Skip to content

Commit 9c7bfb8

Browse files
lexfreilexfrei
authored
ci(workflows): make the E2E breakpoint fully label opt-in (#3926)
## What this PR does The SSH debug breakpoint that opens on a failed end-to-end run used to open automatically for pull requests authored by any project maintainer, even when nobody intended to use it, in addition to opening for pull requests carrying an explicit label. Every red end-to-end run on such a pull request held an ephemeral CI runner open for up to twenty minutes for a breakpoint nobody attached to, which adds up across an ordinary day of pull requests. This change makes the breakpoint strictly opt-in: it now opens only when the pull request carries the debug label or the release label. A maintainer who wants to attach adds the debug label before or after the run fails. The step's explanatory comment is trimmed to match: the paragraph describing the removed authorship path, including a claim about runner selection that no longer applied to the current workflow, is removed rather than rewritten. ### Screenshots Not applicable: this is a CI workflow text change with no user interface. ### Downstream repositories - [x] No downstream repository is affected by this change - [ ] [cozystack/website](https://github.com/cozystack/website) - follow-up: - [ ] [cozystack/terraform-provider-cozystack](https://github.com/cozystack/terraform-provider-cozystack) - follow-up: - [ ] [cozystack/ansible-cozystack](https://github.com/cozystack/ansible-cozystack) - follow-up: - [ ] [cozystack/ccp](https://github.com/cozystack/ccp) - follow-up: - [ ] [cozystack/talm](https://github.com/cozystack/talm) - follow-up: - [ ] [cozystack/cozyhr](https://github.com/cozystack/cozyhr) - follow-up: - [ ] [cozystack/cozy-proxy](https://github.com/cozystack/cozy-proxy) - follow-up: - [ ] [cozystack/cozystack-telemetry-server](https://github.com/cozystack/cozystack-telemetry-server) - follow-up: - [ ] [cozystack/external-apps-example](https://github.com/cozystack/external-apps-example) - follow-up: - [ ] [cozystack/examples](https://github.com/cozystack/examples) - follow-up: ### Release note ```release-note NONE ```
2 parents 4ebf9c2 + 61f7939 commit 9c7bfb8

1 file changed

Lines changed: 5 additions & 11 deletions

File tree

‎.github/workflows/pull-requests.yaml‎

Lines changed: 5 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1121,15 +1121,10 @@ jobs:
11211121
# ▸ Open an SSH breakpoint to the failing sandbox so maintainers can attach,
11221122
# inspect Talos/Cozystack state and resume with `breakpoint resume`.
11231123
#
1124-
# Opens when the E2E job fails AND any of: the `debug` label, the
1125-
# `release` label (release PRs are bot-created, so their presence
1126-
# implies maintainer authorship), or the PR author is a maintainer
1127-
# (author_association is OWNER/MEMBER/COLLABORATOR). The maintainer-
1128-
# authorship path needs no label and does NOT move the jobs onto
1129-
# self-hosted runners — only the `debug` label flips `runs-on`, so a
1130-
# maintainer PR opens the breakpoint on the default oracle-vm runner the
1131-
# job already uses and simply holds that ephemeral runner. authorized-users
1132-
# is kept as a second defense layer controlling who may actually SSH in.
1124+
# Opens when the E2E job fails AND the PR carries the `debug` label or
1125+
# the `release` label (release PRs are bot-created, so the label
1126+
# implies maintainer authorship). authorized-users is kept as a second
1127+
# defense layer controlling who may actually SSH in.
11331128
#
11341129
# Uses cozystack/breakpoint-action (fork of namespacelabs/breakpoint-action)
11351130
# pinned by SHA. The fork adds: pause-idle mode (initial grace period for
@@ -1147,8 +1142,7 @@ jobs:
11471142
failure() &&
11481143
vars.BREAKPOINT_ENDPOINT != '' &&
11491144
(contains(github.event.pull_request.labels.*.name, 'debug')
1150-
|| contains(github.event.pull_request.labels.*.name, 'release')
1151-
|| contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.pull_request.author_association))
1145+
|| contains(github.event.pull_request.labels.*.name, 'release'))
11521146
# cozystack/breakpoint-action v2-cozy.1
11531147
# mode: pause-idle defaults: grace-period=20m, idle-timeout=10m
11541148
uses: cozystack/breakpoint-action@a6f3a6f87be398ad63b6577351e3398e53f578e4

0 commit comments

Comments
 (0)