ci: add permission control for public ci tests#2397
ci: add permission control for public ci tests#2397yzh119 merged 9 commits intoflashinfer-ai:mainfrom
Conversation
|
Note Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported. |
📝 WalkthroughWalkthroughAdds three GitHub Actions workflows: a bot-driven PR command processor triggered by issue comments that authorizes ci-users to control CI, a PR label cleanup workflow that removes Changes
Sequence Diagram(s)sequenceDiagram
participant User as PR Commenter
participant GitHub as GitHub API
participant Workflow as CI-Bot Workflow
participant TeamAPI as GitHub Team API
participant CI as CI System
User->>GitHub: Post comment mentioning bot
GitHub->>Workflow: Trigger issue_comment event
Workflow->>Workflow: Verify PR context & bot mention
Workflow->>TeamAPI: Check ci-users membership
TeamAPI-->>Workflow: Member / Not member
alt Authorized
Workflow->>Workflow: Parse command (run / rerun / rerun-failed / stop)
alt run
Workflow->>GitHub: Add `run-ci` label
else rerun
Workflow->>CI: Rerun all workflows for PR commit
else rerun-failed
Workflow->>CI: Rerun failed workflows for PR commit
else stop
Workflow->>CI: Cancel in-progress/queued runs for PR commit
end
Workflow->>GitHub: Post thumbs-up reaction
else Unauthorized
Workflow->>GitHub: Post confused reaction
end
sequenceDiagram
participant GitHubEvents as GitHub Events
participant Gate as Gate Job
participant Setup as Setup Job
participant CIJobs as CI Jobs
participant Results as Test Results
GitHubEvents->>Gate: PR opened/synchronize/reopened/labeled or workflow_dispatch
Gate->>Gate: Check `run-ci` label and ci-users membership
Gate-->>Setup: Export `authorized` flag
alt Authorized
Gate->>Setup: Allow setup to run
Setup->>CIJobs: Trigger gated CI jobs (aot-build-import, gpu-tests-*)
CIJobs->>Results: Produce test results
else Unauthorized
Gate->>GitHubEvents: Post skip message on PR
Setup--xCIJobs: Skip (blocked by gate)
Results->>GitHubEvents: Indicate CI skipped
end
Estimated code review effort🎯 4 (Complex) | ⏱️ ~50 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In @.github/workflows/ci-bot-commands.yml:
- Around line 64-77: The Parse command step currently interpolates the untrusted
comment body directly into the shell (variable BODY="${{
github.event.comment.body }}"), enabling command injection; instead, stop inline
YAML interpolation and load the comment body from a safe environment or file
(e.g., set an env var or read/parsing from GITHUB_EVENT_PATH) and then perform
the grep checks against that safe variable; update the step named "Parse
command" (id: parse) to populate BODY from an environment variable or
JSON-parsed file before running the echo/grep comparisons so no untrusted
content is directly injected into the shell.
🧹 Nitpick comments (2)
.github/workflows/pr-test.yml (1)
117-120: Duplicate comment check may be fragile.The
grep -c "CI is paused"check could produce false positives if someone quotes this phrase in another comment. Consider using a more unique marker (e.g., an HTML comment like<!-- ci-skip-notice -->).Suggested improvement
- --jq '.comments[].body' | grep -c "CI is paused" || true) + --jq '.comments[].body' | grep -c "<!-- ci-gate-notice -->" || true) ... - --body "**CI is paused for external contributors.** + --body "<!-- ci-gate-notice --> +**CI is paused for external contributors.**.github/workflows/ci-bot-commands.yml (1)
148-160:RERUN_COUNTwon't reflect actual count due to subshell.The
while readloop runs in a subshell (due to the pipe), soRERUN_COUNTmodifications are lost. This is cosmetic since the counter isn't used afterward, but it's worth noting for future debugging.Fix using process substitution (if count is needed later)
# Rerun failed workflow runs for this commit RERUN_COUNT=0 - gh run list \ + while read -r run_id; do + if [ -n "$run_id" ]; then + echo "Rerunning failed jobs in workflow $run_id..." + gh run rerun "$run_id" --repo ${{ github.repository }} --failed || true + RERUN_COUNT=$((RERUN_COUNT + 1)) + fi + done < <(gh run list \ --repo ${{ github.repository }} \ --commit "$PR_SHA" \ --status failure \ - --json databaseId -q '.[].databaseId' | \ - while read -r run_id; do - if [ -n "$run_id" ]; then - echo "Rerunning failed jobs in workflow $run_id..." - gh run rerun "$run_id" --repo ${{ github.repository }} --failed || true - RERUN_COUNT=$((RERUN_COUNT + 1)) - fi - done + --json databaseId -q '.[].databaseId')
|
@yongwww can we test the functionality of the CI before it's merged? |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In @.github/workflows/ci-bot-commands.yml:
- Around line 113-123: The current gh run list pipeline filters out only
"in_progress" runs and can pass non-completed statuses (like "queued") to gh run
rerun; update the jq filter used with gh run list (the command around gh run
list --commit "$PR_SHA" --json databaseId,status -q '.[] | select(.status !=
"in_progress") | .databaseId') to explicitly select only completed runs (e.g.,
change to select(.status == "completed") or an equivalent check for
terminal/completed statuses) so gh run rerun is invoked only for completed runs;
keep the surrounding while read loop and gh run rerun invocation unchanged
except for this jq filter adjustment.
🧹 Nitpick comments (1)
.github/workflows/ci-bot-commands.yml (1)
27-62: Use the team membership endpoint to avoid listing all members.
Fetching all members can be slow and API-heavy for large teams. The membership endpoint is cheaper and avoids pagination.♻️ Proposed refactor
- # List team members and check if commenter is in the list - MEMBERS=$(gh api \ - -H "Accept: application/vnd.github+json" \ - -H "X-GitHub-Api-Version: 2022-11-28" \ - --paginate \ - "/orgs/${ORG}/teams/${TEAM}/members" \ - --jq '.[].login' 2>&1) || { - echo "::error::Failed to get team members: $MEMBERS" - echo "authorized=false" >> "$GITHUB_OUTPUT" - exit 0 - } - - if echo "$MEMBERS" | grep -qx "$ACTOR"; then + # Check membership directly + if gh api \ + -H "Accept: application/vnd.github+json" \ + -H "X-GitHub-Api-Version: 2022-11-28" \ + "/orgs/${ORG}/teams/${TEAM}/memberships/${ACTOR}" >/dev/null 2>&1; then echo "$ACTOR is a member of $TEAM" echo "authorized=true" >> "$GITHUB_OUTPUT" else - echo "$ACTOR is not a member of $TEAM" + echo "$ACTOR is not a member of $TEAM or membership check failed" echo "authorized=false" >> "$GITHUB_OUTPUT" fi
yongwww
force-pushed
the
ci_permission
branch
from
b9b6a24 to
a4e28f7
Compare
The |
2 participants
📌 Description
#2355
Add team-based permission control for the PR test workflow to manage CI costs.
gatejob to check authorization before running testsci-usersteam members run automaticallyrun-cilabel (via@flashinfer-bot runcommand from member of ci-users)ci-bot-commands.ymlfor handling bot commands:@flashinfer-bot run- trigger CI@flashinfer-bot rerun- rerun all jobs@flashinfer-bot rerun failed- rerun failed and cancelled jobspr-label-cleanup.ymlto auto-removerun-cilabel when external PRs receive new commits🔍 Related Issues
🚀 Pull Request Checklist
Thank you for contributing to FlashInfer! Before we review your pull request, please make sure the following items are complete.
✅ Pre-commit Checks
pre-commitby runningpip install pre-commit(or used your preferred method).pre-commit install.pre-commit run --all-filesand fixed any reported issues.🧪 Tests
unittest, etc.).Co-Authored-By: Kevin Vincent kvincent@nvidia.com
Reviewer Notes
Summary by CodeRabbit
New Features
Chores
Bug Fixes / Maintenance
✏️ Tip: You can customize this high-level summary in your review settings.