(gravitino) branch branch-1.3 updated: [Cherry-pick to branch-1.3] [MINOR] ci: Fix mcp-integration CI (action allowlist + skip blocked authz test) (#11720) (#11725)

[mchades]

This is an automated email from the ASF dual-hosted git repository.

mchades pushed a commit to branch branch-1.3
in repository https://gitbox.apache.org/repos/asf/gravitino.git


The following commit(s) were added to refs/heads/branch-1.3 by this push:
     new 8f8df6e878 [Cherry-pick to branch-1.3] [MINOR] ci: Fix mcp-integration 
CI (action allowlist + skip blocked authz test) (#11720) (#11725)
8f8df6e878 is described below

commit 8f8df6e878514304027e1bfacc537536659a6da6
Author: github-actions[bot] 
<41898282+github-actions[bot]@users.noreply.github.com>
AuthorDate: Thu Jun 18 11:08:54 2026 +0800

    [Cherry-pick to branch-1.3] [MINOR] ci: Fix mcp-integration CI (action 
allowlist + skip blocked authz test) (#11720) (#11725)
    
    **Cherry-pick Information:**
    - Original commit: 3d277583e9e165413c1102cb4e4837d45f7fd73f
    - Target branch: `branch-1.3`
    - Status: ✅ Clean cherry-pick (no conflicts)
    
    Co-authored-by: Qi Yu <y...@datastrato.com>
---
 .github/workflows/iceberg-rest-trino-integration-test.yml | 2 +-
 .github/workflows/mcp-integration-test.yml                | 4 ++--
 mcp-server/tests/integration/test_authz_e2e.py            | 9 +++++++++
 3 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/iceberg-rest-trino-integration-test.yml 
b/.github/workflows/iceberg-rest-trino-integration-test.yml
index fee150d7cc..754c49c0ce 100644
--- a/.github/workflows/iceberg-rest-trino-integration-test.yml
+++ b/.github/workflows/iceberg-rest-trino-integration-test.yml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36
+      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # 
v4.0.1
         id: filter
         with:
           filters: |
diff --git a/.github/workflows/mcp-integration-test.yml 
b/.github/workflows/mcp-integration-test.yml
index 959d439e82..697bc7c3d6 100644
--- a/.github/workflows/mcp-integration-test.yml
+++ b/.github/workflows/mcp-integration-test.yml
@@ -35,7 +35,7 @@ jobs:
       mcp_or_authz_changes: ${{ steps.filter.outputs.mcp_or_authz_changes }}
     steps:
       - uses: actions/checkout@v4
-      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36
+      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # 
v4.0.1
         id: filter
         with:
           filters: |
@@ -59,7 +59,7 @@ jobs:
           java-version: 17
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # 
v8.2.0
 
       - name: Build Gravitino distribution
         run: ./gradlew compileDistribution -x test -PskipWeb=true
diff --git a/mcp-server/tests/integration/test_authz_e2e.py 
b/mcp-server/tests/integration/test_authz_e2e.py
index 488e6245db..79f070fadc 100644
--- a/mcp-server/tests/integration/test_authz_e2e.py
+++ b/mcp-server/tests/integration/test_authz_e2e.py
@@ -83,6 +83,15 @@ def test_authorization_scoped_discovery(gravitino_fixture, 
integration_env):
     assert admin_catalogs != bob_catalogs
 
 
+@pytest.mark.skip(
+    reason="Depends on the 'create_tag' write tool, which is disabled by 
default "
+    "in the MCP server (destructive-tool gating in tools/tag.py). With it 
disabled "
+    "the call fails as 'Unknown tool' rather than an authorization denial. No 
other "
+    "enabled write tool works as a drop-in here: 
associate_tag/policy_with_metadata "
+    "and run_job all require fixture entities that the setup does not create, 
so they "
+    "would fail with 'not found' instead of a denial. Re-enable this test once 
the PR "
+    "that enables 'create_tag' is merged."
+)
 def test_write_denied_for_readonly_principal(
     gravitino_fixture, integration_env
 ):