This is an automated email from the ASF dual-hosted git repository. github-actions[bot] pushed a commit to branch cherry-pick-3d277583-to-branch-1.3 in repository https://gitbox.apache.org/repos/asf/gravitino.git
commit e298589a60a7aa8ae172f93709bc77804e09effe Author: Qi Yu <[email protected]> AuthorDate: Thu Jun 18 09:34:31 2026 +0800 [MINOR] ci: Fix mcp-integration CI (action allowlist + skip blocked authz test) (#11720) ### What changes were proposed in this pull request? Two fixes that unblock the `mcp-integration-test` (and `iceberg-rest-trino-integration-test`) CI: 1. **Pin disallowed GitHub Actions to allowlisted versions.** The apache/gravitino org action allowlist rejects: - `dorny/paths-filter@de90cc6fâŚ` â `fbd0ab8f3e69293af611ebaee6363fc25e6d187d` # v4.0.1 (the SHA already used by the other 13 workflows), in `iceberg-rest-trino-integration-test.yml` and `mcp-integration-test.yml`. - `astral-sh/setup-uv@v5` â `fac544c07dec837d0ccb6301d7b5580bf5edae39` # v8.2.0, in `mcp-integration-test.yml`. 2. **Skip `test_write_denied_for_readonly_principal`** in `mcp-server/tests/integration/test_authz_e2e.py`. It drives a write through the `create_tag` MCP tool, but `create_tag` (with `alter_tag`/`delete_tag`) is disabled by default in `tools/tag.py` as a destructive-tool guard. With it disabled the call fails as `Unknown tool: 'create_tag'` rather than an authorization denial, so the assertion fails. No other enabled write tool is a drop-in (`associate_tag/policy_with_metadata`, `run_job` all require fixture entities that the setup does not create, so they would fail with "not found"). Re-enable once the PR that enables `create_tag` is merged. `test_audit_trail_attribution` is unaffected â `AuditMiddleware` emits a `deny` record for the requested tool name on any tool-call exception. ### Why are the changes needed? CI cannot run the affected workflows (disallowed actions) and the authz write-denial test cannot pass while `create_tag` is disabled. ### Does this PR introduce any user-facing change? No. ### How was this patch tested? CI only; no functional changes. --- .github/workflows/iceberg-rest-trino-integration-test.yml | 2 +- .github/workflows/mcp-integration-test.yml | 4 ++-- mcp-server/tests/integration/test_authz_e2e.py | 9 +++++++++ 3 files changed, 12 insertions(+), 3 deletions(-) diff --git a/.github/workflows/iceberg-rest-trino-integration-test.yml b/.github/workflows/iceberg-rest-trino-integration-test.yml index fee150d7cc..754c49c0ce 100644 --- a/.github/workflows/iceberg-rest-trino-integration-test.yml +++ b/.github/workflows/iceberg-rest-trino-integration-test.yml @@ -19,7 +19,7 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 + - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1 id: filter with: filters: | diff --git a/.github/workflows/mcp-integration-test.yml b/.github/workflows/mcp-integration-test.yml index 959d439e82..697bc7c3d6 100644 --- a/.github/workflows/mcp-integration-test.yml +++ b/.github/workflows/mcp-integration-test.yml @@ -35,7 +35,7 @@ jobs: mcp_or_authz_changes: ${{ steps.filter.outputs.mcp_or_authz_changes }} steps: - uses: actions/checkout@v4 - - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 + - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1 id: filter with: filters: | @@ -59,7 +59,7 @@ jobs: java-version: 17 - name: Install uv - uses: astral-sh/setup-uv@v5 + uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 - name: Build Gravitino distribution run: ./gradlew compileDistribution -x test -PskipWeb=true diff --git a/mcp-server/tests/integration/test_authz_e2e.py b/mcp-server/tests/integration/test_authz_e2e.py index 488e6245db..79f070fadc 100644 --- a/mcp-server/tests/integration/test_authz_e2e.py +++ b/mcp-server/tests/integration/test_authz_e2e.py @@ -83,6 +83,15 @@ def test_authorization_scoped_discovery(gravitino_fixture, integration_env): assert admin_catalogs != bob_catalogs [email protected]( + reason="Depends on the 'create_tag' write tool, which is disabled by default " + "in the MCP server (destructive-tool gating in tools/tag.py). With it disabled " + "the call fails as 'Unknown tool' rather than an authorization denial. No other " + "enabled write tool works as a drop-in here: associate_tag/policy_with_metadata " + "and run_job all require fixture entities that the setup does not create, so they " + "would fail with 'not found' instead of a denial. Re-enable this test once the PR " + "that enables 'create_tag' is merged." +) def test_write_denied_for_readonly_principal( gravitino_fixture, integration_env ):
