ci: run Collate Workflow & Data Access Request Playwright tests on OpenMetadata PRs - #29505
Conversation
✅ PR checks passedThe linked issue has a description and all required Shipping project fields set. Thanks! |
|
Hi there 👋 Thanks for your contribution! The OpenMetadata team will review the PR shortly! Once it has been labeled as Let us know if you need any help! |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
|
Hi there 👋 Thanks for your contribution! The OpenMetadata team will review the PR shortly! Once it has been labeled as Let us know if you need any help! |
anuj-kumary
added
the
safe to test
…penMetadata into OSS-workflow-dar
Jest test CoverageUI tests summary
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
Code Review ✅ ApprovedIntroduces an automated CI trigger to run Collate Workflow and Data Access Request Playwright tests on OpenMetadata PRs. Replaces the initial workflow with a robust path-filtered implementation to ensure compatibility with mandatory branch protection checks. OptionsDisplay: compact → Showing less information. Comment with these commands to change:
Was this helpful? React with 👍 / 👎 | Gitar |
4 participants
Describe your changes:
Fixes #29514
Governance Workflows and Data Access Request (DAR). Today a change to any of those OSS files can silently break those Collate flows we don't find out until a separate Collate checks run.
This adds a targeted CI check: when an OpenMetadata PR touches those specific files, automatically run the Collate Workflow + DAR Playwright suite against that PR's exact OSS code.
Type of change:
High-level design:
N/A — small change.
Tests:
Use cases covered
Unit tests
Backend integration tests
Ingestion integration tests
Playwright (UI) tests
Manual testing performed
UI screen recording / screenshots:
Not applicable.
Checklist:
Fixes <issue-number>: <short explanation>Fixes #<issue-number>above.Summary by Gitar
collate-workflow-dar-playwright.ymlwithdata-access-request-e2e.ymlto support mandatory CI status checks.dorny/paths-filterto skip execution for unrelated changes, ensuring branch protection compatibility.This will update automatically on new commits.
------|----------|
| .github/workflows/collate-workflow-dar-playwright.yml | New GitHub Actions workflow that dispatches the Collate Playwright suite when OpenMetadata PRs touch Task/Feed/Governance workflow files; contains a dead
push-event branch in the SHA expression and three issues flagged in prior review threads (missing timeout, unused checkout, empty SHA onworkflow_dispatch). |Sequence Diagram
%%{init: {'theme': 'neutral'}}%% sequenceDiagram participant Dev as PR Author participant GH as GitHub (OM Repo) participant Labeler as Labeler / wait-on-check participant Collate as Collate Repo Workflow Dev->>GH: Open / push PR touching Task/Feed/Governance files GH->>GH: Trigger pull_request_target (collate-workflow-dar-playwright) GH->>Labeler: Wait for "Team Label" check Labeler-->>GH: Check complete GH->>GH: Verify "safe to test" label present GH->>GH: "Checkout fork HEAD (actions/checkout@v4)" GH->>Collate: "workflow-dispatch inputs: { sha, event }" Collate-->>GH: Workflow queued and running GH->>GH: Block runner (wait-for-completion: true) Collate-->>GH: Workflow finished (pass / fail) GH-->>Dev: CI check result surfaced on PR%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%% sequenceDiagram participant Dev as PR Author participant GH as GitHub (OM Repo) participant Labeler as Labeler / wait-on-check participant Collate as Collate Repo Workflow Dev->>GH: Open / push PR touching Task/Feed/Governance files GH->>GH: Trigger pull_request_target (collate-workflow-dar-playwright) GH->>Labeler: Wait for "Team Label" check Labeler-->>GH: Check complete GH->>GH: Verify "safe to test" label present GH->>GH: "Checkout fork HEAD (actions/checkout@v4)" GH->>Collate: "workflow-dispatch inputs: { sha, event }" Collate-->>GH: Workflow queued and running GH->>GH: Block runner (wait-for-completion: true) Collate-->>GH: Workflow finished (pass / fail) GH-->>Dev: CI check result surfaced on PRReviews (3): Last reviewed commit: "Merge branch 'OSS-workflow-dar' of https..." | Re-trigger Greptile
Greptile Summary
This PR replaces
collate-workflow-dar-playwright.ymlwithdata-access-request-e2e.yml, addingdorny/paths-filterto skip the expensive Collate dispatch when an OM PR does not touch Task/Feed/Governance workflow files. Two issues flagged in prior reviews are resolved: the SHA expression now falls back togithub.shaonworkflow_dispatch, and the unusedactions/checkoutstep (which unnecessarily widened thepull_request_targetattack surface) has been removed.check-changesjob usesdorny/paths-filter@v4over the GitHub API (no checkout needed) to gate on four specific file paths; thedata-access-request-e2ejob still fires unconditionally onworkflow_dispatchvia an explicit bypass in itsifexpression.pull_request_targetruns must pass the "Team Label" wait-on-check step and theverify-pr-label-action"safe to test" check before the Collate PAT dispatch fires; no fork code is checked out into thepull_request_targetcontext.Confidence Score: 5/5
Safe to merge — no fork code is executed under the elevated pull_request_target context and the label gate correctly guards the Collate PAT dispatch.
The two concrete defects flagged in earlier reviews — the empty SHA on workflow_dispatch and the unused checkout step that widened the pull_request_target attack surface — are both resolved. The SHA now falls back to github.sha and the checkout step is gone entirely.
No files require special attention.
Important Files Changed
Sequence Diagram
%%{init: {'theme': 'neutral'}}%% sequenceDiagram participant Dev as PR Author participant GH as GitHub (OM Repo) participant Filter as check-changes (paths-filter) participant Labeler as wait-on-check / verify-label participant Collate as Collate Repo Workflow Dev->>GH: Open / push PR touching Task/Feed/Governance files GH->>Filter: Trigger pull_request_target check-changes job Filter-->>GH: "dar=true (matched files) or dar=false (skip)" alt "dar=true or workflow_dispatch" GH->>Labeler: Wait for Team Label check Labeler-->>GH: Check complete GH->>GH: Verify safe to test label present GH->>Collate: "workflow-dispatch { sha, event }" Collate-->>GH: "Workflow running (wait-for-completion=true)" Collate-->>GH: Workflow finished (pass / fail) GH-->>Dev: CI check result surfaced on PR else "dar=false" GH-->>Dev: data-access-request-e2e skipped end%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%% sequenceDiagram participant Dev as PR Author participant GH as GitHub (OM Repo) participant Filter as check-changes (paths-filter) participant Labeler as wait-on-check / verify-label participant Collate as Collate Repo Workflow Dev->>GH: Open / push PR touching Task/Feed/Governance files GH->>Filter: Trigger pull_request_target check-changes job Filter-->>GH: "dar=true (matched files) or dar=false (skip)" alt "dar=true or workflow_dispatch" GH->>Labeler: Wait for Team Label check Labeler-->>GH: Check complete GH->>GH: Verify safe to test label present GH->>Collate: "workflow-dispatch { sha, event }" Collate-->>GH: "Workflow running (wait-for-completion=true)" Collate-->>GH: Workflow finished (pass / fail) GH-->>Dev: CI check result surfaced on PR else "dar=false" GH-->>Dev: data-access-request-e2e skipped endReviews (7): Last reviewed commit: "Merge branch 'main' into OSS-workflow-da..." | Re-trigger Greptile