Skip to content

Commit 1a3b2d7

Browse files
soonumsoonum
committed
chore(ci): extend external contribution to all pr workflows
User permission checking is done after the should-run, when there is such step, rather than before it. This way, only workflows that should run would fail id triggering actor is not allowed to launch it. Thus a repository maintainer would have to re-run only a handful of jobs that would effectively run afterward (i.e relevant code has changed and setup-instance would be called).
1 parent dbde7ad commit 1a3b2d7

29 files changed

+930
-187
lines changed

‎.github/workflows/aws_tfhe_backward_compat_tests.yml

Lines changed: 36 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,15 +11,47 @@ env:
1111
SLACK_ICON: https://pbs.twimg.com/profile_images/1274014582265298945/OjBKP9kn_400x400.png
1212
SLACK_USERNAME: ${{ secrets.BOT_USERNAME }}
1313
SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
14+
MSG_MINIMAL: event,action url,commit
15+
BRANCH: ${{ github.head_ref || github.ref }}
16+
REF: ${{ github.event.pull_request.head.sha || github.sha }}
1417

1518
on:
1619
# Allows you to run this workflow manually from the Actions tab as an alternative.
1720
workflow_dispatch:
21+
# Trigger pull_request event on CI files to be able to test changes before merging to main branch.
22+
# Workflow would fail if changes come from a forked repository since secrets are not available with this event.
1823
pull_request:
24+
paths:
25+
- '.github/**'
26+
- 'ci/**'
27+
# General entry point for Zama's pull request as well as contribution from forks.
28+
pull_request_target:
29+
paths:
30+
- '**'
31+
- '!.github/**'
32+
- '!ci/**'
1933

2034
jobs:
35+
check-ci-files:
36+
uses: ./.github/workflows/check_ci_files_change.yml
37+
with:
38+
checkout_ref: ${{ github.event.pull_request.head.sha || github.sha }}
39+
secrets:
40+
REPO_CHECKOUT_TOKEN: ${{ secrets.REPO_CHECKOUT_TOKEN }}
41+
42+
# Fail if the triggering actor is not part of Zama organization.
43+
# If pull_request_target is emitted and CI files have changed, skip this job. This would skip following jobs.
44+
check-user-permission:
45+
needs: check-ci-files
46+
if: github.event_name != 'pull_request_target' ||
47+
(github.event_name == 'pull_request_target' && needs.check-ci-files.outputs.ci_file_changed == 'false')
48+
uses: ./.github/workflows/check_actor_permissions.yml
49+
secrets:
50+
TOKEN: ${{ secrets.GITHUB_TOKEN }}
51+
2152
setup-instance:
2253
name: Setup instance (backward-compat-tests)
54+
needs: check-user-permission
2355
runs-on: ubuntu-latest
2456
outputs:
2557
runner-name: ${{ steps.start-instance.outputs.label }}
@@ -39,7 +71,7 @@ jobs:
3971
name: Backward compatibility tests
4072
needs: [ setup-instance ]
4173
concurrency:
42-
group: ${{ github.workflow }}_${{ github.ref }}
74+
group: ${{ github.workflow }}_${{ github.head_ref || github.ref }}
4375
cancel-in-progress: true
4476
runs-on: ${{ needs.setup-instance.outputs.runner-name }}
4577
steps:
@@ -48,6 +80,7 @@ jobs:
4880
with:
4981
persist-credentials: 'false'
5082
token: ${{ secrets.REPO_CHECKOUT_TOKEN }}
83+
ref: ${{ env.REF }}
5184

5285
- name: Install latest stable
5386
uses: dtolnay/rust-toolchain@a54c7afa936fefeb4456b2dd8068152669aa8203
@@ -90,7 +123,7 @@ jobs:
90123
uses: rtCamp/action-slack-notify@c33737706dea87cd7784c687dadc9adf1be59990
91124
env:
92125
SLACK_COLOR: ${{ job.status }}
93-
SLACK_MESSAGE: "Backward compatibility tests finished with status: ${{ job.status }}. (${{ env.ACTION_RUN_URL }})"
126+
SLACK_MESSAGE: "Backward compatibility tests finished with status: ${{ job.status }} on '${{ env.BRANCH }}'. (${{ env.ACTION_RUN_URL }})"
94127

95128
teardown-instance:
96129
name: Teardown instance (backward-compat-tests)
@@ -114,4 +147,4 @@ jobs:
114147
uses: rtCamp/action-slack-notify@c33737706dea87cd7784c687dadc9adf1be59990
115148
env:
116149
SLACK_COLOR: ${{ job.status }}
117-
SLACK_MESSAGE: "Instance teardown (backward-compat-tests) finished with status: ${{ job.status }}. (${{ env.ACTION_RUN_URL }})"
150+
SLACK_MESSAGE: "Instance teardown (backward-compat-tests) finished with status: ${{ job.status }} on '${{ env.BRANCH }}'. (${{ env.ACTION_RUN_URL }})"

‎.github/workflows/aws_tfhe_fast_tests.yml

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ jobs:
3636
should-run:
3737
runs-on: ubuntu-latest
3838
permissions:
39-
pull-requests: write
39+
pull-requests: read
4040
outputs:
4141
csprng_test: ${{ env.IS_PULL_REQUEST == 'false' || steps.changed-files.outputs.csprng_any_changed }}
4242
zk_pok_test: ${{ env.IS_PULL_REQUEST == 'false' || steps.changed-files.outputs.zk_pok_any_changed }}
@@ -62,7 +62,6 @@ jobs:
6262
user_docs_test: ${{ env.IS_PULL_REQUEST == 'false' ||
6363
steps.changed-files.outputs.user_docs_any_changed ||
6464
steps.changed-files.outputs.dependencies_any_changed }}
65-
ci_file_changed: ${{ env.IS_PULL_REQUEST == 'false' || steps.changed-files.outputs.ci_any_changed }}
6665
any_file_changed: ${{ env.IS_PULL_REQUEST == 'false' || steps.aggregated-changes.outputs.any_changed }}
6766
steps:
6867
- name: Checkout tfhe-rs
@@ -122,13 +121,9 @@ jobs:
122121
- '!tfhe/src/c_api/**'
123122
- 'tfhe/docs/**/**.md'
124123
- README.md
125-
ci:
126-
- .github/**
127-
- ci/**
128124
129125
- name: Aggregate file changes
130126
id: aggregated-changes
131-
# CI files are not included in this aggregator.
132127
if: ( steps.changed-files.outputs.dependencies_any_changed == 'true' ||
133128
steps.changed-files.outputs.csprng_any_changed == 'true' ||
134129
steps.changed-files.outputs.zk_pok_any_changed == 'true' ||
@@ -143,13 +138,20 @@ jobs:
143138
run: |
144139
echo "any_changed=true" >> "$GITHUB_OUTPUT"
145140
141+
check-ci-files:
142+
uses: ./.github/workflows/check_ci_files_change.yml
143+
with:
144+
checkout_ref: ${{ github.event.pull_request.head.sha || github.sha }}
145+
secrets:
146+
REPO_CHECKOUT_TOKEN: ${{ secrets.REPO_CHECKOUT_TOKEN }}
147+
146148
# Fail if the triggering actor is not part of Zama organization.
147149
# If pull_request_target is emitted and CI files have changed, skip this job. This would skip following jobs.
148150
check-user-permission:
149-
needs: should-run
151+
needs: check-ci-files
150152
if: github.event_name != 'pull_request_target' ||
151-
(github.event_name == 'pull_request_target' && needs.should-run.outputs.ci_file_changed == 'false')
152-
uses: ./.github/workflows/check_triggering_actor.yml
153+
(github.event_name == 'pull_request_target' && needs.check-ci-files.outputs.ci_file_changed == 'false')
154+
uses: ./.github/workflows/check_actor_permissions.yml
153155
secrets:
154156
TOKEN: ${{ secrets.GITHUB_TOKEN }}
155157

‎.github/workflows/aws_tfhe_integer_tests.yml

Lines changed: 43 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -10,16 +10,31 @@ env:
1010
SLACK_ICON: https://pbs.twimg.com/profile_images/1274014582265298945/OjBKP9kn_400x400.png
1111
SLACK_USERNAME: ${{ secrets.BOT_USERNAME }}
1212
SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
13+
MSG_MINIMAL: event,action url,commit
14+
BRANCH: ${{ github.head_ref || github.ref }}
1315
# We clear the cache to reduce memory pressure because of the numerous processes of cargo
1416
# nextest
1517
TFHE_RS_CLEAR_IN_MEMORY_KEY_CACHE: "1"
1618
NO_BIG_PARAMS: FALSE
19+
REF: ${{ github.event.pull_request.head.sha || github.sha }}
1720

1821
on:
1922
# Allows you to run this workflow manually from the Actions tab as an alternative.
2023
workflow_dispatch:
24+
# Trigger pull_request event on CI files to be able to test changes before merging to main branch.
25+
# Workflow would fail if changes come from a forked repository since secrets are not available with this event.
2126
pull_request:
22-
types: [labeled]
27+
types: [ labeled ]
28+
paths:
29+
- '.github/**'
30+
- 'ci/**'
31+
# General entry point for Zama's pull request as well as contribution from forks.
32+
pull_request_target:
33+
types: [ labeled ]
34+
paths:
35+
- '**'
36+
- '!.github/**'
37+
- '!ci/**'
2338
push:
2439
branches:
2540
- main
@@ -28,12 +43,11 @@ jobs:
2843
should-run:
2944
if:
3045
(github.event_name == 'push' && github.repository == 'zama-ai/tfhe-rs') ||
31-
(github.event_name == 'schedule' && github.repository == 'zama-ai/tfhe-rs') ||
32-
(github.event_name == 'pull_request' && contains(github.event.label.name, 'approved')) ||
46+
(github.event_name == 'pull_request_target' && contains(github.event.label.name, 'approved')) ||
3347
github.event_name == 'workflow_dispatch'
3448
runs-on: ubuntu-latest
3549
permissions:
36-
pull-requests: write
50+
pull-requests: read
3751
outputs:
3852
integer_test: ${{ github.event_name == 'workflow_dispatch' ||
3953
steps.changed-files.outputs.integer_any_changed }}
@@ -44,6 +58,7 @@ jobs:
4458
fetch-depth: 0
4559
persist-credentials: 'false'
4660
token: ${{ secrets.REPO_CHECKOUT_TOKEN }}
61+
ref: ${{ env.REF }}
4762

4863
- name: Check for file changes
4964
id: changed-files
@@ -61,13 +76,30 @@ jobs:
6176
- tfhe/src/integer/**
6277
- .github/workflows/aws_tfhe_integer_tests.yml
6378
79+
check-ci-files:
80+
uses: ./.github/workflows/check_ci_files_change.yml
81+
with:
82+
checkout_ref: ${{ github.event.pull_request.head.sha || github.sha }}
83+
secrets:
84+
REPO_CHECKOUT_TOKEN: ${{ secrets.REPO_CHECKOUT_TOKEN }}
85+
86+
# Fail if the triggering actor is not part of Zama organization.
87+
# If pull_request_target is emitted and CI files have changed, skip this job. This would skip following jobs.
88+
check-user-permission:
89+
needs: check-ci-files
90+
if: github.event_name != 'pull_request_target' ||
91+
(github.event_name == 'pull_request_target' && needs.check-ci-files.outputs.ci_file_changed == 'false')
92+
uses: ./.github/workflows/check_actor_permissions.yml
93+
secrets:
94+
TOKEN: ${{ secrets.GITHUB_TOKEN }}
95+
6496
setup-instance:
6597
name: Setup instance (unsigned-integer-tests)
66-
needs: should-run
98+
needs: [ should-run, check-user-permission ]
6799
if:
68100
(github.event_name == 'push' && github.repository == 'zama-ai/tfhe-rs' && needs.should-run.outputs.integer_test == 'true') ||
69101
(github.event_name == 'schedule' && github.repository == 'zama-ai/tfhe-rs') ||
70-
(github.event_name == 'pull_request' && contains(github.event.label.name, 'approved')) ||
102+
(github.event.action == 'labeled' && github.event.label.name == 'approved' && needs.should-run.outputs.integer_test == 'true') ||
71103
github.event_name == 'workflow_dispatch'
72104
runs-on: ubuntu-latest
73105
outputs:
@@ -88,7 +120,7 @@ jobs:
88120
name: Unsigned integer tests
89121
needs: setup-instance
90122
concurrency:
91-
group: ${{ github.workflow }}_${{ github.ref }}${{ github.ref == 'refs/heads/main' && github.sha || '' }}
123+
group: ${{ github.workflow }}_${{ github.head_ref || github.ref }}
92124
cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
93125
runs-on: ${{ needs.setup-instance.outputs.runner-name }}
94126
steps:
@@ -97,14 +129,15 @@ jobs:
97129
with:
98130
persist-credentials: "false"
99131
token: ${{ secrets.REPO_CHECKOUT_TOKEN }}
132+
ref: ${{ env.REF }}
100133

101134
- name: Install latest stable
102135
uses: dtolnay/rust-toolchain@a54c7afa936fefeb4456b2dd8068152669aa8203
103136
with:
104137
toolchain: stable
105138

106139
- name: Should skip big parameters set
107-
if: github.event_name == 'pull_request'
140+
if: github.event_name == 'pull_request_target'
108141
run: |
109142
echo "NO_BIG_PARAMS=TRUE" >> "${GITHUB_ENV}"
110143
@@ -130,7 +163,7 @@ jobs:
130163
uses: rtCamp/action-slack-notify@c33737706dea87cd7784c687dadc9adf1be59990
131164
env:
132165
SLACK_COLOR: ${{ job.status }}
133-
SLACK_MESSAGE: "Unsigned Integer tests finished with status: ${{ job.status }}. (${{ env.ACTION_RUN_URL }})"
166+
SLACK_MESSAGE: "Unsigned Integer tests finished with status: ${{ job.status }} on '${{ env.BRANCH }}'. (${{ env.ACTION_RUN_URL }})"
134167

135168
teardown-instance:
136169
name: Teardown instance (unsigned-integer-tests)
@@ -154,4 +187,4 @@ jobs:
154187
uses: rtCamp/action-slack-notify@c33737706dea87cd7784c687dadc9adf1be59990
155188
env:
156189
SLACK_COLOR: ${{ job.status }}
157-
SLACK_MESSAGE: "Instance teardown (unsigned-integer-tests) finished with status: ${{ job.status }}. (${{ env.ACTION_RUN_URL }})"
190+
SLACK_MESSAGE: "Instance teardown (unsigned-integer-tests) finished with status: ${{ job.status }} on '${{ env.BRANCH }}'. (${{ env.ACTION_RUN_URL }})"

‎.github/workflows/aws_tfhe_signed_integer_tests.yml

Lines changed: 43 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -10,16 +10,31 @@ env:
1010
SLACK_ICON: https://pbs.twimg.com/profile_images/1274014582265298945/OjBKP9kn_400x400.png
1111
SLACK_USERNAME: ${{ secrets.BOT_USERNAME }}
1212
SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
13+
MSG_MINIMAL: event,action url,commit
14+
BRANCH: ${{ github.head_ref || github.ref }}
1315
# We clear the cache to reduce memory pressure because of the numerous processes of cargo
1416
# nextest
1517
TFHE_RS_CLEAR_IN_MEMORY_KEY_CACHE: "1"
1618
NO_BIG_PARAMS: FALSE
19+
REF: ${{ github.event.pull_request.head.sha || github.sha }}
1720

1821
on:
1922
# Allows you to run this workflow manually from the Actions tab as an alternative.
2023
workflow_dispatch:
24+
# Trigger pull_request event on CI files to be able to test changes before merging to main branch.
25+
# Workflow would fail if changes come from a forked repository since secrets are not available with this event.
2126
pull_request:
22-
types: [labeled]
27+
types: [ labeled ]
28+
paths:
29+
- '.github/**'
30+
- 'ci/**'
31+
# General entry point for Zama's pull request as well as contribution from forks.
32+
pull_request_target:
33+
types: [ labeled ]
34+
paths:
35+
- '**'
36+
- '!.github/**'
37+
- '!ci/**'
2338
push:
2439
branches:
2540
- main
@@ -29,11 +44,11 @@ jobs:
2944
if:
3045
(github.event_name == 'push' && github.repository == 'zama-ai/tfhe-rs') ||
3146
(github.event_name == 'schedule' && github.repository == 'zama-ai/tfhe-rs') ||
32-
(github.event_name == 'pull_request' && contains(github.event.label.name, 'approved')) ||
47+
((github.event_name == 'pull_request_target' || github.event_name == 'pull_request_target') && contains(github.event.label.name, 'approved')) ||
3348
github.event_name == 'workflow_dispatch'
3449
runs-on: ubuntu-latest
3550
permissions:
36-
pull-requests: write
51+
pull-requests: read
3752
outputs:
3853
integer_test: ${{ github.event_name == 'workflow_dispatch' ||
3954
steps.changed-files.outputs.integer_any_changed }}
@@ -44,6 +59,7 @@ jobs:
4459
fetch-depth: 0
4560
persist-credentials: 'false'
4661
token: ${{ secrets.REPO_CHECKOUT_TOKEN }}
62+
ref: ${{ env.REF }}
4763

4864
- name: Check for file changes
4965
id: changed-files
@@ -61,13 +77,30 @@ jobs:
6177
- tfhe/src/integer/**
6278
- .github/workflows/aws_tfhe_signed_integer_tests.yml
6379
80+
check-ci-files:
81+
uses: ./.github/workflows/check_ci_files_change.yml
82+
with:
83+
checkout_ref: ${{ github.event.pull_request.head.sha || github.sha }}
84+
secrets:
85+
REPO_CHECKOUT_TOKEN: ${{ secrets.REPO_CHECKOUT_TOKEN }}
86+
87+
# Fail if the triggering actor is not part of Zama organization.
88+
# If pull_request_target is emitted and CI files have changed, skip this job. This would skip following jobs.
89+
check-user-permission:
90+
needs: check-ci-files
91+
if: github.event_name != 'pull_request_target' ||
92+
(github.event_name == 'pull_request_target' && needs.check-ci-files.outputs.ci_file_changed == 'false')
93+
uses: ./.github/workflows/check_actor_permissions.yml
94+
secrets:
95+
TOKEN: ${{ secrets.GITHUB_TOKEN }}
96+
6497
setup-instance:
6598
name: Setup instance (unsigned-integer-tests)
66-
needs: should-run
99+
needs: [ should-run, check-user-permission ]
67100
if:
68101
(github.event_name == 'push' && github.repository == 'zama-ai/tfhe-rs' && needs.should-run.outputs.integer_test == 'true') ||
69102
(github.event_name == 'schedule' && github.repository == 'zama-ai/tfhe-rs') ||
70-
(github.event_name == 'pull_request' && contains(github.event.label.name, 'approved')) ||
103+
(github.event.action == 'labeled' && github.event.label.name == 'approved' && needs.should-run.outputs.integer_test == 'true') ||
71104
github.event_name == 'workflow_dispatch'
72105
runs-on: ubuntu-latest
73106
outputs:
@@ -88,7 +121,7 @@ jobs:
88121
name: Signed integer tests
89122
needs: setup-instance
90123
concurrency:
91-
group: ${{ github.workflow }}_${{ github.ref }}${{ github.ref == 'refs/heads/main' && github.sha || '' }}
124+
group: ${{ github.workflow }}_${{ github.head_ref || github.ref }}
92125
cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
93126
runs-on: ${{ needs.setup-instance.outputs.runner-name }}
94127
steps:
@@ -97,14 +130,15 @@ jobs:
97130
with:
98131
persist-credentials: "false"
99132
token: ${{ secrets.REPO_CHECKOUT_TOKEN }}
133+
ref: ${{ env.REF }}
100134

101135
- name: Install latest stable
102136
uses: dtolnay/rust-toolchain@a54c7afa936fefeb4456b2dd8068152669aa8203
103137
with:
104138
toolchain: stable
105139

106140
- name: Should skip big parameters set
107-
if: github.event_name == 'pull_request'
141+
if: github.event_name == 'pull_request_target'
108142
run: |
109143
echo "NO_BIG_PARAMS=TRUE" >> "${GITHUB_ENV}"
110144
@@ -134,7 +168,7 @@ jobs:
134168
uses: rtCamp/action-slack-notify@c33737706dea87cd7784c687dadc9adf1be59990
135169
env:
136170
SLACK_COLOR: ${{ job.status }}
137-
SLACK_MESSAGE: "Signed Integer tests finished with status: ${{ job.status }}. (${{ env.ACTION_RUN_URL }})"
171+
SLACK_MESSAGE: "Signed Integer tests finished with status: ${{ job.status }} on '${{ env.BRANCH }}'. (${{ env.ACTION_RUN_URL }})"
138172

139173
teardown-instance:
140174
name: Teardown instance (signed-integer-tests)
@@ -158,4 +192,4 @@ jobs:
158192
uses: rtCamp/action-slack-notify@c33737706dea87cd7784c687dadc9adf1be59990
159193
env:
160194
SLACK_COLOR: ${{ job.status }}
161-
SLACK_MESSAGE: "Instance teardown (signed-integer-tests) finished with status: ${{ job.status }}. (${{ env.ACTION_RUN_URL }})"
195+
SLACK_MESSAGE: "Instance teardown (signed-integer-tests) finished with status: ${{ job.status }} on '${{ env.BRANCH }}'. (${{ env.ACTION_RUN_URL }})"

0 commit comments

Comments
 (0)