Skip to content

Commit 74985fe

Browse files
LauraBeatrisLauraBeatris
authored
chore(repo): Add workflow to approve integration tests for fork PRs (clerk#4482)
1 parent 9bd8645 commit 74985fe

3 files changed

Lines changed: 101 additions & 0 deletions

File tree

‎.changeset/odd-colts-sing.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
---
2+
---

‎.github/workflows/ci.yml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,11 @@ name: CI
22

33
on:
44
workflow_dispatch:
5+
inputs:
6+
run_integration_tests:
7+
description: 'Run integration tests'
8+
type: boolean
9+
default: false
510
merge_group:
611
pull_request:
712
branches:
@@ -133,6 +138,10 @@ jobs:
133138

134139
integration-tests:
135140
name: Integration Tests
141+
# Skip for fork PRs to prevent security vulnerabilities (no secrets)
142+
# Runs if it comes from the root repo or once it gets approved by a maintainer
143+
if: |
144+
github.event.inputs.run_integration_tests == 'true' || github.event.pull_request.head.repo.full_name == github.repository
136145
needs: formatting-linting
137146
runs-on: ${{ vars.RUNNER_LARGE || 'ubuntu-latest-l' }}
138147
timeout-minutes: ${{ vars.TIMEOUT_MINUTES_LONG && fromJSON(vars.TIMEOUT_MINUTES_LONG) || 15 }}

‎.github/workflows/run-integration-tests.yml‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
# This workflow exists as a security measure for handling fork PRs.
2+
# Since GitHub doesn't share repository secrets with fork PRs (for security),
3+
# this workflow acts as a manual approval mechanism where Clerk org members can
4+
# trigger integration tests on fork PRs by commenting '!run-integration-tests'
5+
name: Run Integration Tests
6+
run-name: Executed by ${{ github.actor }}
7+
8+
on:
9+
issue_comment:
10+
types: [created]
11+
12+
concurrency:
13+
group: ${{ github.workflow }}-${{ github.ref }}-${{ github.actor }}
14+
cancel-in-progress: true
15+
16+
jobs:
17+
run-tests:
18+
if: ${{ startsWith(github.event.comment.body, '!run-integration-tests') && github.repository == 'clerk/javascript' && github.event.issue.pull_request }}
19+
runs-on: ${{ vars.RUNNER_LARGE || 'ubuntu-latest-l' }}
20+
timeout-minutes: ${{ vars.TIMEOUT_MINUTES_NORMAL && fromJSON(vars.TIMEOUT_MINUTES_NORMAL) || 10 }}
21+
22+
permissions:
23+
contents: read
24+
id-token: write
25+
26+
steps:
27+
- name: Limit action to Clerk members
28+
uses: actions/github-script@v7
29+
with:
30+
result-encoding: string
31+
retries: 3
32+
retry-exempt-status-codes: 400,401
33+
github-token: ${{ secrets.CLERK_COOKIE_PAT }}
34+
script: |
35+
const isMember = await github.rest.orgs.checkMembershipForUser({
36+
org: 'clerk',
37+
username: context.actor
38+
});
39+
if (!isMember) {
40+
core.setFailed(`@${actor} is not a member of the Clerk organization`);
41+
}
42+
43+
- name: Checkout repo
44+
uses: actions/checkout@v4
45+
with:
46+
ref: refs/pull/${{ github.event.issue.number }}/head
47+
48+
- name: Ensure the PR hasn't changed since initiating the !run-integration-tests command
49+
uses: actions/github-script@v7
50+
with:
51+
result-encoding: string
52+
retries: 3
53+
retry-exempt-status-codes: 400,401
54+
github-token: ${{ secrets.CLERK_COOKIE_PAT }}
55+
script: |
56+
const commentCreated = new Date(context.payload.comment.created_at);
57+
58+
const pr = await github.rest.pulls.get({
59+
owner: 'clerk',
60+
repo: 'javascript',
61+
pull_number: context.issue.number,
62+
});
63+
64+
const prLastUpdated = new Date(pr.updated_at);
65+
66+
if (prLastUpdated > commentCreated) {
67+
core.setFailed("The PR has been updated since !run-integration-tests was initiated. Please review the changes and re-run the !run-integration-tests command.");
68+
}
69+
70+
- name: Trigger Integration Tests
71+
uses: actions/github-script@v7
72+
with:
73+
github-token: ${{ secrets.CLERK_COOKIE_PAT }}
74+
script: |
75+
await github.rest.actions.createWorkflowDispatch({
76+
owner: 'clerk',
77+
repo: 'javascript',
78+
workflow_id: 'ci.yml',
79+
ref: context.payload.pull_request.head.ref,
80+
inputs: {
81+
run_integration_tests: 'true'
82+
}
83+
});
84+
85+
- name: Update Comment
86+
uses: peter-evans/create-or-update-comment@v3.0.0
87+
with:
88+
token: ${{ secrets.CLERK_COOKIE_PAT }}
89+
comment-id: ${{ github.event.comment.id }}
90+
reactions: heart

0 commit comments

Comments
 (0)