor

@denik denik Apr 1, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should also consider vendoring dependencies here like we did with Python.

Cloud = false
Local = true
Local = false
RecordRequests = false
Timeout = '2m'
TimeoutWindows = '10m'
Expand Down
13 changes: 7 additions & 6 deletions tools/testmask/targets.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,34 +11,35 @@ type targetMapping struct {
target string
}

// goTriggerPatterns lists patterns that trigger all Go-dependent targets.
var goTriggerPatterns = []string{
// commonTriggerPatterns lists patterns that trigger all test targets.
var commonTriggerPatterns = []string{
"go.mod",
"go.sum",
".github/actions/setup-build-environment/",
}

var fileTargetMappings = []targetMapping{
{
prefixes: slices.Concat(goTriggerPatterns, []string{
prefixes: slices.Concat(commonTriggerPatterns, []string{
// Specify files that match targets below and should still trigger the "test" target.
}),
target: "test",
},
{
prefixes: slices.Concat(goTriggerPatterns, []string{
prefixes: slices.Concat(commonTriggerPatterns, []string{
"experimental/aitools/",
}),
target: "test-exp-aitools",
},
{
prefixes: slices.Concat(goTriggerPatterns, []string{
prefixes: slices.Concat(commonTriggerPatterns, []string{
"experimental/ssh/",
"acceptance/ssh/",
}),
target: "test-exp-ssh",
},
{
prefixes: slices.Concat(goTriggerPatterns, []string{
prefixes: slices.Concat(commonTriggerPatterns, []string{
"cmd/pipelines/",
"acceptance/pipelines/",
}),
Expand Down
7 changes: 7 additions & 0 deletions tools/testmask/targets_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,13 @@ func TestGetTargets(t *testing.T) {
},
targets: []string{"test", "test-exp-aitools", "test-exp-ssh", "test-pipelines"},
},
{
name: "setup_build_environment_triggers_all",
files: []string{
".github/actions/setup-build-environment/action.yml",
},
targets: []string{"test", "test-exp-aitools", "test-exp-ssh", "test-pipelines"},
},
{
name: "empty_files",
files: []string{},
Expand Down
Loading