Skip to content

Internal Tests [ref=refs/pull/5687/merge] #4361

Internal Tests [ref=refs/pull/5687/merge]

Internal Tests [ref=refs/pull/5687/merge] #4361

# `SPACETIMEDB_PRIVATE_TOKEN` needs Actions read/write, Contents read, and Pull
# requests read access to clockworklabs/SpacetimeDBPrivate.
name: Internal Tests
on:
pull_request:
push:
branches:
- master
merge_group:
workflow_dispatch:
run-name: Internal Tests [ref=${{ github.ref }}]
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
permissions:
contents: read
pull-requests: read
jobs:
internal-tests:
name: Internal Tests
# Skip if not a PR or a push to master
# Skip if this is an external contribution. GitHub secrets will be empty, so the step would fail anyway.
if: ${{ (github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref == 'refs/heads/master'))
&& (github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork) }}
runs-on: ubuntu-latest
env:
TARGET_OWNER: clockworklabs
TARGET_REPO: SpacetimeDBPrivate
steps:
# Required for the path filter check below on non-PR commits (e.g. `master`)
- name: Checkout
uses: actions/checkout@v4
# Skip the private dispatch entirely when only `docs/` is touched. The job
# itself still completes successfully so required-status-check gating is
# satisfied without spending private-runner time on a docs-only change.
- name: Detect non-docs changes
id: filter
uses: dorny/paths-filter@v3
with:
filters: |
non_docs:
- '!docs/**'
- id: dispatch
name: Select or trigger tests
if: steps.filter.outputs.non_docs == 'true'
env:
CARGO_TARGET_DIR: ${{ runner.temp }}/internal-tests-cargo-target
GH_TOKEN: ${{ secrets.SPACETIMEDB_PRIVATE_TOKEN }}
PUBLIC_PR_NUMBER: ${{ github.event.pull_request.number }}
PUBLIC_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
run: |
set -euo pipefail
args=(--public-sha "$PUBLIC_SHA")
if [[ -n "$PUBLIC_PR_NUMBER" ]]; then
args+=(--public-pr-number "$PUBLIC_PR_NUMBER")
fi
cargo run --quiet \
--manifest-path tools/ci/Cargo.toml \
-- other-workflows coordinate-internal-tests "${args[@]}"
- name: Wait for Internal Tests to complete
if: steps.filter.outputs.non_docs == 'true'
env:
GH_TOKEN: ${{ secrets.SPACETIMEDB_PRIVATE_TOKEN }}
RUN_ID: ${{ steps.dispatch.outputs.run_id }}
RUN_URL: ${{ steps.dispatch.outputs.run_url }}
run: |
set -euo pipefail
echo "Waiting for workflow result... ${RUN_URL}"
set +e
# Due to our limited-scope token permissions, `gh run watch` spams errors about not being able to get annotations. They look worrying but they're benign, so we filter them out.
gh run watch "$RUN_ID" \
--repo "$TARGET_OWNER/$TARGET_REPO" \
--exit-status \
--interval 30 2>&1 \
| grep -Fv "requesting annotations returned 403 Forbidden as the token does not have sufficient permissions"
watch_status="${PIPESTATUS[0]}"
set -e
exit "$watch_status"
- name: Cancel invoked run if workflow cancelled
if: ${{ cancelled() && steps.dispatch.outputs.run_id && steps.dispatch.outputs.did_start == 'true' }}
uses: actions/github-script@v7
with:
github-token: ${{ secrets.SPACETIMEDB_PRIVATE_TOKEN }}
script: |
const targetOwner = process.env.TARGET_OWNER;
const targetRepo = process.env.TARGET_REPO;
const runId = Number(`${{ steps.dispatch.outputs.run_id }}`);
if (!runId) return;
await github.rest.actions.cancelWorkflowRun({
owner: targetOwner,
repo: targetRepo,
run_id: runId,
});