sdk/.github/workflows/check-owners.yaml at main · kubeflow/sdk · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
name: "Check OWNERS"

on:
  pull_request:
    paths:
      - 'kubeflow/hub/OWNERS'
  workflow_dispatch:

permissions:
  contents: read

jobs:
  check-owners:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: yq - portable yaml processor
        uses: mikefarah/yq@v4

      - name: Check approvers against kubeflow-hub-team
        continue-on-error: true
        run: |
          # Extract approvers from OWNERS (excluding noqa lines)
          approvers=$(grep -v '# noqa(kubeflow-hub-team)' kubeflow/hub/OWNERS | yq eval '.approvers[]')

          # Fetch kubeflow-hub-team members
          hub_team=$(curl -s https://raw.githubusercontent.com/kubeflow/internal-acls/master/github-orgs/kubeflow/org.yaml | \
            yq '.orgs.kubeflow.teams.kubeflow-hub-team.members[]')

          echo -e "Approvers:\n$approvers\n"
          echo -e "kubeflow-hub-team:\n$hub_team\n"

          # Find approvers not in hub team
          missing=$(comm -23 <(echo "$approvers" | sort) <(echo "$hub_team" | sort))

          echo "Approvers NOT in kubeflow-hub-team:"
          echo "$missing"

          # Convert to space-separated for annotation
          missing=$(echo "$missing" | tr '\n' ' ' | xargs)

          # Annotate if there are missing approvers
          if [ -n "$missing" ]; then
            echo "::warning file=kubeflow/hub/OWNERS,line=1::Approvers not in kubeflow-hub-team: $missing"
          else
            echo "✅ All approvers are in kubeflow-hub-team!"
          fi

          # -------------------------------------------------------------------
          # Check if out of sync with model-registry/OWNERS (Base OWNERS)
          # -------------------------------------------------------------------

          echo "Checking sync with model-registry OWNERS..."
          local_owners_path="kubeflow/hub/OWNERS"
          remote_owners_url="https://raw.githubusercontent.com/kubeflow/model-registry/main/OWNERS"

          if ! diff -u "$local_owners_path" <(curl -s "$remote_owners_url"); then
            echo "❌ Error: OWNERS files out of sync for kubeflow hub!"
            exit 1
          else
            echo "✅ OWNERS files in sync for kubeflow hub!"
          fi


      - name: Ensure workflow success  # don't ever fail merging PR for this sanity check
        run: exit 0