[aaron-kumo]

What

• Separate public tests from private-resource tests on NVIDIA runners.
• Run private CI and OpenAPI analysis through copy-pr-bot approval.
• Remove cloud login from public CI.
• Trim unused S3 fixture uploads.

Why

Allow third-party PRs to run public CI without private credentials, then run resource-backed tests and OpenAPI checks after SHA approval.

Incorporates the coverage-upload fix and adapts the merge-base approach from #142.

Validation

Local regressions, workflow security checks, and OpenAPI generation passed. Workflow lint has no new findings. Live provider validation remains pending.

Change map

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[aaron-kumo]

Change map

Fork PR jobs currently attempt cloud authentication before tests can run. Separate public tests from resource-backed suites, and reuse copy-pr-bot approval for private CI and OpenAPI analysis.

File	Function / scope	What changed	Why
.github/scripts/copied-pr.cjs	Copied PR context	Validate the PR/head SHA and calculate its local merge base	Share consistent change selection between private CI and OpenAPI; adapt Vedaant’s approach from #142
.github/scripts/openapi-pr.cjs	OpenAPI comment	Create or update one bot-owned comment and recheck the head before writing	Keep schema feedback current and give fork contributors local generation instructions
.github/scripts/approved-pr.test.cjs	Approved workflow regressions	Test copied-PR validation, divergent branch histories, stale reporting, and comment updates	Verify approval and reporting behavior without GitHub writes
.github/workflows/workflow-security.yml	Workflow checks	Run the approved-PR regressions alongside the security tests	Validate workflow helpers in public CI
.github/workflows/testing.yml	Public Python matrix	Remove cloud setup, select public cases, fail on test errors, and guard coverage upload after setup failures	Run public CI independently of private credentials; retain Vedaant’s coverage fix from #142
.github/workflows/install.yml	Installation smoke	Remove AWS setup and use the standard GitHub token; correct the Python label	Installation and imports passed without cloud identity
.github/workflows/ui-client-code-generate.yml	Approved OpenAPI analysis	Run schema analysis and PR commenting on approved copied branches; publish a summary and schema patch using the standard GitHub token	Provide schema feedback for approved fork PRs
.github/workflows/testing_private.yml	Private workflow	Run provider groups on approved copied branches, main, or manual dispatch; use shared PR validation and merge-base selection	Keep resource-backed tests on the approved execution path
.github/workflows/testing_gcs.yml, .github/workflows/testing_snowflake.yml, .github/workflows/testing_databricks.yml	Former hosted resource workflows, deleted	Consolidate their selected coverage into private jobs	Avoid credential-dependent execution on public runners and duplicate workflows
test/ci_resources.py	Pytest collection and reporting	Discover resource/profile metadata on tests, fixture closures and parameter marks; use annotated workload groups and provider gates; reject missing-credential skips and emit safe phase fields	Keep public/private selection complementary before fixtures execute
kumo/testing/_skip.py, kumo/testing/s3.py, kumo/testing/gcs.py, kumo/testing/bigquery.py, kumo/testing/adls.py, kumo/testing/databricks.py, kumo/testing/snowflake.py	Existing credential decorators	Attach resource metadata and Databricks auth profiles while preserving wrapper/factory behavior	Reuse existing credential gates for collection without probing private resources
test/conftest.py	Shared test setup	Register the selector and resource fixtures, preserve Snowflake selection, and configure/restore the selected deployment environment before cache fixtures	Keep collection free of E2E deployment changes and retain local fixture behavior
tools/ci_private_changes.py	Private job filters	Select provider jobs from changed paths, including changes to the shared copied-PR helper	Run relevant private suites when their inputs change
tools/run_private_tests.py	Provider test execution	Replace provider filename lists with component discovery and declared process profiles; retain manifests, JUnit, coverage and complete durations with URL/secret redaction	Establish live results without credential skips or authentication-mode interference; keep raw Temporal histories off public artifacts
test/scripts/test_ci_resources.py	Selection regression tests	Use six broad tests for fixture exclusion, complementary/balanced selection, new-component discovery, process/auth isolation, missing-credential failure, safe output and change gates	Verify the boundaries that keep private fixtures off public runners
test/io_utils/fsutil/test_fsutil.py	S3 scratch fixture	Mark the real S3 dependency directly and remove an unrelated dataset access probe	Ensure the case is selected privately before fixture setup
test/io_utils/fsutil/local/test_s3.py	Credential-free unit test	Explicitly isolate the missing AWS credentials file	Make the test independent of a developer's home credentials
test/rest/integ/fixture_connector_args.py	Selected fixture loading and opt-in source provisioning	Retain only the selected query/graph/tables and upload physically resolved input files with existing precedence	Avoid unrelated uploads while retaining generic helper behavior for other callers
test/rest/integ/test_diskgraph_public_api_e2e.py	Three local/S3 public API cases	Use selected-source provisioning and safe phase timings; declare the AWS workload group and remove import-time deployment setup	Reduce unnecessary S3 setup while preserving rows, assertions, both training jobs and refresh behavior
test/rest/integ/test_fixture_connector_args.py	Provisioning verification	Assert exactly the three selected Parquet inputs are copied with identical bytes	Guard the performance change against coverage/data drift
test/connector/conftest.py, test/io_utils/fsutil/test_all.py	Resource fixture and parameter declarations	Declare resources and dynamically requested Databricks PAT profiles beside fixtures and parameters	Avoid a central registry of fixture names
test/io_utils/test_json.py, test/io_utils/test_parquet_util.py, test/io_utils/snowflake/test_session.py, test/io_utils/snowflake/test_session_logging.py	Direct live test declarations	Mark live cases beside their definitions	Preserve private classification across test renames without a second name registry
test/rest/config/test_artifact_export_file_output.py, test/rest/driver/test_pquery_api_driver.py	Credential-free REST unit coverage	Mock AWS region discovery for coordinate resolution and use a local missing-file path	Keep unit coverage public without accidental AWS probes
docs/connector-test-matrix.md	CI behavior	Update workflow references and explain public selection, private discovery, annotations and separate collection entry points	Keep the existing guide current without adding a separate CI document
test/rest/conftest.py, test/rest/integ/conftest.py	Deployment and pool fixtures	Order deployment setup explicitly, declare the pool process profile and S3 parameter resources	Configure runtime after selection and preserve worker lifetime without filename routing
test/rest/integ/test_bigquery_diskgraph_e2e.py, test/rest/integ/test_bigquery_ingestion_diskgraph_e2e.py, test/rest/integ/test_snowflake_diskgraph_e2e.py, test/rest/integ/test_snowflake_ingestion_diskgraph_e2e.py	Warehouse E2E declarations	Declare workload/profile/change gates and S3 parameters; remove import-time deployment defaults	Preserve private coverage and existing provider gates through source annotations
test/rest/integ/test_diskgraph_e2e.py, test/rest/integ/test_diskgraph_custom_tt_e2e.py, test/rest/integ/test_databricks_diskgraph_e2e.py, test/rest/integ/test_data_variety/test_table_lifecycle.py	Pool-backed E2E setup	Remove import-time deployment defaults and mark the pinned S3 parameter where needed	Discover suites without changing process configuration during imports
test/rest/integ/test_gcs_e2e.py, test/rest/integ/test_gcs_public_api_e2e.py	GCS execution profiles	Declare GCP environment and change gates; include the existing v2 case in private discovery	Preserve legacy coverage and include the additional case approved by the user
test/connector/test_databricks_connector.py	Databricks seed staging	Declare AWS alongside Databricks for the S3 staging case and add a TODO to use a Databricks volume	Preserve the existing write test while documenting how to remove its AWS dependency

Verification: 20 Node tests, six selector/driver regressions, the fixture-provisioning regression, and OpenAPI generation passed locally. Workflow security and documentation checks passed; workflow lint has no new findings. Live provider results and the 25-minute CI target remain unverified.

Stopping condition: public and approved private CI pass on the current head, with no unexpected credential skips. Remove temporary phase instrumentation after S3 profiling.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[anle2024]

I am also working on this PR that separates cloud test from the original main CI so fork PRs only run public tests. #39 (in progress). I think PR#42 can supersede PR#39 so I will close my PR.

[aaron-kumo]

/ok to test 5369bc0

[aaron-kumo]

Hey @anle2024 , sorry, I didn't notice you have an existing PR targeted at this problem. I agree this PR supersedes it- for immediate unblock of @haoweiyu-kumo 's PR he updated it to not use a fork repository branch as that's not needed, but fork PR support will be needed when we start accepting 3p contributions. At that point we want to make sure CI can properly run for their PRs too (after we approve the CI to run, tests using our private creds should utilize NVIDIA private runners).

[anle2024]

Hey @anle2024 , sorry, I didn't notice you have an existing PR targeted at this problem. I agree this PR supersedes it- for immediate unblock of @haoweiyu-kumo 's PR he updated it to not use a fork repository branch as that's not needed, but fork PR support will be needed when we start accepting 3p contributions. At that point we want to make sure CI can properly run for their PRs too (after we approve the CI to run, tests using our private creds should utilize NVIDIA private runners).

That makes sense. I was also planning to work on the broader fork PR workflow and private CI setup, but held off after yesterday’s discussion since we are not targeting third-party contributions yet for this week. If we need this to unblock current work, I agree it makes sense to move ahead now.

[aaron-kumo]

/ok to test 8b24cd4