Skip to content

fix(ci): grant actions:read and contents:read to E2E label helper #995

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pimlock merged 3 commits into from
Apr 28, 2026
Merged

fix(ci): grant actions:read and contents:read to E2E label helper #995

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
9c4d0b4
docs(ci): clarify E2E gate is no-op success when no label
pimlock Apr 27, 2026
35d6b1c
fix(ci): grant actions:read and contents:read to E2E label helper
pimlock Apr 27, 2026
cf4689a
fix(ci): include commit SHA in fallback E2E label-help comment
pimlock Apr 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 6 additions & 3 deletions .github/workflows/e2e-label-help.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,8 @@ jobs:
runs-on: ubuntu-latest
permissions:
pull-requests: write
actions: read
contents: read
steps:
- name: Post comment
env:
Expand Down Expand Up @@ -54,11 +56,12 @@ jobs:
run_id=$(gh api "repos/$GH_REPO/actions/workflows/$workflow_file/runs?head_sha=$PR_HEAD_SHA&event=push" \
--jq '.workflow_runs | sort_by(.created_at) | reverse | .[0].id // empty')
if [ -n "$run_id" ]; then
run_link="[the existing run](https://github.com/$GH_REPO/actions/runs/$run_id)"
instructions="Open [the existing run](https://github.com/$GH_REPO/actions/runs/$run_id) and click **Re-run all jobs** to execute with the label set."
else
run_link="[$workflow_name](https://github.com/$GH_REPO/actions/workflows/$workflow_file)"
workflow_link="[$workflow_name](https://github.com/$GH_REPO/actions/workflows/$workflow_file)"
instructions="Open $workflow_link, find the run for commit \`$short_pr\`, and click **Re-run all jobs** to execute with the label set."
fi
body="Label \`$LABEL_NAME\` applied for \`$short_pr\`. Open $run_link and click **Re-run all jobs** to execute with the label set. The \`E2E Gate\` check on this PR will flip green automatically once the run finishes."
body="Label \`$LABEL_NAME\` applied for \`$short_pr\`. $instructions The \`E2E Gate\` check on this PR will flip green automatically once the run finishes."
fi

gh pr comment "$PR_NUMBER" --body "$body"
2 changes: 1 addition & 1 deletion CI.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,7 +63,7 @@ Prerequisites:
Flow:

1. Open the PR. copy-pr-bot mirrors it to `pull-request/<N>` automatically.
2. The first push of `pull-request/<N>` runs `Branch E2E Checks`, but it skips the build/E2E jobs because no label is set yet. The PR's `E2E Gate` check stays neutral (no label, no requirement).
2. The first push of `pull-request/<N>` runs `Branch E2E Checks`, but it skips the build/E2E jobs because no label is set yet. The PR's `E2E Gate` check passes as a no-op (no label, no requirement).
3. A maintainer applies `test:e2e` and/or `test:e2e-gpu`. `E2E Label Help` posts a comment with a link to the existing `Branch E2E Checks` run.
4. The maintainer opens that link and clicks **Re-run all jobs**. This time `pr_metadata` sees the label and the build/E2E jobs run.
5. When the run finishes, the `E2E Gate` check on the PR flips to green automatically.
Expand Down
2 changes: 1 addition & 1 deletion architecture/ci-e2e.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -150,7 +150,7 @@ Every workflow declares `permissions: {}` at the top. Per-job grants are the min
| `e2e-gate.yml` | `e2e`, `gpu` (`workflow_call`) | inherits via the called workflow |
| | `rerun-on-completion` | `actions: write` |
| `e2e-gate-check.yml` | `check` | `contents: read`, `pull-requests: read`, `actions: read` |
| `e2e-label-help.yml` | `hint` | `pull-requests: write` |
| `e2e-label-help.yml` | `hint` | `pull-requests: write`, `actions: read`, `contents: read` |

The reusable worker workflows (`e2e-test.yml`, `e2e-gpu-test.yaml`, `docker-build.yml`) declare their own internal permissions; the calling job grants are an upper bound for them.

Expand Down
Loading