Skip to content

ci: do not run ci tests by default, require citest comment or label [citest_skip] #338

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
richm merged 1 commit into from
Sep 2, 2026
Merged

ci: do not run ci tests by default, require citest comment or label [citest_skip] #338

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
56 changes: 54 additions & 2 deletions .github/workflows/ansible-lint.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,13 @@
name: Ansible Lint
on: # yamllint disable-line rule:truthy
pull_request:
types:
- opened
- synchronize
- labeled
issue_comment:
types:
- created
merge_group:
branches:
- main
Expand All @@ -16,11 +23,43 @@ env:
LSR_ROLE2COLL_NAME: linux_system_roles
permissions:
contents: read
pull-requests: read
jobs:
ansible_lint:
if: |
!((github.event_name == 'pull_request' && contains(github.event.pull_request.title, '[citest_skip]')) ||
(github.event_name == 'push' && contains(github.event.head_commit.message, '[citest_skip]')))
(
github.event_name == 'issue_comment'
&& github.event.issue.pull_request
&& (contains(github.event.comment.body, '[citest_all]')
|| contains(github.event.comment.body, '[citest_ansible-lint]'))
&& (contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'),
github.event.comment.author_association)
|| github.event.comment.user.login == 'systemroller')
) || (
github.event_name == 'pull_request'
&& github.event.action == 'opened'
&& (contains(github.event.pull_request.labels.*.name, 'citest_all')
|| contains(github.event.pull_request.labels.*.name, 'citest_ansible-lint'))
&& (contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'),
github.event.pull_request.author_association)
|| github.event.pull_request.user.login == 'systemroller')
) || (
github.event_name == 'pull_request'
&& github.event.action == 'synchronize'
&& (contains(github.event.pull_request.labels.*.name, 'citest_all')
|| contains(github.event.pull_request.labels.*.name, 'citest_ansible-lint'))
&& (contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'),
github.event.pull_request.author_association)
|| github.event.sender.login == 'systemroller')
) || (
github.event_name == 'pull_request'
&& github.event.action == 'labeled'
&& (github.event.label.name == 'citest_all'
|| github.event.label.name == 'citest_ansible-lint')
&& (contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'),
github.event.pull_request.author_association)
|| github.event.sender.login == 'systemroller')
)
runs-on: ubuntu-latest
strategy:
fail-fast: false
Expand All @@ -38,10 +77,23 @@ jobs:
sudo apt update
sudo apt install -y git

- name: Get PR head SHA
if: github.event_name == 'issue_comment'
id: head_sha
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
REPO: ${{ github.repository }}
PR_NUMBER: ${{ github.event.issue.number }}
run: |
set -euxo pipefail
head_sha=$(gh api "repos/$REPO/pulls/$PR_NUMBER" --jq '.head.sha')
echo "head_sha=$head_sha" >> "$GITHUB_OUTPUT"

- name: Checkout repo
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
persist-credentials: false
ref: ${{ steps.head_sha.outputs.head_sha || github.sha }}

- name: Install tox, tox-lsr
run: |
Expand Down
56 changes: 54 additions & 2 deletions .github/workflows/ansible-managed-var-comment.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,13 @@
name: Check for ansible_managed variable use in comments
on: # yamllint disable-line rule:truthy
pull_request:
types:
- opened
- synchronize
- labeled
issue_comment:
types:
- created
merge_group:
branches:
- main
Expand All @@ -13,11 +20,43 @@ on: # yamllint disable-line rule:truthy
workflow_dispatch:
permissions:
contents: read
pull-requests: read
jobs:
ansible_managed_var_comment:
if: |
!((github.event_name == 'pull_request' && contains(github.event.pull_request.title, '[citest_skip]')) ||
(github.event_name == 'push' && contains(github.event.head_commit.message, '[citest_skip]')))
(
github.event_name == 'issue_comment'
&& github.event.issue.pull_request
&& (contains(github.event.comment.body, '[citest_all]')
|| contains(github.event.comment.body, '[citest_ansible-managed-var-comment]'))
&& (contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'),
github.event.comment.author_association)
|| github.event.comment.user.login == 'systemroller')
) || (
github.event_name == 'pull_request'
&& github.event.action == 'opened'
&& (contains(github.event.pull_request.labels.*.name, 'citest_all')
|| contains(github.event.pull_request.labels.*.name, 'citest_ansible-managed-var-comment'))
&& (contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'),
github.event.pull_request.author_association)
|| github.event.pull_request.user.login == 'systemroller')
) || (
github.event_name == 'pull_request'
&& github.event.action == 'synchronize'
&& (contains(github.event.pull_request.labels.*.name, 'citest_all')
|| contains(github.event.pull_request.labels.*.name, 'citest_ansible-managed-var-comment'))
&& (contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'),
github.event.pull_request.author_association)
|| github.event.sender.login == 'systemroller')
) || (
github.event_name == 'pull_request'
&& github.event.action == 'labeled'
&& (github.event.label.name == 'citest_all'
|| github.event.label.name == 'citest_ansible-managed-var-comment')
&& (contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'),
github.event.pull_request.author_association)
|| github.event.sender.login == 'systemroller')
)
runs-on: ubuntu-latest
steps:
- name: Update pip, git
Expand All @@ -27,10 +66,23 @@ jobs:
sudo apt update
sudo apt install -y git

- name: Get PR head SHA
if: github.event_name == 'issue_comment'
id: head_sha
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
REPO: ${{ github.repository }}
PR_NUMBER: ${{ github.event.issue.number }}
run: |
set -euxo pipefail
head_sha=$(gh api "repos/$REPO/pulls/$PR_NUMBER" --jq '.head.sha')
echo "head_sha=$head_sha" >> "$GITHUB_OUTPUT"

- name: Checkout repo
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
persist-credentials: false
ref: ${{ steps.head_sha.outputs.head_sha || github.sha }}

- name: Install tox, tox-lsr
run: |
Expand Down
56 changes: 54 additions & 2 deletions .github/workflows/ansible-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,13 @@
name: Ansible Test
on: # yamllint disable-line rule:truthy
pull_request:
types:
- opened
- synchronize
- labeled
issue_comment:
types:
- created
merge_group:
branches:
- main
Expand All @@ -16,11 +23,43 @@ env:
LSR_ROLE2COLL_NAME: linux_system_roles
permissions:
contents: read
pull-requests: read
jobs:
ansible_test:
if: |
!((github.event_name == 'pull_request' && contains(github.event.pull_request.title, '[citest_skip]')) ||
(github.event_name == 'push' && contains(github.event.head_commit.message, '[citest_skip]')))
(
github.event_name == 'issue_comment'
&& github.event.issue.pull_request
&& (contains(github.event.comment.body, '[citest_all]')
|| contains(github.event.comment.body, '[citest_ansible-test]'))
&& (contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'),
github.event.comment.author_association)
|| github.event.comment.user.login == 'systemroller')
) || (
github.event_name == 'pull_request'
&& github.event.action == 'opened'
&& (contains(github.event.pull_request.labels.*.name, 'citest_all')
|| contains(github.event.pull_request.labels.*.name, 'citest_ansible-test'))
&& (contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'),
github.event.pull_request.author_association)
|| github.event.pull_request.user.login == 'systemroller')
) || (
github.event_name == 'pull_request'
&& github.event.action == 'synchronize'
&& (contains(github.event.pull_request.labels.*.name, 'citest_all')
|| contains(github.event.pull_request.labels.*.name, 'citest_ansible-test'))
&& (contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'),
github.event.pull_request.author_association)
|| github.event.sender.login == 'systemroller')
) || (
github.event_name == 'pull_request'
&& github.event.action == 'labeled'
&& (github.event.label.name == 'citest_all'
|| github.event.label.name == 'citest_ansible-test')
&& (contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'),
github.event.pull_request.author_association)
|| github.event.sender.login == 'systemroller')
)
runs-on: ubuntu-latest
strategy:
fail-fast: false # get all results, not just the first failure
Expand All @@ -41,10 +80,23 @@ jobs:
sudo apt update
sudo apt install -y git

- name: Get PR head SHA
if: github.event_name == 'issue_comment'
id: head_sha
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
REPO: ${{ github.repository }}
PR_NUMBER: ${{ github.event.issue.number }}
run: |
set -euxo pipefail
head_sha=$(gh api "repos/$REPO/pulls/$PR_NUMBER" --jq '.head.sha')
echo "head_sha=$head_sha" >> "$GITHUB_OUTPUT"

- name: Checkout repo
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
persist-credentials: false
ref: ${{ steps.head_sha.outputs.head_sha || github.sha }}

- name: Install tox, tox-lsr
run: |
Expand Down
59 changes: 57 additions & 2 deletions .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,21 +5,63 @@ on: # yamllint disable-line rule:truthy
branches: ["main"]
pull_request:
branches: ["main"]
types:
- opened
- synchronize
- labeled
issue_comment:
types:
- created
merge_group:
branches:
- main
types:
- checks_requested
schedule:
- cron: 10 1 * * 4
permissions:
contents: read
pull-requests: read
jobs:
analyze:
if: |
!((github.event_name == 'pull_request' && contains(github.event.pull_request.title, '[citest_skip]')) ||
(github.event_name == 'push' && contains(github.event.head_commit.message, '[citest_skip]')))
(
github.event_name == 'issue_comment'
&& github.event.issue.pull_request
&& (contains(github.event.comment.body, '[citest_all]')
|| contains(github.event.comment.body, '[citest_codeql]'))
&& (contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'),
github.event.comment.author_association)
|| github.event.comment.user.login == 'systemroller')
) || (
github.event_name == 'pull_request'
&& github.event.action == 'opened'
&& (contains(github.event.pull_request.labels.*.name, 'citest_all')
|| contains(github.event.pull_request.labels.*.name, 'citest_codeql'))
&& (contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'),
github.event.pull_request.author_association)
|| github.event.pull_request.user.login == 'systemroller')
) || (
github.event_name == 'pull_request'
&& github.event.action == 'synchronize'
&& (contains(github.event.pull_request.labels.*.name, 'citest_all')
|| contains(github.event.pull_request.labels.*.name, 'citest_codeql'))
&& (contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'),
github.event.pull_request.author_association)
|| github.event.sender.login == 'systemroller')
) || (
github.event_name == 'pull_request'
&& github.event.action == 'labeled'
&& (github.event.label.name == 'citest_all'
|| github.event.label.name == 'citest_codeql')
&& (contains(fromJson('["OWNER", "MEMBER", "COLLABORATOR"]'),
github.event.pull_request.author_association)
|| github.event.sender.login == 'systemroller')
)
name: Analyze
runs-on: ubuntu-latest
permissions:
pull-requests: read
actions: read
contents: read
security-events: write
Expand All @@ -33,10 +75,23 @@ jobs:
set -euxo pipefail
sudo apt update
sudo apt install -y git
- name: Get PR head SHA
if: github.event_name == 'issue_comment'
id: head_sha
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
REPO: ${{ github.repository }}
PR_NUMBER: ${{ github.event.issue.number }}
run: |
set -euxo pipefail
head_sha=$(gh api "repos/$REPO/pulls/$PR_NUMBER" --jq '.head.sha')
echo "head_sha=$head_sha" >> "$GITHUB_OUTPUT"

- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
persist-credentials: false
ref: ${{ steps.head_sha.outputs.head_sha || github.sha }}

- name: Initialize CodeQL
uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
Expand Down
Loading