trigger-integration-tests.yml

name: Trigger Integration Tests

# Dispatches the proxy-based Go integration suite in
# databricks/databricks-driver-test to run against this PR's commit, and reports
# the result back as the "Go Integration Tests" check.
#
# Matches the label-gated / merge-queue pattern used by the Node.js and Python
# connectors: normal PR events get an immediate green check, maintainers can
# preview with the `integration-test` label (replay) or `integration-test-full`
# (full passthrough), and merge queue runs the real required gate.
#
# The suite runs against either driver backend, selected by the label:
#   - `integration-test` (replay) / `integration-test-full` (passthrough) → Thrift
#   - `integration-test-kernel` (passthrough)                             → SEA-via-kernel
# The kernel label adds `go_mode: sea` to the dispatch payload; driver-test then
# builds the kernel static lib and runs the tagged (databricks_kernel) leg. It uses
# passthrough (real warehouse) — the sea leg has no committed recordings to replay
# yet, so there is no sea replay label until those are captured.
#
# Required external setup:
#
#   1. The three trigger labels exist in this repo: `integration-test`,
#      `integration-test-full`, `integration-test-kernel`.
#   2. `INTEGRATION_TEST_APP_ID` / `INTEGRATION_TEST_PRIVATE_KEY` repo secrets
#      are installed in this repo for the dispatcher GitHub App.
#   3. The app is installed/granted on `databricks-driver-test` so this workflow
#      can send `repository_dispatch`.
#   4. The same app is installed/granted on `databricks-sql-go` with checks:write
#      so driver-test can report the final `Go Integration Tests` check back to
#      this PR/merge-queue commit.
#   5. Merge queue branch protection lists `Go Integration Tests` as a required
#      status check.

on:
  pull_request:
    types: [opened, synchronize, reopened, labeled, closed]
  merge_group: # the required gate runs here

jobs:
  # Drop the trigger labels when new commits are pushed, forcing a maintainer to
  # re-review before re-running.
  remove-label-on-new-commit:
    if: github.event_name == 'pull_request' && github.event.action == 'synchronize'
    runs-on:
      group: databricks-protected-runner-group
      labels: linux-ubuntu-latest
    permissions:
      # removeLabel needs issues:write; commenting on a PR needs pull-requests:write
      # (GitHub requires the PR scope for issues.createComment on a PR).
      issues: write
      pull-requests: write
    steps:
      - name: Remove integration-test labels
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const present = context.payload.pull_request.labels.map((l) => l.name);
            const triggerLabels = ['integration-test', 'integration-test-full', 'integration-test-kernel'];
            const removed = [];
            for (const name of triggerLabels) {
              if (!present.includes(name)) continue;
              try {
                await github.rest.issues.removeLabel({
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  issue_number: context.issue.number,
                  name,
                });
                removed.push(name);
              } catch (error) {
                if (error.status !== 404) throw error;
              }
            }
            if (removed.length) {
              const pr = context.payload.pull_request;
              // head.repo is null when the PR's source fork has been deleted; treat an
              // absent/differing head repo as a fork so this never throws on that edge.
              const isFromFork = pr.head.repo?.full_name !== pr.base.repo.full_name;
              const repoType = isFromFork ? '**fork PR**' : 'PR';
              const body = [
                'Integration test approval reset.',
                '',
                `New commits were pushed to this ${repoType}. Label(s) \`${removed.join('`, `')}\` were removed for security.`,
                '',
                '**A maintainer must re-review and re-add a label to preview tests again.** (The real gate runs in the merge queue.)',
                '',
                `Latest commit: ${pr.head.sha.substring(0, 7)}`,
              ].join('\n');
              await github.rest.issues.createComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: context.issue.number,
                body,
              });
            }

  # NOTE: the PR-open "skipped" placeholder for the required `Go Integration Tests`
  # check is NOT posted here. It is posted by the companion workflow
  # `skip-checks-reporter.yml`, which runs on `workflow_run` in the base-repo context
  # so it can post the check as the driver-test app (the app the branch ruleset pins
  # the required check to) on EVERY PR head — including fork PRs, whose own
  # `pull_request` run gets a read-only token and cannot post checks at all. A
  # `pull_request`-triggered stub here could only post via `github.token`
  # (github-actions app), which would neither satisfy the app-pinned gate nor work on
  # forks. See skip-checks-reporter.yml.

  # Labeled PR: preview on demand. `integration-test` → replay,
  # `integration-test-full` → full passthrough.
  trigger-tests-pr:
    if: |
      github.event_name == 'pull_request' &&
      github.event.action == 'labeled' &&
      (github.event.label.name == 'integration-test' ||
       github.event.label.name == 'integration-test-full' ||
       github.event.label.name == 'integration-test-kernel')
    runs-on:
      group: databricks-protected-runner-group
      labels: linux-ubuntu-latest
    permissions:
      # Commenting on a PR needs pull-requests:write (issues.createComment on a PR
      # requires the PR scope); checks:write for the failure check. The dispatch
      # itself uses the App token, not GITHUB_TOKEN.
      issues: write
      pull-requests: write
      checks: write
    steps:
      - name: Resolve proxy mode + backend from label
        id: mode
        # go_mode: integration-test-kernel runs the SEA-via-kernel backend; the others
        # run Thrift. proxy_mode: integration-test-full and integration-test-kernel hit
        # the real warehouse (passthrough); plain integration-test serves recordings
        # (replay). The kernel label is passthrough because the sea leg has no committed
        # recordings to replay yet. driver-test reads go_mode to decide whether to build
        # the kernel lib and run the tagged leg.
        run: |
          LABEL="${{ github.event.label.name }}"
          case "$LABEL" in
            integration-test-full|integration-test-kernel) echo "proxy_mode=passthrough" >> "$GITHUB_OUTPUT" ;;
            *)                                             echo "proxy_mode=replay"      >> "$GITHUB_OUTPUT" ;;
          esac
          case "$LABEL" in
            integration-test-kernel) echo "go_mode=sea"    >> "$GITHUB_OUTPUT" ;;
            *)                       echo "go_mode=thrift" >> "$GITHUB_OUTPUT" ;;
          esac

      - name: Generate GitHub App token (driver-test repo)
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          app-id: ${{ secrets.INTEGRATION_TEST_APP_ID }}
          private-key: ${{ secrets.INTEGRATION_TEST_PRIVATE_KEY }}
          owner: databricks
          repositories: databricks-driver-test

      - name: Dispatch go-pr-test to driver-test
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          PROXY_MODE: ${{ steps.mode.outputs.proxy_mode }}
          GO_MODE: ${{ steps.mode.outputs.go_mode }}
        with:
          github-token: ${{ steps.app-token.outputs.token }}
          script: |
            const pr = context.payload.pull_request;
            await github.rest.repos.createDispatchEvent({
              owner: 'databricks',
              repo: 'databricks-driver-test',
              event_type: 'go-pr-test',
              client_payload: {
                pr_number: `${pr.number}`,
                commit_sha: pr.head.sha,
                pr_repo: context.repo.owner + '/' + context.repo.repo,
                pr_url: pr.html_url,
                proxy_mode: process.env.PROXY_MODE,
                go_mode: process.env.GO_MODE,
              },
            });
            core.info(`Dispatched go-pr-test (${process.env.GO_MODE}/${process.env.PROXY_MODE}) for PR #${pr.number} @ ${pr.head.sha}`);

      - name: Fail check on dispatch error
        if: failure()
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          github-token: ${{ github.token }}
          script: |
            await github.rest.checks.create({
              owner: context.repo.owner,
              repo: context.repo.repo,
              name: 'Go Integration Tests',
              head_sha: context.payload.pull_request.head.sha,
              status: 'completed',
              conclusion: 'failure',
              completed_at: new Date().toISOString(),
              output: {
                title: 'Failed - error dispatching tests',
                summary: 'An error occurred while dispatching Go integration tests. Check this workflow run for details.',
              },
            });

      - name: Comment on PR
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          PROXY_MODE: ${{ steps.mode.outputs.proxy_mode }}
          GO_MODE: ${{ steps.mode.outputs.go_mode }}
        with:
          script: |
            await github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              body: `Go integration tests triggered (\`${process.env.GO_MODE}\` / \`${process.env.PROXY_MODE}\`). [View workflow runs](https://github.com/databricks/databricks-driver-test/actions).`,
            });

  # Merge queue: the required gate. Runs replay once before merge.
  merge-queue-go:
    if: github.event_name == 'merge_group'
    runs-on:
      group: databricks-protected-runner-group
      labels: linux-ubuntu-latest
    permissions:
      contents: read
      checks: write
    steps:
      - name: Extract PR number from merge queue ref
        id: extract-pr
        env:
          MERGE_QUEUE_REF: ${{ github.event.merge_group.head_ref }}
        run: |
          # Merge-queue refs are refs/heads/gh-readonly-queue/<base>/pr-<n>-<sha>. Anchor
          # to the trailing pr-<n>-<sha> so a base branch name that itself contains a
          # "pr-<digits>" segment (e.g. feature/pr-123-fix) can't be matched instead of the
          # real, last PR number. Requires the SHA suffix so the match is the queue segment.
          if [[ "$MERGE_QUEUE_REF" =~ /pr-([0-9]+)-[0-9a-f]+$ ]]; then
            echo "pr_number=${BASH_REMATCH[1]}" >> "$GITHUB_OUTPUT"
          else
            echo "Error: failed to extract PR number from merge group ref: '$MERGE_QUEUE_REF'" >&2
            exit 1
          fi

      - name: Generate GitHub App token (driver-test repo)
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          app-id: ${{ secrets.INTEGRATION_TEST_APP_ID }}
          private-key: ${{ secrets.INTEGRATION_TEST_PRIVATE_KEY }}
          owner: databricks
          repositories: databricks-driver-test

      - name: Dispatch go-pr-test (replay) for merge queue
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          PR_NUMBER: ${{ steps.extract-pr.outputs.pr_number }}
          HEAD_SHA: ${{ github.event.merge_group.head_sha }}
        with:
          github-token: ${{ steps.app-token.outputs.token }}
          script: |
            const prNumber = process.env.PR_NUMBER;
            await github.rest.repos.createDispatchEvent({
              owner: 'databricks',
              repo: 'databricks-driver-test',
              event_type: 'go-pr-test',
              client_payload: {
                pr_number: prNumber,
                commit_sha: process.env.HEAD_SHA,
                pr_repo: context.repo.owner + '/' + context.repo.repo,
                pr_url: `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/pull/${prNumber}`,
                proxy_mode: 'replay',
                // The required merge-queue gate runs the Thrift backend only. The
                // kernel (sea) leg is previewed on demand via the kernel labels but
                // is not a required gate — it becomes one once the SEA backend ships
                // in a released driver and its recordings are captured.
                go_mode: 'thrift',
              },
            });
            core.info(`Merge-queue dispatch go-pr-test (thrift/replay) for PR #${prNumber} @ ${process.env.HEAD_SHA}`);

      - name: Fail check on dispatch error
        if: failure()
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          HEAD_SHA: ${{ github.event.merge_group.head_sha }}
        with:
          github-token: ${{ github.token }}
          script: |
            await github.rest.checks.create({
              owner: context.repo.owner,
              repo: context.repo.repo,
              name: 'Go Integration Tests',
              head_sha: process.env.HEAD_SHA,
              status: 'completed',
              conclusion: 'failure',
              completed_at: new Date().toISOString(),
              output: {
                title: 'Failed - error dispatching tests',
                summary: 'An error occurred while dispatching Go integration tests. Check this workflow run for details.',
              },
            });

  # =============================================================================
  # After merge: trigger the multi-language coverage fan-out.
  # Fires when a PR lands on main (merge queue or direct merge) and touched Go
  # driver source. Dispatches `coverage-fanout` to databricks-driver-test, whose
  # coverage-fanout-tracker.yml creates a tracking issue and kicks off the
  # language-agnostic fan-out (spec authored from THIS PR's diff, then conformed
  # across every driver) as peco-engineer-bot.
  # =============================================================================
  trigger-coverage-fanout:
    if: |
      github.event_name == 'pull_request' &&
      github.event.action == 'closed' &&
      github.event.pull_request.merged == true &&
      github.event.pull_request.base.ref == 'main'
    runs-on:
      group: databricks-protected-runner-group
      labels: linux-ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
    steps:
      - name: Check if Go driver source changed
        id: changed
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const files = await github.paginate(github.rest.pulls.listFiles, {
              owner: context.repo.owner,
              repo: context.repo.repo,
              pull_number: context.payload.pull_request.number,
              per_page: 100,
            });
            // The whole repo IS the Go driver. Count a merge as source-affecting
            // when it changes a NON-test .go file outside examples/ and testdata/.
            // Docs/CI/test-only merges do not warrant a full multi-language fan-out.
            const isSource = (f) =>
              f.endsWith('.go') &&
              !f.endsWith('_test.go') &&
              !f.startsWith('examples/') &&
              !f.startsWith('testdata/');
            const srcChanged = files.some((f) => isSource(f.filename));
            console.log(`Go driver source changed: ${srcChanged}`);
            core.setOutput('source', srcChanged.toString());

      - name: Generate GitHub App token (databricks-driver-test)
        if: steps.changed.outputs.source == 'true'
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          app-id: ${{ secrets.INTEGRATION_TEST_APP_ID }}
          private-key: ${{ secrets.INTEGRATION_TEST_PRIVATE_KEY }}
          owner: databricks
          repositories: databricks-driver-test
          permission-contents: write

      - name: Dispatch coverage-fanout
        if: steps.changed.outputs.source == 'true'
        uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3.0.0
        with:
          token: ${{ steps.app-token.outputs.token }}
          repository: databricks/databricks-driver-test
          event-type: coverage-fanout
          client-payload: '{"reference_repo": "${{ github.repository }}", "pr_number": "${{ github.event.pull_request.number }}", "pr_url": "${{ github.event.pull_request.html_url }}"}'