[CI] Gate /rerun-test on commenter trust and remove /rerun-stage (#35750)
This commit is contained in:
Liangsheng Yin
File diff suppressed because it is too large
Load Diff
@@ -8,5 +8,27 @@ This folder contains tools and workflows for automating maintenance tasks.
|
||||
Maintainers can directly edit the file to add entries with `"reason": "custom override"`.
|
||||
Maintainers can also run `update_ci_permission.py` to update it with some auto rules (e.g., top contributors in the last 90 days get full permissions).
|
||||
|
||||
Recognized permission keys:
|
||||
|
||||
| Key | Grants |
|
||||
| --- | --- |
|
||||
| `can_tag_run_ci_label` | `/tag-run-ci-label`, `/tag-and-rerun-ci` |
|
||||
| `can_rerun_failed_ci` | `/rerun-failed-ci`, `/tag-and-rerun-ci` |
|
||||
| `cooldown_interval_minutes` | rate limit in `pr-gate.yml`; `0` also grants `/rerun-test`, `/rerun-group` |
|
||||
|
||||
`/rerun-test` and `/rerun-group` are gated on the commenter alone: either
|
||||
`cooldown_interval_minutes: 0`, or `write`/`admin` permission on the repo. Where
|
||||
the PR comes from makes no difference, and authoring it grants nothing.
|
||||
|
||||
Those are the same two signals `pr-gate.yml` already uses to waive its rate
|
||||
limit, and that is the point -- a selective rerun dispatches `rerun-test.yml`
|
||||
directly, which never passes through `pr-gate.yml`, so it bypasses the rate limit
|
||||
by construction. Anyone allowed to run one is therefore unthrottled in practice,
|
||||
which is exactly what a zero cooldown already declares.
|
||||
|
||||
Set a cooldown deliberately: `0` lets the holder run PR-head code on the
|
||||
self-hosted GPU runners, and raising it above `0` takes that away again along
|
||||
with their rate-limit waiver.
|
||||
|
||||
## Others
|
||||
- `MAINTAINER.md` defines the code maintenance model.
|
||||
|
||||
@@ -35,6 +35,9 @@ Permissions are assigned according to the following rules:
|
||||
- For all other cases, preserve the original configuration unchanged.
|
||||
3. All other users receive no permissions and a 120-minute cooldown (they are omitted from the file).
|
||||
|
||||
`cooldown_interval_minutes` is not only a rate limit: 0 also authorizes
|
||||
`/rerun-test` and `/rerun-group`, which never pass through `pr-gate.yml`.
|
||||
|
||||
Usage:
|
||||
export GH_TOKEN="your_github_token"
|
||||
python3 update_ci_permission.py
|
||||
@@ -203,7 +206,6 @@ def main():
|
||||
new_permissions[user] = {
|
||||
"can_tag_run_ci_label": True,
|
||||
"can_rerun_failed_ci": True,
|
||||
"can_rerun_stage": True,
|
||||
"cooldown_interval_minutes": 0,
|
||||
"reason": "top contributor",
|
||||
}
|
||||
@@ -221,7 +223,6 @@ def main():
|
||||
new_permissions[user] = {
|
||||
"can_tag_run_ci_label": True,
|
||||
"can_rerun_failed_ci": True,
|
||||
"can_rerun_stage": True,
|
||||
"cooldown_interval_minutes": 60,
|
||||
"reason": "custom override",
|
||||
}
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
name: PR Test ROCm 7.2 (AMD)
|
||||
# Dynamic run-name for /rerun-stage commands to enable URL lookup
|
||||
# Dynamic run-name for manual stage dispatches to enable URL lookup
|
||||
# Format: "[stage-name] sha" for fork PRs, "[stage-name]" for non-fork, default for normal runs
|
||||
run-name: ${{ (inputs.target_stage || inputs.target_stage_select) && (inputs.pr_head_sha && format('[{0}] {1}', inputs.target_stage || inputs.target_stage_select, inputs.pr_head_sha) || format('[{0}]', inputs.target_stage || inputs.target_stage_select)) || '' }}
|
||||
|
||||
@@ -56,7 +56,7 @@ on:
|
||||
type: string
|
||||
default: ""
|
||||
pr_head_sha:
|
||||
description: "PR head SHA to checkout (for /rerun-stage on fork PRs)"
|
||||
description: "PR head SHA to checkout (for stage dispatches on fork PRs)"
|
||||
required: false
|
||||
type: string
|
||||
default: ""
|
||||
@@ -239,7 +239,7 @@ jobs:
|
||||
# pr-test.yml's `call-pr-test-extra`. On `schedule` (and run_all_tests
|
||||
# dispatch) the extra suite runs on `main` without needing the
|
||||
# `run-ci-extra` label (pr-gate.yml only enforces labels on pull_request
|
||||
# events). Targeted /rerun-stage dispatches (target_stage set) are excluded.
|
||||
# events). Targeted stage dispatches (target_stage set) are excluded.
|
||||
# Not added to `pr-test-amd-rocm720-finish` so the base AMD gate never depends on
|
||||
# the opt-in extra suite.
|
||||
call-pr-test-amd-extra-rocm720:
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
name: PR Test ROCm 7.0 (AMD)
|
||||
# Dynamic run-name for /rerun-stage commands to enable URL lookup
|
||||
# Dynamic run-name for manual stage dispatches to enable URL lookup
|
||||
# Format: "[stage-name] sha" for fork PRs, "[stage-name]" for non-fork, default for normal runs
|
||||
run-name: ${{ (inputs.target_stage || inputs.target_stage_select) && (inputs.pr_head_sha && format('[{0}] {1}', inputs.target_stage || inputs.target_stage_select, inputs.pr_head_sha) || format('[{0}]', inputs.target_stage || inputs.target_stage_select)) || '' }}
|
||||
|
||||
@@ -43,7 +43,7 @@ on:
|
||||
type: string
|
||||
default: ""
|
||||
pr_head_sha:
|
||||
description: "PR head SHA to checkout (for /rerun-stage on fork PRs)"
|
||||
description: "PR head SHA to checkout (for stage dispatches on fork PRs)"
|
||||
required: false
|
||||
type: string
|
||||
default: ""
|
||||
@@ -209,7 +209,7 @@ jobs:
|
||||
# pr-test.yml's `call-pr-test-extra`. On `schedule` (and run_all_tests
|
||||
# dispatch) the extra suite runs on `main` without needing the
|
||||
# `run-ci-extra` label (pr-gate.yml only enforces labels on pull_request
|
||||
# events). Targeted /rerun-stage dispatches (target_stage set) are excluded.
|
||||
# events). Targeted stage dispatches (target_stage set) are excluded.
|
||||
# Not added to `pr-test-amd-finish` so the base AMD gate never depends on
|
||||
# the opt-in extra suite.
|
||||
call-pr-test-amd-extra:
|
||||
|
||||
@@ -72,8 +72,9 @@ env:
|
||||
# every run, so a rerun holding the write token could become everyone's next
|
||||
# comparison baseline. Without the repo var it fails fast instead.
|
||||
|
||||
# Every job below sets its own `permissions`, which replaces rather than merges
|
||||
# with a workflow-level block -- so keep the floor here minimal and grant per job.
|
||||
permissions:
|
||||
actions: write
|
||||
contents: read
|
||||
issues: read
|
||||
|
||||
@@ -93,6 +94,9 @@ jobs:
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
ref: ${{ inputs.pr_head_sha || github.sha }}
|
||||
# This checkout can hold a fork's code that the steps below execute;
|
||||
# without this the job token stays in .git/config, readable by it.
|
||||
persist-credentials: false
|
||||
|
||||
- name: Mark runner picked up
|
||||
if: inputs.reply_comment_id != '' && inputs.reply_marker != ''
|
||||
@@ -188,6 +192,9 @@ jobs:
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
ref: ${{ inputs.pr_head_sha || github.sha }}
|
||||
# This checkout can hold a fork's code that the steps below execute;
|
||||
# without this the job token stays in .git/config, readable by it.
|
||||
persist-credentials: false
|
||||
|
||||
- name: Mark runner picked up
|
||||
if: inputs.reply_comment_id != '' && inputs.reply_marker != ''
|
||||
@@ -262,6 +269,9 @@ jobs:
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
ref: ${{ inputs.pr_head_sha || github.sha }}
|
||||
# This checkout can hold a fork's code that the steps below execute;
|
||||
# without this the job token stays in .git/config, readable by it.
|
||||
persist-credentials: false
|
||||
|
||||
- name: Mark runner picked up
|
||||
if: inputs.reply_comment_id != '' && inputs.reply_marker != ''
|
||||
|
||||
@@ -19,7 +19,6 @@ jobs:
|
||||
(contains(github.event.comment.body, '/tag-run-ci-label') ||
|
||||
contains(github.event.comment.body, '/rerun-failed-ci') ||
|
||||
contains(github.event.comment.body, '/tag-and-rerun-ci') ||
|
||||
contains(github.event.comment.body, '/rerun-stage') ||
|
||||
contains(github.event.comment.body, '/rerun-group') ||
|
||||
contains(github.event.comment.body, '/rerun-test'))
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
Reference in New Issue
Block a user