Skip to content

Make sure that we can run locking on GitHub Actions#5675

Merged
krzysztofczyz-da merged 3 commits into
mainfrom
kczyz/infra-runner-setup
Jun 1, 2026
Merged

Make sure that we can run locking on GitHub Actions#5675
krzysztofczyz-da merged 3 commits into
mainfrom
kczyz/infra-runner-setup

Conversation

@krzysztofczyz-da
Copy link
Copy Markdown
Contributor

@krzysztofczyz-da krzysztofczyz-da commented May 25, 2026

This PR makes sure that we can verify the locker of scratchnets on GHA.

For context:

  • as a part of porting infra_up I've ran into errors related to lock ownership
  • in particular $SPLICE_ROOT/build-tools/approved-by.sh could not execute as the job did not have CCI token (and it does not make sense under GHA anyway)
  • from a quick search it seems that the logic cannot really be replicated 1:1 under GHA as deployments don't have a direct API for this (unless we're speaking about approval from forks, than we have this endpoint)
  • the closest thing would be a github actor (if we're talking about running workflows from GHA UI) or maybe custom deployment protection rule

Solution:

  • since we're running those jobs manually anyway we can for sure just use GITHUB_ACTOR (or GITHUB_TRIGGERING_ACTOR)
  • later on I'll change cluster_test (and others) to just print the cli command needed to run the workflow without doing any magic underneath which will be both simpler to understand and simpler to run
  • CIRCLECI is always populated by CCI as you can see here, so no functionality is lost - tested with cluster_test on CCI side ✅

Refs:

Signed-off-by: krzysztofczyz-da <krzysztof.czyz@digitalasset.com>
@krzysztofczyz-da krzysztofczyz-da force-pushed the kczyz/infra-runner-setup branch from 50da662 to 1d28435 Compare May 26, 2026 07:12
@krzysztofczyz-da krzysztofczyz-da added the static Used to label PRs for which static tests suffice label May 28, 2026
Signed-off-by: krzysztofczyz-da <krzysztof.czyz@digitalasset.com>
@krzysztofczyz-da
Copy link
Copy Markdown
Contributor Author

/cluster_test

@github-actions
Copy link
Copy Markdown

Deploy cluster test triggered for Commit f70c859cbbc87ff505b13cfa71ce01974573ae34 in , please contact a Contributor to approve it in CircleCI: https://app.circleci.com/pipelines/github/DACH-NY/canton-network-internal/67311

@krzysztofczyz-da krzysztofczyz-da changed the title Make sure that we can run CI on infra teams' runners Make sure that we can run locking on GitHub Actions May 28, 2026
Copy link
Copy Markdown
Contributor

@martinflorian-da martinflorian-da left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks reasonable, thank you!

Comment thread build-tools/cncluster
# Check lock for CI...
if ! approver=$( "$SPLICE_ROOT/build-tools/approved-by.sh" ); then
_error "Could not determine approver for CI workflow"
approver=""
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: consider making this local

Comment thread build-tools/cncluster Outdated
Co-authored-by: Martin Florian <martin.florian@digitalasset.com>
Signed-off-by: krzysztofczyz-da <krzysztof.czyz@digitalasset.com>
@krzysztofczyz-da krzysztofczyz-da merged commit 3223f8d into main Jun 1, 2026
46 checks passed
@krzysztofczyz-da krzysztofczyz-da deleted the kczyz/infra-runner-setup branch June 1, 2026 09:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

static Used to label PRs for which static tests suffice

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants