(gravitino) branch main updated: [MINOR] ci: Fix mcp-integration CI (action allowlist + skip blocked authz test) (#11720)

[mchades]

This is an automated email from the ASF dual-hosted git repository.

mchades pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/gravitino.git


The following commit(s) were added to refs/heads/main by this push:
     new 3d277583e9 [MINOR] ci: Fix mcp-integration CI (action allowlist + skip 
blocked authz test) (#11720)
3d277583e9 is described below

commit 3d277583e9e165413c1102cb4e4837d45f7fd73f
Author: Qi Yu <y...@datastrato.com>
AuthorDate: Thu Jun 18 09:34:31 2026 +0800

    [MINOR] ci: Fix mcp-integration CI (action allowlist + skip blocked authz 
test) (#11720)
    
    ### What changes were proposed in this pull request?
    
    Two fixes that unblock the `mcp-integration-test` (and
    `iceberg-rest-trino-integration-test`) CI:
    
    1. **Pin disallowed GitHub Actions to allowlisted versions.** The
    apache/gravitino org action allowlist rejects:
    - `dorny/paths-filter@de90cc6f…` →
    `fbd0ab8f3e69293af611ebaee6363fc25e6d187d` # v4.0.1 (the SHA already
    used by the other 13 workflows), in
    `iceberg-rest-trino-integration-test.yml` and
    `mcp-integration-test.yml`.
    - `astral-sh/setup-uv@v5` → `fac544c07dec837d0ccb6301d7b5580bf5edae39` #
    v8.2.0, in `mcp-integration-test.yml`.
    
    2. **Skip `test_write_denied_for_readonly_principal`** in
    `mcp-server/tests/integration/test_authz_e2e.py`. It drives a write
    through the `create_tag` MCP tool, but `create_tag` (with
    `alter_tag`/`delete_tag`) is disabled by default in `tools/tag.py` as a
    destructive-tool guard. With it disabled the call fails as `Unknown
    tool: 'create_tag'` rather than an authorization denial, so the
    assertion fails. No other enabled write tool is a drop-in
    (`associate_tag/policy_with_metadata`, `run_job` all require fixture
    entities that the setup does not create, so they would fail with "not
    found"). Re-enable once the PR that enables `create_tag` is merged.
    `test_audit_trail_attribution` is unaffected — `AuditMiddleware` emits a
    `deny` record for the requested tool name on any tool-call exception.
    
    ### Why are the changes needed?
    
    CI cannot run the affected workflows (disallowed actions) and the authz
    write-denial test cannot pass while `create_tag` is disabled.
    
    ### Does this PR introduce any user-facing change?
    
    No.
    
    ### How was this patch tested?
    
    CI only; no functional changes.
---
 .github/workflows/iceberg-rest-trino-integration-test.yml | 2 +-
 .github/workflows/mcp-integration-test.yml                | 4 ++--
 mcp-server/tests/integration/test_authz_e2e.py            | 9 +++++++++
 3 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/iceberg-rest-trino-integration-test.yml 
b/.github/workflows/iceberg-rest-trino-integration-test.yml
index fee150d7cc..754c49c0ce 100644
--- a/.github/workflows/iceberg-rest-trino-integration-test.yml
+++ b/.github/workflows/iceberg-rest-trino-integration-test.yml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36
+      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # 
v4.0.1
         id: filter
         with:
           filters: |
diff --git a/.github/workflows/mcp-integration-test.yml 
b/.github/workflows/mcp-integration-test.yml
index 959d439e82..697bc7c3d6 100644
--- a/.github/workflows/mcp-integration-test.yml
+++ b/.github/workflows/mcp-integration-test.yml
@@ -35,7 +35,7 @@ jobs:
       mcp_or_authz_changes: ${{ steps.filter.outputs.mcp_or_authz_changes }}
     steps:
       - uses: actions/checkout@v4
-      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36
+      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # 
v4.0.1
         id: filter
         with:
           filters: |
@@ -59,7 +59,7 @@ jobs:
           java-version: 17
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # 
v8.2.0
 
       - name: Build Gravitino distribution
         run: ./gradlew compileDistribution -x test -PskipWeb=true
diff --git a/mcp-server/tests/integration/test_authz_e2e.py 
b/mcp-server/tests/integration/test_authz_e2e.py
index 488e6245db..79f070fadc 100644
--- a/mcp-server/tests/integration/test_authz_e2e.py
+++ b/mcp-server/tests/integration/test_authz_e2e.py
@@ -83,6 +83,15 @@ def test_authorization_scoped_discovery(gravitino_fixture, 
integration_env):
     assert admin_catalogs != bob_catalogs
 
 
+@pytest.mark.skip(
+    reason="Depends on the 'create_tag' write tool, which is disabled by 
default "
+    "in the MCP server (destructive-tool gating in tools/tag.py). With it 
disabled "
+    "the call fails as 'Unknown tool' rather than an authorization denial. No 
other "
+    "enabled write tool works as a drop-in here: 
associate_tag/policy_with_metadata "
+    "and run_job all require fixture entities that the setup does not create, 
so they "
+    "would fail with 'not found' instead of a denial. Re-enable this test once 
the PR "
+    "that enables 'create_tag' is merged."
+)
 def test_write_denied_for_readonly_principal(
     gravitino_fixture, integration_env
 ):