trusted-external-sweep.yml

name: Trusted External Sweep Dispatch
run-name: Trusted external sweep - PR #${{ github.event.pull_request.number }} @ ${{ github.event.pull_request.head.sha }}

# This workflow is intentionally control-plane only. It never checks out or
# executes pull-request code. A write-authorized collaborator applies one primary
# sweep label to approve the exact external head SHA, then this trusted event
# dispatches the existing e2e workflow from main with repository secrets.
# Each authorized label event approves an exact PR head; no event may cancel another.
on: # zizmor: ignore[concurrency-limits]
    # Control plane only: verifies writer permission and the exact labeled head, never executes PR code.
    pull_request_target: # zizmor: ignore[dangerous-triggers]
        branches:
            - main
        types:
            - labeled

permissions: {}

jobs:
    dispatch:
        name: dispatch
        permissions:
            actions: write # Dispatch authorized sweeps.
            contents: read
            pull-requests: write # Publish PR feedback.
        if: >-
            github.event.pull_request.head.repo.full_name != github.repository &&
            contains(
              fromJson('["full-sweep-enabled","non-canary-full-sweep-enabled","full-sweep-fail-fast"]'),
              github.event.label.name
            )
        runs-on: ubuntu-latest
        steps:
            - name: Authorize exact external revision and dispatch
              uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
              with:
                  github-token: ${{ github.token }}
                  script: |
                      const primaryLabels = new Set([
                        'full-sweep-enabled',
                        'non-canary-full-sweep-enabled',
                        'full-sweep-fail-fast',
                      ]);

                      const {data: access} = await github.rest.repos.getCollaboratorPermissionLevel({
                        owner: context.repo.owner,
                        repo: context.repo.repo,
                        username: context.actor,
                      });
                      if (typeof access?.permission !== 'string' || !access.permission ||
                          typeof access?.role_name !== 'string' || !access.role_name) {
                        throw new Error('Invalid repository permission response.');
                      }
                      const {permission, role_name: role} = access;
                      const trustedPermissions = ['admin', 'maintain', 'write'];
                      if (!trustedPermissions.includes(permission) || !trustedPermissions.includes(role)) {
                        core.setFailed(
                          `@${context.actor} has repository permission "${permission}" and role "${role}"; ` +
                          'both must be write, maintain, or admin to authorize external code.',
                        );
                        return;
                      }

                      const eventPull = context.payload.pull_request;
                      const {data: pull} = await github.rest.pulls.get({
                        owner: context.repo.owner,
                        repo: context.repo.repo,
                        pull_number: eventPull.number,
                      });
                      if (pull.state !== 'open' || pull.draft) {
                        core.setFailed('The pull request must be open and ready for review.');
                        return;
                      }
                      if (pull.head.repo?.full_name === context.payload.repository.full_name) {
                        core.setFailed('Trusted external dispatch is only for fork pull requests.');
                        return;
                      }
                      if (pull.head.sha !== eventPull.head.sha) {
                        core.setFailed(
                          `The PR advanced from ${eventPull.head.sha} to ${pull.head.sha}; ` +
                          'remove and re-add the sweep label to approve the new revision.',
                        );
                        return;
                      }

                      const labels = pull.labels.map((label) => label.name);
                      const primary = labels.filter((label) => primaryLabels.has(label));
                      if (primary.length !== 1 || primary[0] !== context.payload.label.name) {
                        core.setFailed(`Expected exactly the newly applied primary sweep label; found ${primary}.`);
                        return;
                      }
                      // GitHub recomputes the test merge commit asynchronously, so merge_commit_sha
                      // can still describe an older head. Wait for a settled mergeable state and
                      // require the merge commit to be built from the exact approved head.
                      let mergePull = pull;
                      for (let attempt = 0; attempt < 10 && mergePull.mergeable === null; attempt += 1) {
                        await new Promise((resolve) => setTimeout(resolve, 3000));
                        ({data: mergePull} = await github.rest.pulls.get({
                          owner: context.repo.owner,
                          repo: context.repo.repo,
                          pull_number: pull.number,
                        }));
                      }
                      if (mergePull.head.sha !== pull.head.sha) {
                        core.setFailed(
                          `The PR advanced from ${pull.head.sha} to ${mergePull.head.sha}; ` +
                          'remove and re-add the sweep label to approve the new revision.',
                        );
                        return;
                      }
                      if (mergePull.mergeable !== true) {
                        core.setFailed(
                          mergePull.mergeable === null
                            ? 'GitHub has not finished computing mergeability; re-add the label shortly.'
                            : 'The PR does not merge cleanly into main; resolve conflicts and re-add the label.',
                        );
                        return;
                      }
                      const mergeSha = mergePull.merge_commit_sha;
                      if (!mergeSha) {
                        core.setFailed('GitHub has not produced a merge commit; resolve conflicts and re-add the label.');
                        return;
                      }
                      const {data: mergeCommit} = await github.rest.git.getCommit({
                        owner: context.repo.owner,
                        repo: context.repo.repo,
                        commit_sha: mergeSha,
                      });
                      const mergeParents = mergeCommit.parents.map((parent) => parent.sha);
                      if (mergeParents.length !== 2 || mergeParents[1] !== pull.head.sha) {
                        core.setFailed(
                          `Merge commit ${mergeSha} has parents [${mergeParents.join(', ')}], not the approved ` +
                          `head ${pull.head.sha}; GitHub may still be recomputing it. Re-add the label shortly.`,
                        );
                        return;
                      }

                      const marker = `External PR #${pull.number} @ ${pull.head.sha.slice(0, 12)}`;
                      const dispatchStarted = Date.now();
                      await github.rest.actions.createWorkflowDispatch({
                        owner: context.repo.owner,
                        repo: context.repo.repo,
                        workflow_id: 'e2e-tests.yml',
                        ref: context.payload.repository.default_branch,
                        inputs: {
                          'test-name': marker,
                          'ref': mergeSha,
                          'changelog-base-ref': pull.base.sha,
                          'changelog-head-ref': pull.head.sha,
                          'trim-conc': 'false',
                          'all-evals': String(labels.includes('all-evals')),
                          'evals-only': String(labels.includes('evals-only')),
                          'fail-fast': String(primary[0].includes('fail-fast')),
                          'agentx-fast': String(labels.includes('agentx-fast')),
                        },
                      });

                      let dispatchedRun;
                      for (let attempt = 0; attempt < 15 && !dispatchedRun; attempt += 1) {
                        await new Promise((resolve) => setTimeout(resolve, 2000));
                        const runs = await github.rest.actions.listWorkflowRuns({
                          owner: context.repo.owner,
                          repo: context.repo.repo,
                          workflow_id: 'e2e-tests.yml',
                          event: 'workflow_dispatch',
                          per_page: 20,
                        });
                        dispatchedRun = runs.data.workflow_runs.find((run) =>
                          run.display_title === `e2e Test - ${marker}` &&
                          Date.parse(run.created_at) >= dispatchStarted - 5000
                        );
                      }

                      const runLink = dispatchedRun
                        ? `[trusted sweep run](${dispatchedRun.html_url})`
                        : '[End-to-End Tests workflow](https://github.com/SemiAnalysisAI/InferenceX/actions/workflows/e2e-tests.yml)';
                      const body = [
                        `Dispatched ${runLink} for approved external revision \`${pull.head.sha}\`.`,
                        'New commits are not trusted automatically; remove and re-add the primary sweep label to approve a new SHA.',
                        '',
                        `已为获批的外部提交 \`${pull.head.sha}\` 调度${runLink}。`,
                        '后续新提交不会自动获得信任；如需批准新的 SHA，请移除并重新添加主扫描标签。',
                      ].join('\n');
                      try {
                        await github.rest.issues.createComment({
                          owner: context.repo.owner,
                          repo: context.repo.repo,
                          issue_number: pull.number,
                          body,
                        });
                      } catch (error) {
                        core.warning(
                          `Sweep dispatched successfully, but the PR comment failed: ${error.message}`,
                        );
                      }