Skip to content

Introduce authorize step for external PRs #2493

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 5 commits into from
Closed

Introduce authorize step for external PRs #2493

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
2a6a93a
Introduce authorize step for external PRs
sentrivana Nov 7, 2023
29ce844
add missing file
sentrivana Nov 7, 2023
32666b9
check out pr commit
sentrivana Nov 7, 2023
efa2bf7
rename
sentrivana Nov 7, 2023
3f5d563
Merge branch 'master' into ivana/run-aws-lambda-tests-on-forks
sentrivana Nov 8, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .github/workflows/test-common.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ env:
${{ github.workspace }}/dist-serverless

jobs:

test:
name: common, python ${{ matrix.python-version }}, ${{ matrix.os }}
runs-on: ${{ matrix.os }}
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/test-integration-aiohttp.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ env:
${{ github.workspace }}/dist-serverless

jobs:

test:
name: aiohttp, python ${{ matrix.python-version }}, ${{ matrix.os }}
runs-on: ${{ matrix.os }}
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/test-integration-ariadne.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ env:
${{ github.workspace }}/dist-serverless

jobs:

test:
name: ariadne, python ${{ matrix.python-version }}, ${{ matrix.os }}
runs-on: ${{ matrix.os }}
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/test-integration-arq.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ env:
${{ github.workspace }}/dist-serverless

jobs:

test:
name: arq, python ${{ matrix.python-version }}, ${{ matrix.os }}
runs-on: ${{ matrix.os }}
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/test-integration-asgi.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ env:
${{ github.workspace }}/dist-serverless

jobs:

test:
name: asgi, python ${{ matrix.python-version }}, ${{ matrix.os }}
runs-on: ${{ matrix.os }}
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/test-integration-asyncpg.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ env:
${{ github.workspace }}/dist-serverless

jobs:

test:
name: asyncpg, python ${{ matrix.python-version }}, ${{ matrix.os }}
runs-on: ${{ matrix.os }}
Expand Down
15 changes: 14 additions & 1 deletion .github/workflows/test-integration-aws_lambda.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ on:
- master
- release/**

pull_request:
pull_request_target:

# Cancel in progress workflows on pull_requests.
# https://docs.github.com/en/actions/using-jobs/using-concurrency#example-using-a-fallback-value
Expand All @@ -25,7 +25,18 @@ env:
${{ github.workspace }}/dist-serverless

jobs:
authorize:
name: Determine environment
environment:
${{ github.event_name == 'pull_request_target' &&
github.event.pull_request.head.repo.full_name != github.repository &&
'external' || 'internal' }}
runs-on: ubuntu-latest
steps:
- run: true
Comment on lines 27 to +36
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is not clear what this does -- I expected a label being required here and I don't see it

as it is written right now it is unsafe as it checks out the pull request and then executes arbitrary code from it

Copy link
Contributor Author

@sentrivana sentrivana Nov 8, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The idea is to use environments instead of labels to control which PRs are allowed to be checked out and executed. The prerequisite is that the repo must be configured to have an external environment such that any environment: external workflows require a review from a Sentry employee before they're allowed to run. The authorize job above sets the environment to external if the PR was made from a fork.

Technically this should be better than using a label, since it revokes any existing workflow approvals automatically on new code changes without us needing to introduce another step to check for code changes and remove the label, and there is no risk of a race condition between granting the approval/label and new code changes being pushed.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

More context: iterative/cml#574 (comment)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

hmm nice if it works -- we should try this out in a separate repo first with less sensitive credentials

if this is the github feature I think it is we still might not want to do it this way though -- iirc it sends an email to all repository collaborators (read: the entire company) without a way to opt out

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I tried this out on https://github.com/sentrivana/playground: here's the ci.yaml, the environment definition:

Screenshot 2023-11-10 at 13 37 58

And here's a fork PR against the repo: sentrivana/playground#2

if this is the github feature I think it is we still might not want to do it this way though -- iirc it sends an email to all repository collaborators (read: the entire company) without a way to opt out

Ugh. Will test this some more to see if that's the case. If it is, will change this to use a label instead.

Thanks for the feedback!


test:
needs: authorize
name: aws_lambda, python ${{ matrix.python-version }}, ${{ matrix.os }}
runs-on: ${{ matrix.os }}
timeout-minutes: 30
Expand All @@ -42,6 +53,8 @@ jobs:

steps:
- uses: actions/checkout@v4
with:
ref: ${{ github.event.pull_request.head.sha || github.ref }}
- uses: actions/setup-python@v4
with:
python-version: ${{ matrix.python-version }}
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/test-integration-beam.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ env:
${{ github.workspace }}/dist-serverless

jobs:

test:
name: beam, python ${{ matrix.python-version }}, ${{ matrix.os }}
runs-on: ${{ matrix.os }}
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/test-integration-boto3.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ env:
${{ github.workspace }}/dist-serverless

jobs:

test:
name: boto3, python ${{ matrix.python-version }}, ${{ matrix.os }}
runs-on: ${{ matrix.os }}
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/test-integration-bottle.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ env:
${{ github.workspace }}/dist-serverless

jobs:

test:
name: bottle, python ${{ matrix.python-version }}, ${{ matrix.os }}
runs-on: ${{ matrix.os }}
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/test-integration-celery.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ env:
${{ github.workspace }}/dist-serverless

jobs:

test:
name: celery, python ${{ matrix.python-version }}, ${{ matrix.os }}
runs-on: ${{ matrix.os }}
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/test-integration-chalice.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ env:
${{ github.workspace }}/dist-serverless

jobs:

test:
name: chalice, python ${{ matrix.python-version }}, ${{ matrix.os }}
runs-on: ${{ matrix.os }}
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/test-integration-clickhouse_driver.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ env:
${{ github.workspace }}/dist-serverless

jobs:

test:
name: clickhouse_driver, python ${{ matrix.python-version }}, ${{ matrix.os }}
runs-on: ${{ matrix.os }}
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/test-integration-cloud_resource_context.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ env:
${{ github.workspace }}/dist-serverless

jobs:

test:
name: cloud_resource_context, python ${{ matrix.python-version }}, ${{ matrix.os }}
runs-on: ${{ matrix.os }}
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/test-integration-django.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ env:
${{ github.workspace }}/dist-serverless

jobs:

test:
name: django, python ${{ matrix.python-version }}, ${{ matrix.os }}
runs-on: ${{ matrix.os }}
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/test-integration-falcon.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ env:
${{ github.workspace }}/dist-serverless

jobs:

test:
name: falcon, python ${{ matrix.python-version }}, ${{ matrix.os }}
runs-on: ${{ matrix.os }}
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/test-integration-fastapi.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ env:
${{ github.workspace }}/dist-serverless

jobs:

test:
name: fastapi, python ${{ matrix.python-version }}, ${{ matrix.os }}
runs-on: ${{ matrix.os }}
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/test-integration-flask.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ env:
${{ github.workspace }}/dist-serverless

jobs:

test:
name: flask, python ${{ matrix.python-version }}, ${{ matrix.os }}
runs-on: ${{ matrix.os }}
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/test-integration-gcp.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ env:
${{ github.workspace }}/dist-serverless

jobs:

test:
name: gcp, python ${{ matrix.python-version }}, ${{ matrix.os }}
runs-on: ${{ matrix.os }}
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/test-integration-gevent.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ env:
${{ github.workspace }}/dist-serverless

jobs:

test:
name: gevent, python ${{ matrix.python-version }}, ${{ matrix.os }}
runs-on: ${{ matrix.os }}
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/test-integration-gql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ env:
${{ github.workspace }}/dist-serverless

jobs:

test:
name: gql, python ${{ matrix.python-version }}, ${{ matrix.os }}
runs-on: ${{ matrix.os }}
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/test-integration-graphene.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ env:
${{ github.workspace }}/dist-serverless

jobs:

test:
name: graphene, python ${{ matrix.python-version }}, ${{ matrix.os }}
runs-on: ${{ matrix.os }}
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/test-integration-grpc.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ env:
${{ github.workspace }}/dist-serverless

jobs:

test:
name: grpc, python ${{ matrix.python-version }}, ${{ matrix.os }}
runs-on: ${{ matrix.os }}
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/test-integration-httpx.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ env:
${{ github.workspace }}/dist-serverless

jobs:

test:
name: httpx, python ${{ matrix.python-version }}, ${{ matrix.os }}
runs-on: ${{ matrix.os }}
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/test-integration-huey.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ env:
${{ github.workspace }}/dist-serverless

jobs:

test:
name: huey, python ${{ matrix.python-version }}, ${{ matrix.os }}
runs-on: ${{ matrix.os }}
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/test-integration-loguru.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ env:
${{ github.workspace }}/dist-serverless

jobs:

test:
name: loguru, python ${{ matrix.python-version }}, ${{ matrix.os }}
runs-on: ${{ matrix.os }}
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/test-integration-opentelemetry.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ env:
${{ github.workspace }}/dist-serverless

jobs:

test:
name: opentelemetry, python ${{ matrix.python-version }}, ${{ matrix.os }}
runs-on: ${{ matrix.os }}
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/test-integration-pure_eval.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ env:
${{ github.workspace }}/dist-serverless

jobs:

test:
name: pure_eval, python ${{ matrix.python-version }}, ${{ matrix.os }}
runs-on: ${{ matrix.os }}
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/test-integration-pymongo.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ env:
${{ github.workspace }}/dist-serverless

jobs:

test:
name: pymongo, python ${{ matrix.python-version }}, ${{ matrix.os }}
runs-on: ${{ matrix.os }}
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/test-integration-pyramid.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ env:
${{ github.workspace }}/dist-serverless

jobs:

test:
name: pyramid, python ${{ matrix.python-version }}, ${{ matrix.os }}
runs-on: ${{ matrix.os }}
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/test-integration-quart.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ env:
${{ github.workspace }}/dist-serverless

jobs:

test:
name: quart, python ${{ matrix.python-version }}, ${{ matrix.os }}
runs-on: ${{ matrix.os }}
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/test-integration-redis.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ env:
${{ github.workspace }}/dist-serverless

jobs:

test:
name: redis, python ${{ matrix.python-version }}, ${{ matrix.os }}
runs-on: ${{ matrix.os }}
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/test-integration-rediscluster.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ env:
${{ github.workspace }}/dist-serverless

jobs:

test:
name: rediscluster, python ${{ matrix.python-version }}, ${{ matrix.os }}
runs-on: ${{ matrix.os }}
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/test-integration-requests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ env:
${{ github.workspace }}/dist-serverless

jobs:

test:
name: requests, python ${{ matrix.python-version }}, ${{ matrix.os }}
runs-on: ${{ matrix.os }}
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/test-integration-rq.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ env:
${{ github.workspace }}/dist-serverless

jobs:

test:
name: rq, python ${{ matrix.python-version }}, ${{ matrix.os }}
runs-on: ${{ matrix.os }}
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/test-integration-sanic.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ env:
${{ github.workspace }}/dist-serverless

jobs:

test:
name: sanic, python ${{ matrix.python-version }}, ${{ matrix.os }}
runs-on: ${{ matrix.os }}
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/test-integration-sqlalchemy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ env:
${{ github.workspace }}/dist-serverless

jobs:

test:
name: sqlalchemy, python ${{ matrix.python-version }}, ${{ matrix.os }}
runs-on: ${{ matrix.os }}
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/test-integration-starlette.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ env:
${{ github.workspace }}/dist-serverless

jobs:

test:
name: starlette, python ${{ matrix.python-version }}, ${{ matrix.os }}
runs-on: ${{ matrix.os }}
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/test-integration-starlite.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ env:
${{ github.workspace }}/dist-serverless

jobs:

test:
name: starlite, python ${{ matrix.python-version }}, ${{ matrix.os }}
runs-on: ${{ matrix.os }}
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/test-integration-strawberry.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ env:
${{ github.workspace }}/dist-serverless

jobs:

test:
name: strawberry, python ${{ matrix.python-version }}, ${{ matrix.os }}
runs-on: ${{ matrix.os }}
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/test-integration-tornado.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ env:
${{ github.workspace }}/dist-serverless

jobs:

test:
name: tornado, python ${{ matrix.python-version }}, ${{ matrix.os }}
runs-on: ${{ matrix.os }}
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/test-integration-trytond.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ env:
${{ github.workspace }}/dist-serverless

jobs:

test:
name: trytond, python ${{ matrix.python-version }}, ${{ matrix.os }}
runs-on: ${{ matrix.os }}
Expand Down
9 changes: 9 additions & 0 deletions scripts/split-tox-gh-actions/ci-yaml-authorize-snippet.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
authorize:
name: Determine environment
environment:
${{ github.event_name == 'pull_request_target' &&
github.event.pull_request.head.repo.full_name != github.repository &&
'external' || 'internal' }}
runs-on: ubuntu-latest
steps:
- run: true
1 change: 1 addition & 0 deletions scripts/split-tox-gh-actions/ci-yaml-test-py27-snippet.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@

steps:
- uses: actions/checkout@v4
{{ checkout_with }}

- name: Setup Test Env
run: |
Expand Down
1 change: 1 addition & 0 deletions scripts/split-tox-gh-actions/ci-yaml-test-snippet.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@

steps:
- uses: actions/checkout@v4
{{ checkout_with }}
- uses: actions/setup-python@v4
with:
python-version: ${{ matrix.python-version }}
Expand Down
Loading