8000 fix: Update PR Integration Test Workflow by AdnaneKhan · Pull Request #237 · strands-agents/sdk-python · GitHub
[go: up one dir, main page]
Skip to content
/ sdk-python Public
< 8000 /div>

fix: Update PR Integration Test Workflow #237

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Jun 17, 2025
Merged

fix: Update PR Integration Test Workflow #237

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
90e52f3
Use deployment environment gating for integration tests.
AdnaneKhan Jun 17, 2025
91a9554
Only run on PRs that target main.
AdnaneKhan Jun 17, 2025
930a548
Use correct head name.
AdnaneKhan Jun 17, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
54 changes: 36 additions & 18 deletions .github/workflows/integration-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,41 +2,59 @@ name: Secure Integration test

on:
pull_request_target:
types: [opened, synchronize, labeled, unlabled, reopened]
branches: main

jobs:
authorization-check:
permissions: read-all
runs-on: ubuntu-latest
outputs:
approval-env: ${{ steps.collab-check.outputs.result }}
steps:
- name: Collaborator Check
uses: actions/github-script@v7
id: collab-check
with:
result-encoding: string
script: |
try {
const permissionResponse = await github.rest.repos.getCollaboratorPermissionLevel({
owner: context.repo.owner,
repo: context.repo.repo,
username: context.payload.pull_request.user.login,
});
const permission = permissionResponse.data.permission;
const hasWriteAccess = ['write', 'admin'].includes(permission);
if (!hasWriteAccess) {
console.log(`User ${context.payload.pull_request.user.login} does not have write access to the repository (permission: ${permission})`);
return "manual-approval"
} else {
console.log(`Verifed ${context.payload.pull_request.user.login} has write access. Auto Approving PR Checks.`)
return "auto-approve"
}
} catch (error) {
console.log(`${context.payload.pull_request.user.login} does not have write access. Requiring Manual Approval to run PR Checks.`)
return "manual-approval"
}
check-access-and-checkout:
runs-on: ubuntu-latest
needs: authorization-check
environment: ${{ needs.authorization-check.outputs.approval-env }}
permissions:
id-token: write
pull-requests: read
contents: read
steps:
- name: Check PR labels and author
id: check
uses: actions/github-script@v7
with:
script: |
const pr = context.payload.pull_request;

const labels = pr.labels.map(label => label.name);
const hasLabel = labels.includes('approved-for-integ-test')
if (hasLabel) {
core.info('PR contains label approved-for-integ-test')
return
}

core.setFailed('Pull Request must either have label approved-for-integ-test')
- name: Configure Credentials
uses: aws-actions/configure-aws-credentials@v4
with:
role-to-assume: ${{ secrets.STRANDS_INTEG_TEST_ROLE }}
aws-region: us-east-1
mask-aws-account-id: true
- name: Checkout base branch
- name: Checkout head commit
uses: actions/checkout@v4
with:
ref: ${{ github.event.pull_request.head.ref }} # Pull the commit from the forked repo
ref: ${{ github.event.pull_request.head.sha }} # Pull the commit from the forked repo
persist-credentials: false # Don't persist credentials for subsequent actions
- name: Set up Python
uses: actions/setup-python@v5
Expand Down
0