Secure Integration test #36

< 8EFB div data-view-component="true" class="PageHeader-navigation hide-whenRegular mt-0 ml-n3">

	name: Secure Integration test

	on:
	workflow_run:
	workflows: [ "Pull Request and Push Action" ]
	types:
	- completed

	jobs:
	check-access-and-checkout:
	runs-on: ubuntu-latest
	if: >
	github.event.workflow_run.event == 'pull_request' &&
	github.event.workflow_run.conclusion == 'success'
	permissions:
	id-token: write
	pull-requests: read
	contents: read
	steps:
	- name: Check PR labels and author
	id: check
	uses: actions/github-script@v7
	with:
	script: \|
	const pr = context.payload.pull_request;

	const labels = pr.labels.map(label => label.name);
	const hasLabel = labels.includes('approved-for-integ-test')
	if (hasLabel) {
	core.info('PR contains label approved-for-integ-test')
	return
	}

	core.setFailed('Pull Request must either have label approved-for-integ-test')
	- name: Configure Credentials
	uses: aws-actions/configure-aws-credentials@v4
	with:
	role-to-assume: ${{ secrets.STRANDS_INTEG_TEST_ROLE }}
	aws-region: us-east-1
	mask-aws-account-id: true
	- name: Checkout base branch
	uses: actions/checkout@v4
	with:
	ref: ${{ github.event.pull_request.head.ref }} # Pull the commit from the forked repo
	persist-credentials: false # Don't persist credentials for subsequent actions
	- name: Set up Python
	uses: actions/setup-python@v5
	with:
	python-version: '3.10'
	- name: Install dependencies
	run: \|
	pip install --no-cache-dir hatch
	- name: Run integration tests
	env:
	AWS_REGION: us-east-1
	AWS_REGION_NAME: us-east-1 # Needed for LiteLLM
	id: tests
	run: \|
	hatch test tests-integ

Provide feedback