|
| 1 | +name: PR Checks |
| 2 | +on: |
| 3 | + pull_request_target: |
| 4 | + branches: |
| 5 | + - "master*" |
| 6 | + |
| 7 | +concurrency: |
| 8 | + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.head_ref }} |
| 9 | + cancel-in-progress: true |
| 10 | + |
| 11 | +permissions: |
| 12 | + id-token: write # This is required for requesting the JWT |
| 13 | + |
| 14 | +jobs: |
| 15 | + collab-check: |
| 16 | + runs-on: ubuntu-latest |
| 17 | + outputs: |
| 18 | + approval-env: ${{ steps.collab-check.outputs.result }} |
| 19 | + steps: |
| 20 | + - name: Collaborator Check |
| 21 | + uses: actions/github-script@v7 |
| 22 | + id: collab-check |
| 23 | + with: |
| 24 | + github-token: ${{ secrets.COLLAB_CHECK_TOKEN }} |
| 25 | + result-encoding: string |
| 26 | + script: | |
| 27 | + try { |
| 28 | + const res = await github.rest.repos.checkCollaborator({ |
| 29 | + owner: context.repo.owner, |
| 30 | + repo: context.repo.repo, |
| 31 | + username: "${{ github.event.pull_request.user.login }}", |
| 32 | + }); |
| 33 | + console.log("Verifed ${{ github.event.pull_request.user.login }} is a repo collaborator. Auto Approving PR Checks.") |
| 34 | + return res.status == "204" ? "auto-approve" : "manual-approval" |
| 35 | + } catch (error) { |
| 36 | + console.log("${{ github.event.pull_request.user.login }} is not a collaborator. Requiring Manual Approval to run PR Checks.") |
| 37 | + return "manual-approval" |
| 38 | + } |
| 39 | + wait-for-approval: |
| 40 | + runs-on: ubuntu-latest |
| 41 | + needs: [collab-check] |
| 42 | + environment: ${{ needs.collab-check.outputs.approval-env }} |
| 43 | + steps: |
| 44 | + - run: echo "Workflow Approved! Starting PR Checks." |
| 45 | + codestyle-doc-tests: |
| 46 | + runs-on: ubuntu-latest |
| 47 | + needs: [wait-for-approval] |
| 48 | + steps: |
| 49 | + - name: Configure AWS Credentials |
| 50 | + uses: aws-actions/configure-aws-credentials@v4 |
| 51 | + with: |
| 52 | + role-to-assume: ${{ secrets.CI_AWS_ROLE_ARN }} |
| 53 | + aws-region: us-west-2 |
| 54 | + role-duration-seconds: 10800 |
| 55 | + - name: Run Codestyle & Doc Tests |
| 56 | + uses: aws-actions/aws-codebuild-run-build@v1 |
| 57 | + with: |
| 58 | + project-name: ${{ github.event.repository.name }}-ci-codestyle-doc-tests |
| 59 | + source-version-override: 'refs/pull/${{ github.event.pull_request.number }}/head^{${{ github.event.pull_request.head.sha }}}' |
| 60 | + unit-tests: |
| 61 | + runs-on: ubuntu-latest |
| 62 | + needs: [wait-for-approval] |
| 63 | + strategy: |
| 64 | + fail-fast: false |
| 65 | + matrix: |
| 66 | + python-version: ["py38","py39","py310","py311"] |
| 67 | + steps: |
| 68 | + - name: Configure AWS Credentials |
| 69 | + uses: aws-actions/configure-aws-credentials@v4 |
| 70 | + with: |
| 71 | + role-to-assume: ${{ secrets.CI_AWS_ROLE_ARN }} |
| 72 | + aws-region: us-west-2 |
| 73 | + role-duration-seconds: 10800 |
| 74 | + - name: Run Unit Tests |
| 75 | + uses: aws-actions/aws-codebuild-run-build@v1 |
| 76 | + with: |
| 77 | + project-name: ${{ github.event.repository.name }}-ci-unit-tests |
| 78 | + source-version-override: 'refs/pull/${{ github.event.pull_request.number }}/head^{${{ github.event.pull_request.head.sha }}}' |
| 79 | + env-vars-for-codebuild: | |
| 80 | + PY_VERSION |
| 81 | + env: |
| 82 | + PY_VERSION: ${{ matrix.python-version }} |
| 83 | + integ-tests: |
| 84 | + runs-on: ubuntu-latest |
| 85 | + needs: [wait-for-approval] |
| 86 | + steps: |
| 87 | + - name: Configure AWS Credentials |
| 88 | + uses: aws-actions/configure-aws-credentials@v4 |
| 89 | + with: |
| 90 | + role-to-assume: ${{ secrets.CI_AWS_ROLE_ARN }} |
| 91 | + aws-region: us-west-2 |
| 92 | + role-duration-seconds: 10800 |
| 93 | + - name: Run Integ Tests |
| 94 | + uses: aws-actions/aws-codebuild-run-build@v1 |
| 95 | + with: |
| 96 | + project-name: ${{ github.event.repository.name }}-ci-integ-tests |
| 97 | + source-version-override: 'refs/pull/${{ github.event.pull_request.number }}/head^{${{ github.event.pull_request.head.sha }}}' |
0 commit comments