ci-review-trigger.yml

# CI Review Trigger
#
# This workflow is a central point for triggering workflow runs that normally run only as part of the merge queue,
# on demand by a comment. The exception being the integration tests, which have their own workflow file for
# comment triggers as the logic is a bit more complex.
#
# NOTE: This workflow runs on Pull Request Review Comments rather than normal comments to be able to
# capture the SHA that the comment is associated with.
#
# The available triggers are:
#
# /ci-run-all                 : runs all of the below
# /ci-run-cli                 : runs CLI - Linux
# /ci-run-test-vector-api     : runs make test-vector-api
# /ci-run-test-behavior       : runs make test-behavior
# /ci-run-check-examples      : runs make check-examples
# /ci-run-test-docs           : runs make test-docs
# /ci-run-website             : runs website browser tests
# /ci-run-deny                : runs Deny - Linux
# /ci-run-component-features  : runs Component Features - Linux
# /ci-run-unit-mac            : runs Unit - Mac
# /ci-run-unit-windows        : runs Unit - Windows
# /ci-run-k8s                 : runs K8s E2E Suite
# /ci-run-packaging           : builds and verifies packages (without publishing to Docker/S3/GitHub)
#
# The following triggers are available but do NOT run as part of /ci-run-all:
# /ci-run-cross               : runs Cross (covered by /ci-run-packaging)
# /ci-run-coverage            : runs full coverage suite (unit + int + e2e)
# /ci-run-regression          : runs Regression Detection Suite. The comparison ref is
#                               the review's commit. An optional baseline ref can be
#                               passed as an argument, otherwise the baseline defaults
#                               to the SHA from 7 days ago. Examples:
#                                 /ci-run-regression
#                                 /ci-run-regression origin/master
#                                 /ci-run-regression v0.55.0
#                               Not included in `/ci-run-all` because it is expensive.

name: CI Review Trigger

on:
  pull_request_review:
    types: [submitted]

permissions:
  contents: read
  id-token: write

env:
  DD_ENV: "ci"
  RUST_BACKTRACE: full
  VECTOR_LOG: vector=debug
  VERBOSE: true
  CI: true
  PROFILE: debug

# The below concurrency group settings would let us cancel in progress runs that were triggered with the
# same comment on a given PR, which could save on time consuming runs.
# But GH does not currently support the github.event.review.body as part of the concurrency name, this
# appears to be due to the potential length of it.
#concurrency:
#  group: ${{ github.workflow }}-${{ github.event.issue.id }}-${{ github.event.review.body }}
#  cancel-in-progress: true

jobs:
  validate:
    name: Validate review
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    if: |
      startsWith(github.event.review.body, '/ci-run-all')
      || startsWith(github.event.review.body, '/ci-run-cli')
      || startsWith(github.event.review.body, '/ci-run-test-vector-api')
      || startsWith(github.event.review.body, '/ci-run-test-behavior')
      || startsWith(github.event.review.body, '/ci-run-check-examples')
      || startsWith(github.event.review.body, '/ci-run-test-docs')
      || startsWith(github.event.review.body, '/ci-run-website')
      || startsWith(github.event.review.body, '/ci-run-deny')
      || startsWith(github.event.review.body, '/ci-run-component-features')
      || startsWith(github.event.review.body, '/ci-run-coverage')
      || startsWith(github.event.review.body, '/ci-run-cross')
      || startsWith(github.event.review.body, '/ci-run-unit-mac')
      || startsWith(github.event.review.body, '/ci-run-unit-windows')
      || startsWith(github.event.review.body, '/ci-run-k8s')
      || startsWith(github.event.review.body, '/ci-run-packaging')
      || startsWith(github.event.review.body, '/ci-run-regression')
    steps:
      - name: Generate authentication token
        id: generate_token
        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a
        with:
          app_id: ${{ secrets.GH_APP_DATADOG_VECTOR_CI_APP_ID }}
          private_key: ${{ secrets.GH_APP_DATADOG_VECTOR_CI_APP_PRIVATE_KEY }}
      - name: Get PR review author
        id: comment
        uses: tspascoal/get-user-teams-membership@b2546c5affc730fd8e3d8483ae9ad3621938c2f9 # v4.0.2
        with:
          username: ${{ github.actor }}
          team: "Vector"
          GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}

      - name: Validate author membership
        if: steps.comment.outputs.isTeamMember == 'false'
        run: exit 1

  cli:
    needs: validate
    if: startsWith(github.event.review.body, '/ci-run-all') || contains(github.event.review.body, '/ci-run-cli')
    uses: ./.github/workflows/test-make-command.yml
    with:
      ref: ${{ github.event.review.commit_id }}
      command: test-cli
      job_name: CLI tests
      cargo_nextest: true
    secrets: inherit

  make-test-vector-api:
    needs: validate
    if: startsWith(github.event.review.body, '/ci-run-all') || contains(github.event.review.body, '/ci-run-test-vector-api')
    uses: ./.github/workflows/test-make-command.yml
    with:
      ref: ${{ github.event.review.commit_id }}
      command: test-vector-api
      job_name: make test-vector-api
      cargo_nextest: true
    secrets: inherit

  make-test-behavior:
    needs: validate
    if: startsWith(github.event.review.body, '/ci-run-all') || contains(github.event.review.body, '/ci-run-test-behavior')
    uses: ./.github/workflows/test-make-command.yml
    with:
      ref: ${{ github.event.review.commit_id }}
      command: test-behavior
      job_name: make test-behavior
    secrets: inherit

  make-check-examples:
    needs: validate
    if: startsWith(github.event.review.body, '/ci-run-all') || contains(github.event.review.body, '/ci-run-check-examples')
    uses: ./.github/workflows/test-make-command.yml
    with:
      ref: ${{ github.event.review.commit_id }}
      command: check-examples
      job_name: make check-examples
    secrets: inherit

  make-test-docs:
    needs: validate
    if: startsWith(github.event.review.body, '/ci-run-all') || contains(github.event.review.body, '/ci-run-test-docs')
    uses: ./.github/workflows/test-make-command.yml
    with:
      ref: ${{ github.event.review.commit_id }}
      command: test-docs
      job_name: make test-docs
    secrets: inherit

  website:
    needs: validate
    if: startsWith(github.event.review.body, '/ci-run-all') || contains(github.event.review.body, '/ci-run-website')
    uses: ./.github/workflows/website-tests.yml
    with:
      ref: ${{ github.event.review.commit_id }}

  deny:
    needs: validate
    if: startsWith(github.event.review.body, '/ci-run-all') || contains(github.event.review.body, '/ci-run-deny')
    uses: ./.github/workflows/deny.yml
    with:
      ref: ${{ github.event.review.commit_id }}
    secrets: inherit

  component-features:
    needs: validate
    if: startsWith(github.event.review.body, '/ci-run-all') || contains(github.event.review.body, '/ci-run-component-features')
    uses: ./.github/workflows/component_features.yml
    with:
      ref: ${{ github.event.review.commit_id }}
    secrets: inherit

  cross:
    needs: validate
    if: contains(github.event.review.body, '/ci-run-cross')
    uses: ./.github/workflows/cross.yml
    with:
      ref: ${{ github.event.review.commit_id }}
    secrets: inherit

  unit-mac:
    needs: validate
    if: startsWith(github.event.review.body, '/ci-run-all') || contains(github.event.review.body, '/ci-run-unit-mac')
    uses: ./.github/workflows/unit_mac.yml
    with:
      ref: ${{ github.event.review.commit_id }}
    secrets: inherit

  unit-windows:
    needs: validate
    if: startsWith(github.event.review.body, '/ci-run-all') || contains(github.event.review.body, '/ci-run-unit-windows')
    uses: ./.github/workflows/unit_windows.yml
    with:
      ref: ${{ github.event.review.commit_id }}
    secrets: inherit

  k8s:
    needs: validate
    if: startsWith(github.event.review.body, '/ci-run-all') || contains(github.event.review.body, '/ci-run-k8s')
    uses: ./.github/workflows/k8s_e2e.yml
    with:
      ref: ${{ github.event.review.commit_id }}
    secrets: inherit

  # Parse an optional baseline ref from a `/ci-run-regression <ref>` comment line.
  # The captured ref is passed to the regression workflow; an empty value lets it
  # fall back to its default (the SHA from 7 days ago).
  regression-parse:
    needs: validate
    if: startsWith(github.event.review.body, '/ci-run-regression')
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    outputs:
      baseline-sha: ${{ steps.parse.outputs.baseline }}
    steps:
      - name: Parse baseline ref from review body
        id: parse
        env:
          REVIEW_BODY: ${{ github.event.review.body }}
        run: |
          # The body starts with `/ci-run-regression`; take the second whitespace-
          # delimited token on the first line as the optional baseline ref.
          read -r _ BASELINE _ <<< "${REVIEW_BODY}"
          echo "Parsed baseline ref: '${BASELINE}'"
          echo "baseline=${BASELINE}" >> "$GITHUB_OUTPUT"

  regression:
    needs: [validate, regression-parse]
    if: startsWith(github.event.review.body, '/ci-run-regression')
    permissions:
      contents: read # Required to checkout code
      id-token: write # Required for AWS OIDC token exchange in regression.yml
    uses: ./.github/workflows/regression.yml
    with:
      baseline-sha: ${{ needs.regression-parse.outputs.baseline-sha }}
      comparison-sha: ${{ github.event.review.commit_id }}
    secrets: inherit

  coverage:
    needs: validate
    if: contains(github.event.review.body, '/ci-run-coverage')
    permissions:
      contents: read
      packages: write
      id-token: write
    uses: ./.github/workflows/coverage.yml
    with:
      ref: ${{ github.event.review.commit_id }}
    secrets: inherit

  packaging:
    needs: validate
    if: startsWith(github.event.review.body, '/ci-run-all') || contains(github.event.review.body, '/ci-run-packaging')
    permissions:
      contents: write
      packages: write
      id-token: write # Required by the reusable publish workflow
    uses: ./.github/workflows/publish.yml
    with:
      git_ref: ${{ github.event.review.commit_id }}
      channel: custom
      skip_publish: true
    secrets: inherit