ci: refactor test setup#100
Open
reubenmiller wants to merge 2 commits into
Open
Conversation
Fork PRs cannot access repository secrets on the pull_request event, so the integration tests cannot run automatically for them. This workflow listens for a maintainer commenting /test on a PR and dispatches a repository_dispatch event (in the base-repo context, which has secret access) that triggers test.yaml against the fork's head commit. Requires a repo-scoped PAT stored as the COMMUNITY_ACTIONS_PAT secret; the default GITHUB_TOKEN cannot create repository_dispatch events. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Replace the pull_request_target + manual GitHub Environment approval setup with a fork-safe structure: - In-repo (maintainer) PRs run automatically on pull_request; fork PRs are skipped on that event and instead run via the /test slash command (repository_dispatch), so secrets are never exposed to untrusted code. - Split the single test job into a build job (builds the container bundle tar.gz artifacts once per tedge image and uploads them) and a test matrix that downloads the bundles and only builds the per-engine test infrastructure image. This avoids rebuilding the bundles in every one of the 14 matrix combinations. - Add a stable "Tests Pass" gate job for branch protection (matrix job names change; this single status does not). - Handle the checkout ref across all triggers (pull_request, repository_dispatch, workflow_dispatch, merge_group) and post the Robot Framework report back to the PR for both maintainer and /test runs. Supporting changes: - justfile: split build-test into build-test-bundles + build-test-image so the test job can build only the infra image. - tests/.python-version: pin the Python version via python-version-file. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
reubenmiller
temporarily deployed
to
Test Pull Request
GitHub Actions
Inactive
Robot Results
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Modernizes the CI test setup, applying the fork-safe pattern from thin-edge/tedge-apk-plugin#5. The dominant legacy pattern in this repo was the
pull_request_target+ manual GitHub Environment approval workflow; the per-testDeviceLibrary.Setup, parametrizedDockerfile, andjustfilewere already modern, so this PR focuses on the workflow.What changed
pull_request_target+ the manualapproveenvironment gate. In-repo (maintainer) PRs now run automatically onpull_request; fork PRs are skipped on that event and instead run only when a maintainer comments/test(newtest-slash-command.yaml→repository_dispatch). Secrets are never exposed to untrusted fork code.build→test→Tests Passshape. A newbuildjob builds the container-bundle*.tar.gzartifacts once pertedge/tedge-mainimage and uploads them. Thetestmatrix downloads the matching bundles and only builds the per-engine test-infrastructure image — avoiding a full bundle rebuild in each of the 14 matrix combinations.Tests Passjob that fails ifbuildor any matrixtestjob failed. Require this check in branch protection (matrix job names change; this one is stable).pull_request,repository_dispatch,workflow_dispatchwith arefinput,merge_group), and the Robot Framework report is posted back to the PR for both maintainer and/testruns.Supporting changes
justfile: splitbuild-testintobuild-test-bundles+build-test-imageso the test job can build only the infra image.tests/.python-version: pins Python viapython-version-file(replaces the hard-codedpython-version: '3.11').COMMUNITY_ACTIONS_PATsecret — a repo-scoped PAT. The defaultGITHUB_TOKENcannot createrepository_dispatchevents, so the/testslash command will not work without it.Tests Passstatus check (and drop the old per-matrixTest …checks).Notes
DeviceLibrary.Setup/Stop Device→Delete Managed Object And Device User), theTEDGE_IMAGE/TEDGE_TAG-parametrizedDockerfile, and thejustfile(no compose-demo targets) were already in the modern shape, so they are unchanged. The mixedSuite SetupvsTest Setupusage across suites is intentional (the operations/telemetry suites share device state across cases) and was left as-is.actionlintpasses (only a pre-existing SC2129 style nit on the.envredirects, carried over from the original workflow).🤖 Generated with Claude Code