Skip to content

Commit df157da

Browse files
kvapskvaps
authored
ci(workflows): open the E2E breakpoint for maintainer-authored PRs (#3158)
## What this PR does Decouples opening the E2E SSH breakpoint from the `debug` label. Today, the only way to open a breakpoint on a failed feature PR is to add the `debug` label. That same label also flips every job's `runs-on` onto self-hosted runners, so you cannot get a breakpoint on the normal ephemeral runner — debugging always drags the whole pipeline onto self-hosted infrastructure. This adds a maintainer-authorship path to the breakpoint's `if` condition: a failed PR whose author is an `OWNER`, `MEMBER`, or `COLLABORATOR` now opens the breakpoint automatically, with no label required and without moving the jobs onto self-hosted runners. The breakpoint simply holds the default `oracle-vm` ephemeral runner the job already runs on. The existing `debug` and `release` label paths are unchanged, and the `authorized-users` list still controls who may actually SSH into an open breakpoint (second defense layer). Workflow triggers are untouched — this is purely an `if`-condition change. ### Release note ```release-note ci(workflows): open the E2E SSH breakpoint automatically on failed maintainer-authored PRs, without requiring the `debug` label or moving the jobs onto self-hosted runners ``` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Updated E2E failure debugging so breakpoints can now open for pull requests authored by repository maintainers, not just when specific labels are applied. * Clarified the conditions and runner behavior for breakpoint access in the workflow documentation. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2 parents ee26a50 + 44c1e6e commit df157da

1 file changed

Lines changed: 11 additions & 4 deletions

File tree

‎.github/workflows/pull-requests.yaml‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -788,9 +788,15 @@ jobs:
788788
# ▸ Open an SSH breakpoint to the failing sandbox so maintainers can attach,
789789
# inspect Talos/Cozystack state and resume with `breakpoint resume`.
790790
#
791-
# Gated by the `debug` or `release` label (release PRs are bot-created,
792-
# so their presence implies maintainer authorship). authorized-users is
793-
# kept as a second defense layer at the breakpoint level.
791+
# Opens when the E2E job fails AND any of: the `debug` label, the
792+
# `release` label (release PRs are bot-created, so their presence
793+
# implies maintainer authorship), or the PR author is a maintainer
794+
# (author_association is OWNER/MEMBER/COLLABORATOR). The maintainer-
795+
# authorship path needs no label and does NOT move the jobs onto
796+
# self-hosted runners — only the `debug` label flips `runs-on`, so a
797+
# maintainer PR opens the breakpoint on the default oracle-vm runner the
798+
# job already uses and simply holds that ephemeral runner. authorized-users
799+
# is kept as a second defense layer controlling who may actually SSH in.
794800
#
795801
# Uses cozystack/breakpoint-action (fork of namespacelabs/breakpoint-action)
796802
# pinned by SHA. The fork adds: pause-idle mode (initial grace period for
@@ -808,7 +814,8 @@ jobs:
808814
failure() &&
809815
vars.BREAKPOINT_ENDPOINT != '' &&
810816
(contains(github.event.pull_request.labels.*.name, 'debug')
811-
|| contains(github.event.pull_request.labels.*.name, 'release'))
817+
|| contains(github.event.pull_request.labels.*.name, 'release')
818+
|| contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.pull_request.author_association))
812819
# cozystack/breakpoint-action v2-cozy.1
813820
# mode: pause-idle defaults: grace-period=20m, idle-timeout=10m
814821
uses: cozystack/breakpoint-action@a6f3a6f87be398ad63b6577351e3398e53f578e4

0 commit comments

Comments
 (0)