Fix PRs from forks #556

jsoref · 2025-10-23T21:17:43Z

Fix typos #539 and friends are all blocked because the CI is hostile to forks.
BOT NOTES:
resolves Pull requests from forks aren't mergable #559

solo-build-bot · 2025-10-23T21:17:47Z

Waiting for approval from someone in the solo-io org to start testing.

jsoref · 2025-10-23T21:18:11Z

.github/workflows/codeformat.yaml

@@ -1,16 +1,17 @@
-name: pull_request
+name: Code format check


Having two very unrelated workflows with the same name wasn't terribly helpful.

jsoref · 2025-10-23T21:18:28Z

.github/workflows/codeformat.yaml

    steps:
      - name: Cancel Previous Actions
-        uses: styfle/cancel-workflow-action@0.11.0
+        uses: styfle/cancel-workflow-action@0.12.1


I've upgraded each action as there doesn't appear to be any particular reason to use old actions

jsoref · 2025-10-23T21:18:45Z

.github/workflows/codeformat.yaml

          access_token: ${{ github.token }}
      - name: Free disk space
        run: |
+          : Free disk space


This is a fancy hack I've learned that makes reading GitHub action logs better

jsoref · 2025-10-23T21:19:23Z

.github/workflows/pull_request.yaml

-    - uses: google-github-actions/setup-gcloud@a48b55b3b0eeaf77b6e1384aab737fbefe2085ac
+
+    - name: Gcloud login
+      if: ${{ env.has_auth }}
+      uses: google-github-actions/auth@v2


Google refactored their actions a long time ago so that the login step is done by this other action.

jsoref · 2025-10-23T21:20:01Z

.github/workflows/pull_request.yaml

+      if: ${{ env.has_auth }}
+      uses: google-github-actions/auth@v2
      with:
-        version: '290.0.1'
        project_id: ${{ secrets.GCP_PROJECT_ID }}
-        service_account_key: ${{ secrets.GCP_SA_KEY }}
-        export_default_credentials: true
-      name: Gcloud Login
+        credentials_json: ${{ secrets.GCP_SA_KEY }}
+        create_credentials_file: true
+      env:
+        has_auth: ${{ secrets.GCP_PROJECT_ID && secrets.GCP_SA_KEY && 1 }}


In order to not try to auth when you don't have credentials, you have to bend over backwards because GitHub doesn't give you access to secrets in if

jsoref · 2025-10-23T21:28:52Z

changelogutils/reader_test.go


 		It("can read changelog file", func() {
-			changelogFile, err := reader.ReadChangelogFile(ctx, "changelog/v0.1.1/1.yaml")
+			changelogFile, err := reader.ReadChangelogFile(ctx, fmt.Sprintf("changelog/v0.1.1/%s", log))


Since I found a similar v0.1.1, I'm using Sprintf to select the filename -- I could have left the entire string in the variables above, but this seemed slightly easier to understand. (Apparently changelog/{rev}/ is a thing.)

jsoref · 2025-10-23T21:37:11Z

gcloudutils/builders/gcloud_test.go

+	if os.Getenv("SKIP_GCLOUD_TESTS") == "" {
+		Context("builders", func() {


This stuff needs Gcloud, and it's. incredibly dangerous to let foreign code run with credentials, so the safest thing to do is not to run it.

jsoref · 2025-10-23T21:37:43Z

githubutils/repo_client_test.go

+	if os.Getenv("HAS_CLOUDBUILD_GITHUB_TOKEN") == "" {
+		repo = "reporting-client"
+		repoWithoutReleasesName = "unik-hub"
+		sha = "af5d207720ee6b548704b06bfa6631f9a2897294"
+		commitsInSha = 2
+		commit1 = "7ef898bc3df32db0e1ed2dee70a838c955a7b422"
+		commit2 = "f47eacc21bd62e6bc8bb8954af0dc1817079af0d"
+		tagWithSha = "v0.1.2"
+		shaForTag = "a1c75ffaa40ea2b89368bfc338dc3f6f990b6df2"
+	}


a bunch of tests needed alternates. So these are the alternates

jsoref · 2025-10-23T21:38:57Z

githubutils/repo_client_test.go

+	Context("With write token", func() {
+		BeforeEach(func() {
+			if os.Getenv("HAS_CLOUDBUILD_GITHUB_TOKEN") == "" {
+				Skip("Needs write token")
+			}
+		})


As with the Gcloud stuff, these need write tokens and you can't safely give out write tokens to random people, so they have to be skipped. This is a problem, but, there isn't really a better approach. If it matters, a member should make their own branch based on the contributor's branch and make a new PR from that.

jsoref · 2025-10-23T21:42:23Z

Makefile

 GINKGO_VERSION ?= $(shell echo $(shell go list -m github.com/onsi/ginkgo/v2) | cut -d' ' -f2)
 GINKGO_ENV ?= GOLANG_PROTOBUF_REGISTRATION_CONFLICT=ignore ACK_GINKGO_DEPRECATIONS=$(GINKGO_VERSION)
-GINKGO_FLAGS ?= -v -tags=purego -compilers=4 -fail-fast -race -randomize-suites -randomize-all -skip-package=./installutils/kubeinstall,./debugutils/test
+GINKGO_FLAGS ?= -v -tags=purego -compilers=4 $(shell [ -z "${CI}" ] && echo '-fail-fast') -race -randomize-suites -randomize-all -skip-package=./installutils/kubeinstall,./debugutils/test


It took me a lot of round trips to GitHub to find and fix all of the items here. It would have been much less painful if -fail-fast was omitted. So, let's omit it for CI builds.

Can we add a new ENV variable GINKGO_FAIL_FAST_PARAM ?= --fail-fast that gets included here and overwritten by the CI env instead of inline shell?

Makefile magic is really something I'm happy to not have had to fight in my day-to-day work for over a decade. Getting ?= and similar operations right is above my paygrade. You should have enough permission to push to this PR if you have a syntax that works, please feel free to do so.

solo-changelog-bot · 2025-10-28T17:05:21Z

Issues linked to changelog:
#556

jsoref · 2025-10-28T17:21:46Z

@ashleywang1

ashleywang1 · 2025-11-24T01:27:55Z

@ashleywang1

Apologies for missing this - I no longer have write permissions in this repo. @sheidkamp would you be able to take a look?

sheidkamp · 2025-11-24T20:35:01Z

@ashleywang1

Apologies for missing this - I no longer have write permissions in this repo. @sheidkamp would you be able to take a look?

I can take a look, probably later in the week.

BTW, go-utils has been removed as a direct dependency of kgateway

sheidkamp

A couple notes.

Also validated in a fork of my own: sheidkamp#1

sheidkamp · 2025-12-05T18:43:04Z

Makefile

 GINKGO_VERSION ?= $(shell echo $(shell go list -m github.com/onsi/ginkgo/v2) | cut -d' ' -f2)
 GINKGO_ENV ?= GOLANG_PROTOBUF_REGISTRATION_CONFLICT=ignore ACK_GINKGO_DEPRECATIONS=$(GINKGO_VERSION)
-GINKGO_FLAGS ?= -v -tags=purego -compilers=4 -fail-fast -race -randomize-suites -randomize-all -skip-package=./installutils/kubeinstall,./debugutils/test
+GINKGO_FLAGS ?= -v -tags=purego -compilers=4 $(shell [ -z "${CI}" ] && echo '-fail-fast') -race -randomize-suites -randomize-all -skip-package=./installutils/kubeinstall,./debugutils/test


Can we add a new ENV variable GINKGO_FAIL_FAST_PARAM ?= --fail-fast that gets included here and overwritten by the CI env instead of inline shell?

.github/workflows/pull_request.yaml

jsoref · 2025-12-05T19:37:06Z

Makefile

 GINKGO_VERSION ?= $(shell echo $(shell go list -m github.com/onsi/ginkgo/v2) | cut -d' ' -f2)
 GINKGO_ENV ?= GOLANG_PROTOBUF_REGISTRATION_CONFLICT=ignore ACK_GINKGO_DEPRECATIONS=$(GINKGO_VERSION)
-GINKGO_FLAGS ?= -v -tags=purego -compilers=4 -fail-fast -race -randomize-suites -randomize-all -skip-package=./installutils/kubeinstall,./debugutils/test
+GINKGO_FLAGS ?= -v -tags=purego -compilers=4 $(shell [ -z "${CI}" ] && echo '-fail-fast') -race -randomize-suites -randomize-all -skip-package=./installutils/kubeinstall,./debugutils/test


Makefile magic is really something I'm happy to not have had to fight in my day-to-day work for over a decade. Getting ?= and similar operations right is above my paygrade. You should have enough permission to push to this PR if you have a syntax that works, please feel free to do so.

.github/workflows/pull_request.yaml

jsoref · 2026-01-21T02:36:43Z

@rpunia1 / @sheidkamp ?

sheidkamp · 2026-01-22T15:26:58Z

@jsoref - can you

commit Fix PRs from forks #556 (comment)
update the branch and changelog

After that we should be gtg, the other suggestions were more nits.

jsoref · 2026-01-22T15:49:22Z

What do you mean "update the branch", and can you provide content for the changelog?

sheidkamp · 2026-01-22T20:08:26Z

By "update the branch" I mean merge in main or rebase on main, either with git or rull the dice with the button on the PR.

Here's an example PR. https://github.com/solo-io/go-utils/blob/main/changelog/v0.9.9/fix-issues.yaml. Yours need to go into a new /v0.29.1 directory.

Signed-off-by: Josh Soref <[email protected]>

Google split auth out of setup-gcloud... Signed-off-by: Josh Soref <[email protected]>

Signed-off-by: Josh Soref <[email protected]>

jsoref · 2026-01-22T21:23:43Z

Err there already was a changelog file, it just needed to be moved to the new directory. Rebased and moved.

sheidkamp · 2026-01-23T13:46:52Z

rerunning the tests

sheidkamp

tests failing CI

changelog/v0.29.1/handle-prs-from-forks.yaml

solo-changelog-bot · 2026-01-23T14:24:18Z

Issues linked to changelog:
#559

Signed-off-by: Josh Soref <[email protected]>

jsoref commented Oct 23, 2025

View reviewed changes

jsoref mentioned this pull request Oct 24, 2025

Fix typos #539

Open

jsoref force-pushed the fix-pr-test branch 3 times, most recently from ad4f1c2 to fba93b3 Compare October 28, 2025 17:05

sheidkamp reviewed Dec 5, 2025

View reviewed changes

jsoref commented Dec 5, 2025

View reviewed changes

jsoref added 14 commits January 22, 2026 16:22

Remove deprecated ioutil

8ea7cd4

Signed-off-by: Josh Soref <[email protected]>

Add github token for PRs

768b47d

Signed-off-by: Josh Soref <[email protected]>

Add pretty run comment

f4f5a3a

Signed-off-by: Josh Soref <[email protected]>

Upgrade styfle/cancel-workflow-action to 0.12.1

a27af95

Signed-off-by: Josh Soref <[email protected]>

Upgrade actions/checkout to v5

89cb708

Signed-off-by: Josh Soref <[email protected]>

Upgrade actions/setup-go to v6

fbd29c7

Signed-off-by: Josh Soref <[email protected]>

Upgrade actions/setup-python to v6

b87aab0

Signed-off-by: Josh Soref <[email protected]>

Upgrade google-github-actions/setup-gcloud

cfebaad

Google split auth out of setup-gcloud... Signed-off-by: Josh Soref <[email protected]>

Name Testspace step

fb064dc

Signed-off-by: Josh Soref <[email protected]>

Name workflows

2be1b4b

Signed-off-by: Josh Soref <[email protected]>

Use public repositories

6aebe45

Signed-off-by: Josh Soref <[email protected]>

Skip Testspace steps for forks

5ad552c

Signed-off-by: Josh Soref <[email protected]>

Skip gcloud tests for forks/repositories without gcloud secrets

210b98c

Signed-off-by: Josh Soref <[email protected]>

Use public repository for forks/repository without github secrets

23de3b6

Signed-off-by: Josh Soref <[email protected]>

jsoref added 2 commits January 22, 2026 16:22

Skip tests that require write access when secrets are unavailable

90df1ac

Signed-off-by: Josh Soref <[email protected]>

Fail slow in CI

4a489ec

Signed-off-by: Josh Soref <[email protected]>

jsoref force-pushed the fix-pr-test branch from f4087fb to f688208 Compare January 22, 2026 21:23

sheidkamp reviewed Jan 23, 2026

View reviewed changes

changelog/v0.29.1/handle-prs-from-forks.yaml Show resolved Hide resolved

jsoref mentioned this pull request Jan 23, 2026

Pull requests from forks aren't mergable #559

Open

Warn if GCP_SA_KEY secret goes missing

f28142e

jsoref force-pushed the fix-pr-test branch from f688208 to 829cac4 Compare January 23, 2026 14:24

Add changelog

14a460e

Signed-off-by: Josh Soref <[email protected]>

jsoref force-pushed the fix-pr-test branch from 829cac4 to 14a460e Compare January 23, 2026 14:25

		if os.Getenv("SKIP_GCLOUD_TESTS") == "" {
		Context("builders", func() {

Fix PRs from forks #556

Are you sure you want to change the base?

Fix PRs from forks #556

Uh oh!

Conversation

jsoref commented Oct 23, 2025 • edited by solo-changelog-bot bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

solo-build-bot bot commented Oct 23, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

solo-changelog-bot bot commented Oct 28, 2025

Uh oh!

jsoref commented Oct 28, 2025

Uh oh!

ashleywang1 commented Nov 24, 2025

Uh oh!

sheidkamp commented Nov 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sheidkamp left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

jsoref commented Jan 21, 2026

Uh oh!

sheidkamp commented Jan 22, 2026

Uh oh!

jsoref commented Jan 22, 2026

Uh oh!

sheidkamp commented Jan 22, 2026

Uh oh!

jsoref commented Jan 22, 2026

Uh oh!

sheidkamp commented Jan 23, 2026

Uh oh!

sheidkamp left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

solo-changelog-bot bot commented Jan 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

jsoref commented Oct 23, 2025 •

edited by solo-changelog-bot bot

Loading

sheidkamp commented Nov 24, 2025 •

edited

Loading