Repository navigation
Run fork integration's GitHub API jobs on allowlisted runners - #1101
Merged
Merged
Conversation
The databricks org IP allow list rejects GitHub API calls from GitHub-hosted runners, so `/integration-test` failed with HTTP 403 in the authorize job before anything ran. Move the authorize, reject, and report jobs to databricks-protected-runner-group, as ug-review and the user-journey gate already do, and read the PR through `gh api --jq` because that runner image does not guarantee a jq binary. Co-authored-by: Isaac <no-reply@databricks.com>
david-siqi-liu
requested review from
AarushiShah-db,
lilly-luo and
rohita5l
as code owners
October 12, 2026 17:18
rohita5l
approved these changes
Oct 12, 2026
The fake gh now answers only the exact --jq query the authorize step sends, so changing that expression fails the test instead of passing on canned output. The runner test also checks the linux-ubuntu-latest label, since a misspelled label would leave the jobs queued. Co-authored-by: Isaac <no-reply@databricks.com>
david-siqi-liu
enabled auto-merge
October 12, 2026 17:47
lilly-luo
approved these changes
Oct 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
After this PR,
/integration-testworks on fork PRs. Its three small jobs (authorize, non-member reply, result report) run ondatabricks-protected-runner-group, the same runnersug-review.ymland the user-journey gate already use.Before and after
/integration-testcomment:databricksorganization has an IP allow list enabled"). GitHub-hostedubuntu-latestrunners are not on the org allow list, so their GitHub API calls are rejected. Nothing replies on the PR and no status is posted. First seen on Memoize Databricks CLI tokens per process and skip impossible--no-browserre-auth #1017.Fork integrationstatus, runs Integration on the pinned commit, and reports back.Reading the PR head in the authorize step:
gh apipiped into a standalonejq.gh api --jqcall. The protected runner uses a custom image (ubuntu-22-04-crowdstrike-image) that does not guarantee ajqbinary, and gh has jq built in.Testing
tests/test_integration_contract.py(72 passed). The fakeghin the authorize-script test answers only the exact--jqquery the step sends, so changing that expression fails 6 cases. A new test fails if any fork-integration job loses the protected runner group or itslinux-ubuntu-latestlabel (a misspelled label fails it), goes back toubuntu-latest, or calls a barejq.databricks-protected-runner-group(scratch branch, since deleted):gh2.102.0 is installed, and the exactgh api --jqline read Memoize Databricks CLI tokens per process and skip impossible--no-browserre-auth #1017's head (f2db89b,yaoharry/unity-gateway) through the IP allow list with the job token.--no-browserre-auth #1017 run shows the member gate admits aMEMBERcomment. Theintegrationcall grants the same permissions asci.yml's. A fork head commit is fetchable by SHA from this repo. Windows JFrog OIDC accepts therefs/heads/mainsubject thatissue_commentruns get, as every main push run shows.issue_commentworkflows only run from the default branch, so the end-to-end check is commenting/integration-teston Memoize Databricks CLI tokens per process and skip impossible--no-browserre-auth #1017 after this merges.This pull request and its description were written by Isaac.