Skip to content

Commit 3c826da

Browse files
gontzessgontzess
authored
fix: host regression workflow locally to avoid private repo resolution (#58)
## Summary - Copy regression.yml from baton-regression into this repo - Update verify.yaml to reference it locally (`./.github/workflows/regression.yaml`) instead of cross-repo (`ConductorOne/baton-regression/...@main`) ## Context GitHub Actions cannot resolve nested reusable workflow references to private repos at startup time, even with `access_level: "organization"`. This caused `startup_failure` / 0-job failures on every connector with regression enabled. Hosting the workflow file here (public repo) eliminates the resolution issue. The workflow still checks out baton-regression source from main at runtime using `RELENG_GITHUB_TOKEN`. ## Test plan - [ ] After merge, update v4 tag - [x] Re-run verify on baton-mysql — regression job should start and attempt to build baton-regression <img width="1128" height="1130" alt="Screenshot 2026-03-03 at 14 34 12" src="https://github.com/user-attachments/assets/8670eb03-94d6-4dc2-ac63-9aceb75f7cb8" />
1 parent a4d1ea4 commit 3c826da

File tree

3 files changed

+212
-3
lines changed

3 files changed

+212
-3
lines changed

‎.github/workflows/regression.yaml‎

Lines changed: 209 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,209 @@
1+
name: Connector Regression
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
connector:
7+
description: 'Connector name (e.g., okta, github, slack)'
8+
required: true
9+
type: string
10+
connector-ref:
11+
description: 'Git ref of the connector to test'
12+
required: false
13+
type: string
14+
default: ''
15+
connector-repo:
16+
description: 'Repository containing the connector (defaults to caller)'
17+
required: false
18+
type: string
19+
default: ''
20+
max-probes:
21+
description: 'Maximum verification probes'
22+
required: false
23+
type: number
24+
default: 100
25+
skip-nilcheck:
26+
description: 'Skip static nil pointer analysis'
27+
required: false
28+
type: boolean
29+
default: false
30+
verbose:
31+
description: 'Enable verbose output'
32+
required: false
33+
type: boolean
34+
default: false
35+
secrets:
36+
RELENG_GITHUB_TOKEN:
37+
description: 'GitHub token with access to private ConductorOne repos'
38+
required: false
39+
outputs:
40+
status:
41+
description: 'Verification status (pass/fail)'
42+
value: ${{ jobs.verify.outputs.status }}
43+
axiom-coverage:
44+
description: 'Axiom coverage achieved'
45+
value: ${{ jobs.verify.outputs.axiom-coverage }}
46+
branch-coverage:
47+
description: 'Branch coverage achieved'
48+
value: ${{ jobs.verify.outputs.branch-coverage }}
49+
50+
jobs:
51+
verify:
52+
name: Verify ${{ inputs.connector }}
53+
runs-on: ubuntu-latest
54+
outputs:
55+
status: ${{ steps.verify.outputs.status }}
56+
axiom-coverage: ${{ steps.verify.outputs.axiom-coverage }}
57+
branch-coverage: ${{ steps.verify.outputs.branch-coverage }}
58+
59+
steps:
60+
- name: Checkout baton-regression
61+
uses: actions/checkout@v4
62+
with:
63+
repository: ConductorOne/baton-regression
64+
token: ${{ secrets.RELENG_GITHUB_TOKEN || github.token }}
65+
path: baton-regression
66+
67+
- name: Checkout connector
68+
uses: actions/checkout@v4
69+
with:
70+
repository: ${{ inputs.connector-repo || github.repository }}
71+
ref: ${{ inputs.connector-ref || github.sha }}
72+
path: connector
73+
74+
- name: Set up Go
75+
uses: actions/setup-go@v5
76+
with:
77+
go-version-file: baton-regression/go.mod
78+
cache-dependency-path: |
79+
baton-regression/go.sum
80+
connector/go.sum
81+
82+
- name: Build baton-regression
83+
working-directory: baton-regression
84+
run: |
85+
go build -tags "sqlmock,satsolver" \
86+
-o bin/baton-regression \
87+
./cmd/baton-regression
88+
89+
- name: Build connector
90+
working-directory: connector
91+
run: |
92+
CONNECTOR_NAME="${{ inputs.connector }}"
93+
# Handle both "okta" and "baton-okta" formats
94+
if [[ ! "$CONNECTOR_NAME" =~ ^baton- ]]; then
95+
BINARY_NAME="baton-$CONNECTOR_NAME"
96+
else
97+
BINARY_NAME="$CONNECTOR_NAME"
98+
fi
99+
go build -o ../baton-regression/bin/$BINARY_NAME ./cmd/$BINARY_NAME
100+
101+
- name: Run verification
102+
id: verify
103+
working-directory: baton-regression
104+
run: |
105+
set +e
106+
107+
CONNECTOR_NAME="${{ inputs.connector }}"
108+
# Normalize connector name (remove baton- prefix for config lookup)
109+
if [[ "$CONNECTOR_NAME" =~ ^baton- ]]; then
110+
CONFIG_NAME="${CONNECTOR_NAME#baton-}"
111+
else
112+
CONFIG_NAME="$CONNECTOR_NAME"
113+
fi
114+
115+
BINARY_NAME="baton-$CONFIG_NAME"
116+
117+
ARGS="--binary ./bin/$BINARY_NAME"
118+
ARGS="$ARGS --source ../connector"
119+
ARGS="$ARGS --max-probes ${{ inputs.max-probes }}"
120+
121+
if [ "${{ inputs.verbose }}" = "true" ]; then
122+
ARGS="$ARGS -v"
123+
fi
124+
125+
echo "Running: ./bin/baton-regression verify $CONFIG_NAME $ARGS"
126+
./bin/baton-regression verify $CONFIG_NAME $ARGS 2>&1 | tee ./reports/verification.log
127+
EXIT_CODE=${PIPESTATUS[0]}
128+
129+
# Parse results from log
130+
if grep -q "Verification PASSED" ./reports/verification.log; then
131+
STATUS="pass"
132+
else
133+
STATUS="fail"
134+
fi
135+
136+
# Extract coverage from log
137+
AXIOM_COV=$(grep -oP 'Axiom Coverage: \K[\d.]+' ./reports/verification.log | tail -1 || echo "0")
138+
BRANCH_COV=$(grep -oP 'Branch Coverage: \K[\d.]+' ./reports/verification.log | tail -1 || echo "0")
139+
140+
echo "status=$STATUS" >> $GITHUB_OUTPUT
141+
echo "axiom-coverage=$AXIOM_COV" >> $GITHUB_OUTPUT
142+
echo "branch-coverage=$BRANCH_COV" >> $GITHUB_OUTPUT
143+
144+
exit $EXIT_CODE
145+
146+
- name: Run nil pointer analysis
147+
id: nilcheck
148+
if: ${{ !inputs.skip-nilcheck }}
149+
working-directory: baton-regression
150+
run: |
151+
set +e
152+
153+
CONNECTOR_NAME="${{ inputs.connector }}"
154+
if [[ "$CONNECTOR_NAME" =~ ^baton- ]]; then
155+
CONFIG_NAME="${CONNECTOR_NAME#baton-}"
156+
else
157+
CONFIG_NAME="$CONNECTOR_NAME"
158+
fi
159+
160+
./bin/baton-regression batch-nilcheck \
161+
-connector $CONFIG_NAME \
162+
-verbose > ./reports/nilcheck.log 2>&1
163+
164+
# Count warnings
165+
WARNINGS=$(grep -c "\[WARN\]" ./reports/nilcheck.log || echo "0")
166+
echo "Nil check found $WARNINGS connectors with warnings"
167+
168+
# Don't fail on nilcheck warnings - just report them
169+
exit 0
170+
171+
- name: Upload reports
172+
if: always()
173+
uses: actions/upload-artifact@v4
174+
with:
175+
name: verification-report-${{ inputs.connector }}
176+
path: |
177+
baton-regression/reports/verification.log
178+
baton-regression/reports/nilcheck.log
179+
retention-days: 30
180+
181+
- name: Post summary
182+
if: always()
183+
working-directory: baton-regression
184+
run: |
185+
echo "## Verification Results: ${{ inputs.connector }}" >> $GITHUB_STEP_SUMMARY
186+
echo "" >> $GITHUB_STEP_SUMMARY
187+
188+
STATUS="${{ steps.verify.outputs.status }}"
189+
AXIOM_COV="${{ steps.verify.outputs.axiom-coverage }}"
190+
BRANCH_COV="${{ steps.verify.outputs.branch-coverage }}"
191+
192+
if [ "$STATUS" = "pass" ]; then
193+
echo "**Status:** :white_check_mark: PASS" >> $GITHUB_STEP_SUMMARY
194+
else
195+
echo "**Status:** :x: FAIL" >> $GITHUB_STEP_SUMMARY
196+
fi
197+
198+
echo "**Axiom Coverage:** ${AXIOM_COV}%" >> $GITHUB_STEP_SUMMARY
199+
echo "**Branch Coverage:** ${BRANCH_COV}%" >> $GITHUB_STEP_SUMMARY
200+
echo "" >> $GITHUB_STEP_SUMMARY
201+
202+
# Add nilcheck summary if available
203+
if [ -f ./reports/nilcheck.log ]; then
204+
WARNINGS=$(grep -c "\[WARN\]" ./reports/nilcheck.log || echo "0")
205+
CLEAN=$(grep -c "\[CLEAN\]" ./reports/nilcheck.log || echo "0")
206+
echo "### Static Analysis (Nil Check)" >> $GITHUB_STEP_SUMMARY
207+
echo "- Clean: $CLEAN" >> $GITHUB_STEP_SUMMARY
208+
echo "- Warnings: $WARNINGS" >> $GITHUB_STEP_SUMMARY
209+
fi

‎.github/workflows/verify.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ jobs:
8181
test-results: test.json
8282
regression:
8383
if: inputs.connector != ''
84-
uses: ConductorOne/baton-regression/.github/workflows/regression.yml@main
84+
uses: ./.github/workflows/regression.yaml
8585
with:
8686
connector: ${{ inputs.connector }}
8787
secrets:

‎docs/verify-workflow.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ Runs `go test -v -covermode=count -json ./...` and annotates results. Skipped if
2222

2323
### regression
2424

25-
Calls the [baton-regression](https://github.com/ConductorOne/baton-regression) reusable workflow when `connector` is non-empty. The regression workflow:
25+
Runs the [baton-regression](https://github.com/ConductorOne/baton-regression) verification when `connector` is non-empty. The workflow is hosted in this repo but checks out baton-regression source from main at runtime. The regression job:
2626

2727
1. Checks out baton-regression and the connector repo
2828
2. Builds both the regression tool and the connector binary
@@ -31,7 +31,7 @@ Calls the [baton-regression](https://github.com/ConductorOne/baton-regression) r
3131
5. Uploads verification reports as artifacts
3232
6. Posts a summary with coverage metrics
3333

34-
The regression job requires `RELENG_GITHUB_TOKEN` to be passed from the caller workflow for private repo access.
34+
The regression job requires `RELENG_GITHUB_TOKEN` to be passed from the caller workflow to check out the private baton-regression repo.
3535

3636
## Inputs
3737

0 commit comments

Comments
 (0)