diff --git a/.github/workflows/build_deploy_dev.yml b/.github/workflows/build_deploy_dev.yml index cc9d25f7e..5c5543eb5 100644 --- a/.github/workflows/build_deploy_dev.yml +++ b/.github/workflows/build_deploy_dev.yml @@ -23,7 +23,7 @@ jobs: changes: name: Filter changed files - runs-on: mdb-dev + runs-on: ubuntu-latest outputs: not-docs: ${{ steps.filter.outputs.not-docs }} steps: @@ -78,6 +78,7 @@ jobs: push-cache: false scan-keycloak: + if: ${{ !github.event.pull_request.head.repo.fork }} runs-on: mdb-dev needs: [ build ] name: Scan cloud-cpu image @@ -139,11 +140,22 @@ jobs: # This is a collection point for all of the matrix tests above so we can have a single required job tests_completed: name: All Tests Succeeded - needs: [run_unit_tests, run_integration_tests, changes] - runs-on: mdb-dev + needs: [run_unit_tests, run_integration_tests, changes, get-deploy-labels] + runs-on: ubuntu-latest if: always() steps: + # A skipped `run_integration_tests` means two different things. With no + # deploy label there was nothing to run them against, which is fine. A + # deploy that failed also leaves them skipped, which is not. Reading + # `!= 'success'` treated both the same, so this job failed on every + # first-party pull request that carried no deploy label and its red said + # nothing. Gate on whether anything was actually deployed instead. - name: fail if tests failed or didnt run - if: ${{ (needs.run_unit_tests.result != 'success' || (needs.run_integration_tests.result != 'success' && !github.event.pull_request.head.repo.fork)) && needs.changes.outputs.not-docs == 'true' }} + if: >- + ${{ needs.changes.outputs.not-docs == 'true' + && (needs.run_unit_tests.result != 'success' + || (needs.get-deploy-labels.outputs.deploy-envs != '[]' + && !github.event.pull_request.head.repo.fork + && needs.run_integration_tests.result != 'success')) }} run: exit 1 - run: echo "Tests ran successfully" diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml index 796fc2c0a..cf8d54d6f 100644 --- a/.github/workflows/cla.yml +++ b/.github/workflows/cla.yml @@ -1,7 +1,7 @@ name: "MindsDB CLA Assistant" permissions: - actions: write + actions: read contents: write pull-requests: write statuses: write @@ -14,15 +14,6 @@ on: jobs: CLAssistant: - runs-on: mdb-dev - steps: - - name: "CLA Assistant" - if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target' - uses: contributor-assistant/github-action@v2.6.1 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - with: - path-to-signatures: 'assets/contributions-agreement/signatures/cla.json' - path-to-document: 'https://github.com/mindsdb/mindsdb/blob/main/assets/contributions-agreement/individual-contributor.md' - branch: 'cla' - allowlist: bot*, ZoranPandovski, torrmal, Stpmax, mindsdbadmin, ea-rus, tmichaeldb, dusvyat, hamishfagg, MinuraPunchihewa, martyna-mindsdb, dylanketterer, ala12326571 + uses: mindsdb/github-actions/.github/workflows/cla-assistant.yml@main + with: + path-to-document: 'https://github.com/mindsdb/mindshub/blob/main/assets/contributions-agreement/individual-contributor.md' diff --git a/.github/workflows/tests_unit.yml b/.github/workflows/tests_unit.yml index 876972852..f490c8454 100644 --- a/.github/workflows/tests_unit.yml +++ b/.github/workflows/tests_unit.yml @@ -47,7 +47,7 @@ jobs: # Run all of our static code checks here code_checking: name: Run static code checks - runs-on: mdb-dev + runs-on: ubuntu-latest steps: - name: Checkout uses: actions/checkout@v4 @@ -57,8 +57,7 @@ jobs: - name: Setup uv uses: astral-sh/setup-uv@v5 with: - cache-local-path: "/home/runner/_work/_tool/uv-local-cache" # Place cache in the tool dir because we mount this in our runnners - prune-cache: false # We want to save all cache because it's in the mount^ + enable-cache: true python-version: ${{ vars.CI_PYTHON_VERSION || '3.11' }} # Default to 3.11 where vars aren't available (PRs from forks) # Checks the codebase for print() statements and fails if any are found # We should be using loggers instead @@ -86,7 +85,7 @@ jobs: # Creates a matrix of environments to test against using matrix_includes.json matrix_prep: name: Prepare matrix - runs-on: mdb-dev + runs-on: ubuntu-latest outputs: matrix: ${{ steps.set-matrix.outputs.matrix }} steps: @@ -97,6 +96,35 @@ jobs: uses: JoshuaTheMiller/conditional-build-matrix@v2.0.1 with: filter: "[?runOnBranch==`${{ github.ref }}` || runOnBranch==`always`]" + # matrix_includes.json is read from the pull request's own checkout, so on + # a fork PR the contributor chooses these labels. The jobs below feed them + # straight into `runs-on`, which is how a fork would put its own code on a + # pod inside our clusters without touching a workflow file. + - name: Reject runner labels that are not GitHub-hosted + env: + MATRIX: ${{ steps.set-matrix.outputs.matrix }} + run: | + set -euo pipefail + # tostring and the array branch matter: `runs-on` also accepts a list + # of labels, and an entry with no `runs_on` at all reads as null. Both + # have to reach the comparison as strings rather than crashing jq, + # which would report nothing. + BAD=$(jq -r ' + [(.include // [])[].runs_on] + | map(if type == "array" then .[] else . end) + | map(tostring) + # An allowlist, not a denylist of our own labels, so a label nobody + # has thought of yet fails rather than passes. Adding a new + # GitHub-hosted image to matrix_includes.json means adding it here + # too, and the error below says which label was rejected. + - ["ubuntu-latest","ubuntu-24.04","ubuntu-22.04","windows-latest","macos-latest"] + | unique | join(", ") + ' <<< "$MATRIX") + # Expect: empty, so every matrix entry names a GitHub-hosted runner + if [ -n "$BAD" ]; then + echo "::error::matrix_includes.json asks for runner labels that are not GitHub-hosted: $BAD" + exit 1 + fi check_install: name: Check pip installation