felipepessoto opened a new pull request, #12781:
URL: https://github.com/apache/gluten/pull/12781
Part of #12743.
## What changes are proposed in this pull request?
The Delta Spark UT pipeline added in #12388 runs per-PR only when its
`paths:` filter matches (`gluten-delta/**`, `backends-velox/src-delta*/**`, and
the pipeline's own files). A change to general Velox/core/native code does not
match that filter but can still break Delta offload, and today there is no way
for a contributor to force a run — `workflow_dispatch` needs write access to
this repo, and the nightly is not always soon enough.
#12743 lists a `run-delta-ci` **label** as the candidate. That does not work
for the people who need it most: changing labels requires write/triage
permission, so a PR author working from a fork cannot opt their own PR in. A
label also cannot be expressed as a `paths:` filter, so it would need a gate
job running `git diff` on *every* PR.
This PR adds a **`/delta-test` PR comment** instead — the same mechanism
`velox_backend_ansi.yml` already uses for `/ansi-test`:
- **Anyone can comment**, so a fork author can trigger the suite on their
own PR. Authorised commenters are the **PR author** or anyone with **write
access**.
- It is an **additional `on:` key**, not a change to the `pull_request`
trigger, so the `paths:` filter is untouched and PRs that don't ask for a run
still cost **zero jobs** — no per-PR gate job.
- `startsWith`, not `contains`, so quoting the command while discussing it
doesn't spend ~11 job-hours.
### How it works
An `issue_comment` run is created against the **default branch**, so
`github.ref` points at `main`, not the PR. One workflow-level `env` resolves
what to check out:
```yaml
DELTA_CHECKOUT_REF: ${{ github.event.issue.number &&
format('refs/pull/{0}/merge', github.event.issue.number) || '' }}
```
Every job then checks out `ref: ${{ env.DELTA_CHECKOUT_REF }}`. It is
**empty on every other event**, which is exactly what `actions/checkout` does
by default, so `pull_request`, `schedule` and `workflow_dispatch` behave
precisely as before. Using the PR's merge ref (what `pull_request` itself
tests) avoids any API call, job outputs or SHA plumbing.
A small `delta-test-requested` job holds the authorisation `if:` and posts a
link to the run — an `issue_comment` run belongs to the default branch, so
GitHub cannot attach it to the PR's Checks tab, and without the link the
contributor sees nothing happen for ~2.5 h. It is a separate job so that
`pull-requests: write` is never granted to a job that builds and runs the PR's
code. Everything else hangs off it via `needs`, so a comment that isn't
authorised skips the whole pipeline.
`update_baseline` stays reachable only from `workflow_dispatch`, so **no
comment can rewrite the committed baseline**.
### Cache scoping (why the cache steps changed)
A cache write is scoped to the run's `GITHUB_REF`. For `pull_request` that
is `refs/pull/N/merge`, isolated to the PR — but for `issue_comment` it is the
**default branch**, shared with every trusted run. Since these jobs compile and
execute the PR's code, saving there would let a PR plant a ccache/Maven/sbt
entry that the nightly on `main` later restores (the prefixed `restore-keys`
make it reachable), i.e. attacker-controlled compiler output in a trusted build.
So the three caches are split into restore + save, and comment-triggered
runs **restore but never save**. They still read the shared caches, so they are
no slower; they just don't contribute back. Workflow permissions are
additionally pinned to `contents: read`.
### Files
| File | Change |
|---|---|
| `.github/workflows/delta_spark_ut.yml` | `issue_comment` trigger,
`DELTA_CHECKOUT_REF`, `delta-test-requested` gate job, `ref:` on the 4
checkouts, cache restore/save split, `permissions`, PR-number concurrency key. |
| `.github/workflows/util/delta-spark-ut/README.md` | Documents
`/delta-test` under "When it runs". |
58 functional lines (the rest of the diff is comments and docs).
## How was this patch tested?
This change *is* CI, and the trigger can only be exercised once the workflow
is on the default branch. Verified statically instead:
- **actionlint** clean on `delta_spark_ut.yml`.
- **Authorisation truth table**, 10 cases: `pull_request` / `schedule` /
`workflow_dispatch` all pass through; comment on an issue (not a PR), a
non-author outsider, the command quoted mid-sentence, and ordinary PR chatter
are all rejected; PR author (including a first-time contributor), PR author
with trailing text, and a `MEMBER` on someone else's PR are all accepted.
- **`DELTA_CHECKOUT_REF`** resolves to `''` on `pull_request` / `schedule` /
`workflow_dispatch` and to `refs/pull/N/merge` on `issue_comment`; confirmed
against `actions/checkout`'s source that an empty `ref` reproduces its default
(`github.context.ref` + `github.context.sha`), so existing events are
unaffected.
- **Skip propagation**: with the gate skipped, all five downstream jobs skip
(verified against each job's existing `if:`).
- **Cache read/write split** asserted programmatically: every `save` is
gated on `issue_comment`, every `restore` is not.
- **No untrusted data** (`github.event.comment.*` / `github.event.issue.*`)
is interpolated into any `run:` block; it is passed via `env:` only.
- Confirmed `actions/checkout`'s `assertSafePrCheckout` guard only fires on
`pull_request_target` / `workflow_run`, so `issue_comment` needs no
`allow-unsafe-pr-checkout`.
Once merged, `/delta-test` on any PR is the end-to-end test.
## Was this patch authored or co-authored using generative AI tooling?
Generated-by: GitHub Copilot CLI
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
