Skip to content

Commit fdd8e29

Browse files
jackwotherspoonjackwotherspoon
authored
chore(ci): enable WIF builds for integration tests (#439)
1 parent fadc357 commit fdd8e29

File tree

4 files changed

+193
-8
lines changed

4 files changed

+193
-8
lines changed

‎.github/trusted-contribution.yml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# Copyright 2022 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# https://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
annotations:
16+
- type: label
17+
text: "tests: run"

‎.github/workflows/coverage.yml‎

Lines changed: 30 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,22 +13,45 @@
1313
# limitations under the License.
1414

1515
name: Code Coverage
16-
on: [pull_request]
16+
on:
17+
pull_request:
18+
pull_request_target:
19+
types: [labeled]
1720

1821
jobs:
19-
build:
22+
coverage:
23+
if: "${{ github.event.action != 'labeled' || github.event.label.name == 'tests: run' }}"
2024
runs-on: ubuntu-latest
2125
steps:
26+
- name: Remove PR Label
27+
if: "${{ github.event.action == 'labeled' && github.event.label.name == 'tests: run' }}"
28+
uses: actions/github-script@v6
29+
with:
30+
github-token: ${{ secrets.GITHUB_TOKEN }}
31+
script: |
32+
try {
33+
await github.rest.issues.removeLabel({
34+
name: 'tests: run',
35+
owner: context.repo.owner,
36+
repo: context.repo.repo,
37+
issue_number: context.payload.pull_request.number
38+
});
39+
} catch (e) {
40+
console.log('Failed to remove label. Another job may have already removed it!');
41+
}
42+
2243
- name: Setup Python
2344
uses: actions/setup-python@v4
2445
with:
2546
python-version: "3.10"
47+
2648
- run: pip install nox coverage
27-
49+
2850
- name: Checkout base branch
2951
uses: actions/checkout@v3
3052
with:
3153
ref: ${{ github.base_ref }}
54+
3255
- name: Calculate base code coverage
3356
run: |
3457
nox --sessions unit-3.10
@@ -39,6 +62,10 @@ jobs:
3962
4063
- name: Checkout PR branch
4164
uses: actions/checkout@v3
65+
with:
66+
ref: ${{ github.event.pull_request.head.sha }}
67+
repository: ${{ github.event.pull_request.head.repo.full_name }}
68+
4269
- name: Calculate PR code coverage
4370
run: |
4471
nox --sessions unit-3.10

‎.github/workflows/lint.yml‎

Lines changed: 26 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,13 +13,34 @@
1313
# limitations under the License.
1414

1515
name: Lint
16-
on: [pull_request]
16+
on:
17+
pull_request:
18+
pull_request_target:
19+
types: [labeled]
1720

1821
jobs:
19-
build:
22+
lint:
23+
if: "${{ github.event.action != 'labeled' || github.event.label.name == 'tests: run' }}"
2024
name: Run lint
2125
runs-on: ubuntu-latest
2226
steps:
27+
- name: Remove PR Label
28+
if: "${{ github.event.action == 'labeled' && github.event.label.name == 'tests: run' }}"
29+
uses: actions/github-script@v6
30+
with:
31+
github-token: ${{ secrets.GITHUB_TOKEN }}
32+
script: |
33+
try {
34+
await github.rest.issues.removeLabel({
35+
name: 'tests: run',
36+
owner: context.repo.owner,
37+
repo: context.repo.repo,
38+
issue_number: context.payload.pull_request.number
39+
});
40+
} catch (e) {
41+
console.log('Failed to remove label. Another job may have already removed it!');
42+
}
43+
2344
- name: Setup Python
2445
uses: actions/setup-python@v4
2546
with:
@@ -30,6 +51,9 @@ jobs:
3051

3152
- name: Checkout code
3253
uses: actions/checkout@v3
54+
with:
55+
ref: ${{ github.event.pull_request.head.sha }}
56+
repository: ${{ github.event.pull_request.head.repo.full_name }}
3357

3458
- name: Run nox lint session
3559
run: nox --sessions lint

‎.github/workflows/tests.yml‎

Lines changed: 120 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,17 +18,49 @@ on:
1818
push:
1919
branches:
2020
- main
21+
pull_request_target:
22+
types: [labeled]
23+
schedule:
24+
- cron: '0 2 * * *'
2125

2226
jobs:
23-
build:
24-
name: "unit tests"
27+
integration:
28+
# run job on proper workflow event triggers (skip job for pull_request event from forks and only run pull_request_target for "tests: run" label)
29+
if: "${{ (github.event.action != 'labeled' && github.event.pull_request.head.repo.full_name == github.event.pull_request.base.repo.full_name) || github.event.label.name == 'tests: run' }}"
30+
name: integration tests
2531
runs-on: ${{ matrix.os }}
2632
strategy:
2733
matrix:
2834
os: [macos-latest, windows-latest, ubuntu-latest]
2935
python-version: ["3.7", "3.8", "3.9", "3.10"]
3036
fail-fast: false
37+
permissions:
38+
contents: 'read'
39+
id-token: 'write'
3140
steps:
41+
- name: Remove PR label
42+
if: "${{ github.event.action == 'labeled' && github.event.label.name == 'tests: run' }}"
43+
uses: actions/github-script@v6
44+
with:
45+
github-token: ${{ secrets.GITHUB_TOKEN }}
46+
script: |
47+
try {
48+
await github.rest.issues.removeLabel({
49+
name: 'tests: run',
50+
owner: context.repo.owner,
51+
repo: context.repo.repo,
52+
issue_number: context.payload.pull_request.number
53+
});
54+
} catch (e) {
55+
console.log('Failed to remove label. Another job may have already removed it!');
56+
}
57+
58+
- name: Checkout code
59+
uses: 'actions/checkout@v3'
60+
with:
61+
ref: ${{ github.event.pull_request.head.sha }}
62+
repository: ${{ github.event.pull_request.head.repo.full_name }}
63+
3264
- name: Setup Python ${{ matrix.python-version }}
3365
uses: actions/setup-python@v4
3466
with:
@@ -37,8 +69,93 @@ jobs:
3769
- name: Install nox
3870
run: pip install nox
3971

72+
- id: 'auth'
73+
name: 'Authenticate to Google Cloud'
74+
uses: 'google-github-actions/auth@v0.8.0'
75+
with:
76+
workload_identity_provider: ${{ secrets.PROVIDER_NAME }}
77+
service_account: ${{ secrets.SERVICE_ACCOUNT }}
78+
access_token_lifetime: 600s
79+
80+
- id: 'secrets'
81+
name: Get secrets
82+
uses: 'google-github-actions/get-secretmanager-secrets@v0.5.0'
83+
with:
84+
secrets: |-
85+
MYSQL_CONNECTION_NAME:${{ secrets.GOOGLE_CLOUD_PROJECT }}/MYSQL_CONNECTION_NAME
86+
MYSQL_USER:${{ secrets.GOOGLE_CLOUD_PROJECT }}/MYSQL_USER
87+
MYSQL_PASS:${{ secrets.GOOGLE_CLOUD_PROJECT }}/MYSQL_PASS
88+
MYSQL_DB:${{ secrets.GOOGLE_CLOUD_PROJECT }}/MYSQL_DB
89+
POSTGRES_CONNECTION_NAME:${{ secrets.GOOGLE_CLOUD_PROJECT }}/POSTGRES_CONNECTION_NAME
90+
POSTGRES_IAM_CONNECTION_NAME:${{ secrets.GOOGLE_CLOUD_PROJECT }}/POSTGRES_IAM_CONNECTION_NAME
91+
POSTGRES_USER:${{ secrets.GOOGLE_CLOUD_PROJECT }}/POSTGRES_USER
92+
POSTGRES_IAM_USER:${{ secrets.GOOGLE_CLOUD_PROJECT }}/POSTGRES_USER_IAM_PYTHON
93+
POSTGRES_PASS:${{ secrets.GOOGLE_CLOUD_PROJECT }}/POSTGRES_PASS
94+
POSTGRES_DB:${{ secrets.GOOGLE_CLOUD_PROJECT }}/POSTGRES_DB
95+
SQLSERVER_CONNECTION_NAME:${{ secrets.GOOGLE_CLOUD_PROJECT }}/SQLSERVER_CONNECTION_NAME
96+
SQLSERVER_USER:${{ secrets.GOOGLE_CLOUD_PROJECT }}/SQLSERVER_USER
97+
SQLSERVER_PASS:${{ secrets.GOOGLE_CLOUD_PROJECT }}/SQLSERVER_PASS
98+
SQLSERVER_DB:${{ secrets.GOOGLE_CLOUD_PROJECT }}/SQLSERVER_DB
99+
100+
- name: Run tests
101+
env:
102+
MYSQL_CONNECTION_NAME: '${{ steps.secrets.outputs.MYSQL_CONNECTION_NAME }}'
103+
MYSQL_USER: '${{ steps.secrets.outputs.MYSQL_USER }}'
104+
MYSQL_PASS: '${{ steps.secrets.outputs.MYSQL_PASS }}'
105+
MYSQL_DB: '${{ steps.secrets.outputs.MYSQL_DB }}'
106+
POSTGRES_CONNECTION_NAME: '${{ steps.secrets.outputs.POSTGRES_CONNECTION_NAME }}'
107+
POSTGRES_IAM_CONNECTION_NAME: '${{ steps.secrets.outputs.POSTGRES_IAM_CONNECTION_NAME }}'
108+
POSTGRES_USER: '${{ steps.secrets.outputs.POSTGRES_USER }}'
109+
POSTGRES_IAM_USER: '${{ steps.secrets.outputs.POSTGRES_IAM_USER }}'
110+
POSTGRES_PASS: '${{ steps.secrets.outputs.POSTGRES_PASS }}'
111+
POSTGRES_DB: '${{ steps.secrets.outputs.POSTGRES_DB }}'
112+
SQLSERVER_CONNECTION_NAME: '${{ steps.secrets.outputs.SQLSERVER_CONNECTION_NAME }}'
113+
SQLSERVER_USER: '${{ steps.secrets.outputs.SQLSERVER_USER }}'
114+
SQLSERVER_PASS: '${{ steps.secrets.outputs.SQLSERVER_PASS }}'
115+
SQLSERVER_DB: '${{ steps.secrets.outputs.SQLSERVER_DB }}'
116+
run: nox -s system-${{ matrix.python-version }}
117+
118+
unit:
119+
# run job on proper workflow event triggers (skip job for pull_request event from forks and only run pull_request_target for "tests: run" label)
120+
if: "${{ (github.event.action != 'labeled' && github.event.pull_request.head.repo.full_name == github.event.pull_request.base.repo.full_name) || github.event.label.name == 'tests: run' }}"
121+
name: unit tests
122+
runs-on: ${{ matrix.os }}
123+
strategy:
124+
matrix:
125+
os: [macos-latest, windows-latest, ubuntu-latest]
126+
python-version: ["3.7", "3.8", "3.9", "3.10"]
127+
fail-fast: false
128+
steps:
129+
- name: Remove PR label
130+
if: "${{ github.event.action == 'labeled' && github.event.label.name == 'tests: run' }}"
131+
uses: actions/github-script@v6
132+
with:
133+
github-token: ${{ secrets.GITHUB_TOKEN }}
134+
script: |
135+
try {
136+
await github.rest.issues.removeLabel({
137+
name: 'tests: run',
138+
owner: context.repo.owner,
139+
repo: context.repo.repo,
140+
issue_number: context.payload.pull_request.number
141+
});
142+
} catch (e) {
143+
console.log('Failed to remove label. Another job may have already removed it!');
144+
}
145+
40146
- name: Checkout code
41-
uses: actions/checkout@v3
147+
uses: 'actions/checkout@v3'
148+
with:
149+
ref: ${{ github.event.pull_request.head.sha }}
150+
repository: ${{ github.event.pull_request.head.repo.full_name }}
151+
152+
- name: Setup Python ${{ matrix.python-version }}
153+
uses: actions/setup-python@v4
154+
with:
155+
python-version: ${{ matrix.python-version }}
156+
157+
- name: Install nox
158+
run: pip install nox
42159

43160
- name: Run tests
44161
run: nox -s unit-${{ matrix.python-version }}

0 commit comments

Comments
 (0)