Run golangci-lint as soon as ok-to-test is set

[sbueringer]

Today we have significant toil for maintainers because they always have to manually approve the golangci-lint action for outside contributors (by clicking on approve in the "checks box").

Goal of this issue is to ensure the action is run automatically as soon as the ok-to-test label is applied.

Proposed solution:

1. Configure in the repo settings that actions only require approval for first time GitHub users
2. Update the action to immediately fail with a nice error message if the ok-to-test label is missing

• Prior art: contains(github.event.pull_request.labels.*.name, 'ok-to-test')

Probably needs a bit of trial-and-error on a fork, but I think this should work

For 1.

There is potentially another alternative, which is approve workflows automatically if ok-to-test is set: https://github.com/kubernetes-sigs/metrics-server/blob/19802fd979b3c8cdf23297cebe9dc62448e9dc9d/.github/workflows/gh-workflow-approve.yaml#L14. This seems somewhat okay as it only requires actions write permissions. But I think I would prefer the option I mentioned above

[sbueringer]

@CecileRobertMichon @fabriziopandini @killianmuldoon @chrischdi What do you think?

[sbueringer]

/triage accepted

[sbueringer]

Kudos to @rikatz for sharing the idea!!

[killianmuldoon]

Sounds like a good idea to me for sure.

[chrischdi]

That sounds great. And should be safe because gh actions do not run with the config which is on a PR.

[chrischdi]

Solution 1 has an issue:

When e.g. adding the following to the steps of an action:

...
    steps:
      - name: Block testing
        if: ! contains(github.event.pull_request.labels.*.name, 'ok-to-test')
        run: echo "Requires ok-to-test" && exit 1

It would also require the ok-to-test label for PRs created by kubernetes-sigs members (which is currently not the case).

Also wondering how the second one works.

Using a gh action/workflow to allow gh actions/workflow. Isn't it the case that the gh-workflow-approve workflow won't run either?

[sbueringer]

Good points. What about checking for needs-ok-to-test?

[chrischdi]

needs-ok-to-test

Nope, can't do that. Sounds too easy 😂 I'll give it a try. That should do it!

[chrischdi]

Issue with that is: there is a small time window between creating a PR and gh actions which would run 🤔

[sbueringer]

Hm good point. Maybe you can check via https://cs.k8s.io/?q=%27ok-to-test%27&i=nope&files=&excludeFiles=&repos= how it works in other repos (and maybe also check how Prow determines when ok-to-test is needed)

[sbueringer]

Also wondering how the second one works.

I suspect it works somehow btw. Otherwise they use a broken action :D Maybe we just have to figure out how (or ask them)

[chrischdi]

Jep, the GH action to approve the workflows when ok-to-test label exists works 👍 I'll create a PR for this.

[sbueringer]

Sounds like a good option. Thx!

[killianmuldoon]

Hmm - on this PR: #9251

The ok-to-test seemed to work initially to run the golangci-lint. But since the PR was pushed again it does not seem to be working - the workflow needs to be approved again.

/reopen

[k8s-ci-robot]

@killianmuldoon: Reopened this issue.

In response to this:

Hmm - on this PR: #9251

The ok-to-test seemed to work initially to run the golangci-lint. But since the PR was pushed again it does not seem to be working - the workflow needs to be approved again.

/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[sbueringer]

Yup. It has to be approved after every single push

[sbueringer]

Probably have to trigger it in more cases: https://github.com/kubernetes-sigs/cluster-api/blob/main/.github/workflows/pr-gh-workflow-approve.yaml#L3

[chrischdi]

🤔 I'll test that again.

[chrischdi]

Tricky to catch the issue but this fixes it: #9259