Separate public CI from private resource tests

.github/scripts/approved-pr.test.cjs

@@ -0,0 +1,141 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES.
+// All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+const assert = require('node:assert/strict');
+const { execFileSync } = require('node:child_process');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const test = require('node:test');
+const { readCopiedPullRequest, setCopiedPullRequestOutputs } = require('./copied-pr.cjs');
+const { reportOpenAPI } = require('./openapi-pr.cjs');
+
+function fixture({ changed = true, comments = [], fork = true } = {}) {
+  const context = {
+    eventName: 'push', ref: 'refs/heads/pull-request/42', sha: 'a'.repeat(40),
+    repo: { owner: 'example', repo: 'engine' }, serverUrl: 'https://github.com', runId: 123,
+  };
+  const pr = {
+    number: 42, state: 'open',
+    head: { sha: context.sha, repo: { full_name: fork ? 'contributor/engine' : 'example/engine' } },
+    base: { sha: 'b'.repeat(40), repo: { full_name: 'example/engine' } },
+  };
+  const writes = [];
+  const github = {
+    rest: {
+      pulls: { get: async (args) => { assert.equal(args.pull_number, 42); return { data: pr }; } },
+      issues: {
+        listComments: () => {},
+        createComment: async (args) => writes.push({ kind: 'create', ...args }),
+        updateComment: async (args) => writes.push({ kind: 'update', ...args }),
+      },
+    },
+    paginate: async () => comments,
+  };
+  return { github, context, changed, pr, writes };
+}
+
+test('only current copied commits of open PRs targeting this repository are accepted', async () => {
+  const f = fixture();
+  assert.equal(await readCopiedPullRequest(f), f.pr);
+  for (const [field, value] of [['eventName', 'pull_request'], ['ref', 'refs/heads/main'], ['ref', 'refs/heads/pull-request/42/extra']]) {
+    await assert.rejects(readCopiedPullRequest({ ...f, context: { ...f.context, [field]: value } }), /copy-pr-bot/);
+  }
+  f.pr.head.sha = 'c'.repeat(40);
+  await assert.rejects(readCopiedPullRequest(f), /stale/);
+  f.pr.head.sha = f.context.sha;
+  f.pr.state = 'closed';
+  await assert.rejects(readCopiedPullRequest(f), /open pull request/);
+  f.pr.state = 'open';
+  f.pr.base.repo.full_name = 'other/engine';
+  await assert.rejects(readCopiedPullRequest(f), /this repository/);
+});
+
+test('merge-base selection retains earlier PR changes and excludes independent base changes', async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'copied-pr-base-'));
+  const previous = process.cwd();
+  const git = (...args) => execFileSync('git', ['-c', 'user.name=CI Test', '-c', 'user.email=ci@example.test',
+    '-c', 'commit.gpgsign=false', '-c', 'core.hooksPath=/dev/null', ...args], { cwd: dir, encoding: 'utf8' }).trim();
+  const commit = (file) => {
+    fs.writeFileSync(path.join(dir, file), file);
+    git('add', file);
+    git('commit', '-qm', file);
+    return git('rev-parse', 'HEAD');
+  };
+  try {
+    git('init', '-qb', 'main');
+    const common = commit('base.txt');
+    git('checkout', '-qb', 'feature');
+    commit('service.py');
+    const head = commit('README.md');
+    git('checkout', '-q', 'main');
+    const base = commit('unrelated-gcp.py');
+    git('checkout', '-q', 'feature');
+    const f = fixture();
+    f.context.sha = f.pr.head.sha = head;
+    f.pr.base.sha = base;
+    const outputs = {};
+    process.chdir(dir);
+    await setCopiedPullRequestOutputs({ ...f, core: { setOutput: (key, value) => { outputs[key] = value; } } });
+    assert.deepEqual(outputs, { number: '42', head, base: common });
+    assert.deepEqual(git('diff', '--name-only', `${outputs.base}..${head}`).split('\n'), ['README.md', 'service.py']);
+  } finally {
+    process.chdir(previous);
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('fork warning links the analyzed SHA, schema patch, and local generation command', async () => {
+  const f = fixture();
+  await reportOpenAPI(f);
+  assert.equal(f.writes.length, 1);
+  assert.equal(f.writes[0].issue_number, 42);
+  assert.match(f.writes[0].body, /<!-- kumo-openapi-check -->/);
+  assert.match(f.writes[0].body, /make generate-ui-client-code/);
+  assert.match(f.writes[0].body, /push.*fork/);
+  assert.match(f.writes[0].body, /actions\/runs\/123/);
+  assert.match(f.writes[0].body, /View the schema patch in the workflow run/);
+  assert.ok(f.writes[0].body.includes(f.context.sha));
+  assert.doesNotMatch(f.writes[0].body, /trigger-ui-codegen/);
+});
+
+test('same-repository warning preserves the authorized code-generation command', async () => {
+  const f = fixture({ fork: false });
+  await reportOpenAPI(f);
+  assert.match(f.writes[0].body, /trigger-ui-codegen/);
+});
+
+test('an existing bot warning is updated when schemas become current', async () => {
+  const f = fixture({ changed: false, comments: [
+    { id: 1, user: { login: 'contributor' }, body: '<!-- kumo-openapi-check --> spoof' },
+    { id: 2, user: { login: 'github-actions[bot]' }, body: '⚠️ **OpenAPI spec changes detected in this PR**' },
+  ] });
+  await reportOpenAPI(f);
+  assert.equal(f.writes[0].kind, 'update');
+  assert.equal(f.writes[0].comment_id, 2);
+  assert.match(f.writes[0].body, /up to date/);
+});
+
+test('a repeated warning updates the bot comment instead of creating duplicates', async () => {
+  const f = fixture({ comments: [{ id: 7, user: { login: 'github-actions[bot]' }, body: '<!-- kumo-openapi-check --> old' }] });
+  await reportOpenAPI(f);
+  assert.equal(f.writes[0].kind, 'update');
+  assert.equal(f.writes[0].comment_id, 7);
+});
+
+test('current schemas do not create an unsolicited success comment', async () => {
+  const f = fixture({ changed: false });
+  await reportOpenAPI(f);
+  assert.equal(f.writes.length, 0);
+});
+
+test('a PR update during reporting prevents a stale write', async () => {
+  const f = fixture();
+  f.github.paginate = async () => {
+    f.pr.head.sha = 'c'.repeat(40);
+    return [];
+  };
+  await assert.rejects(reportOpenAPI(f), /stale/);
+  assert.equal(f.writes.length, 0);
+});

.github/scripts/copied-pr.cjs

@@ -0,0 +1,34 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES.
+// All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+const { execFileSync } = require('node:child_process');
+
+async function readCopiedPullRequest({ github, context }) {
+  const match = /^refs\/heads\/pull-request\/([1-9][0-9]*)$/.exec(context.ref);
+  if (context.eventName !== 'push' || !match) {
+    throw new Error('Expected a copy-pr-bot branch push');
+  }
+  const { data: pr } = await github.rest.pulls.get({
+    ...context.repo,
+    pull_number: Number(match[1]),
+  });
+  if (pr.base.repo.full_name !== `${context.repo.owner}/${context.repo.repo}` || pr.state !== 'open') {
+    throw new Error('Expected an open pull request targeting this repository');
+  }
+  if (pr.head.sha !== context.sha) {
+    throw new Error('Copied PR is stale; approve the current SHA');
+  }
+  return pr;
+}
+
+async function setCopiedPullRequestOutputs({ github, context, core }) {
+  const pr = await readCopiedPullRequest({ github, context });
+  // Diff the complete PR, excluding changes made only on the base branch.
+  const base = execFileSync('git', ['merge-base', pr.base.sha, context.sha], { encoding: 'utf8' }).trim();
+  core.setOutput('number', String(pr.number));
+  core.setOutput('head', pr.head.sha);
+  core.setOutput('base', base);
+}
+
+module.exports = { readCopiedPullRequest, setCopiedPullRequestOutputs };

.github/scripts/openapi-pr.cjs

@@ -0,0 +1,44 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES.
+// All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+const { readCopiedPullRequest } = require('./copied-pr.cjs');
+
+const MARKER = '<!-- kumo-openapi-check -->';
+const LEGACY_HEADING = '⚠️ **OpenAPI spec changes detected in this PR**';
+
+async function reportOpenAPI({ github, context, changed }) {
+  const pr = await readCopiedPullRequest({ github, context });
+  const comments = await github.paginate(github.rest.issues.listComments, {
+    ...context.repo,
+    issue_number: pr.number,
+    per_page: 100,
+  });
+  const existing = comments.find((comment) => comment.user?.login === 'github-actions[bot]' &&
+    (comment.body?.startsWith(MARKER) || comment.body?.startsWith(LEGACY_HEADING)));
+  if (!changed && !existing) return;
+
+  const run = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
+  const instructions = pr.head.repo.full_name === pr.base.repo.full_name
+    ? 'Run `make generate-ui-client-code` locally, or comment `/trigger-ui-codegen` if you have repository write access.'
+    : 'Run `make generate-ui-client-code` locally and push the regenerated files to your fork.';
+  const body = [
+    MARKER,
+    changed ? '⚠️ **OpenAPI schema regeneration needed**' : '✅ **OpenAPI schemas are up to date**',
+    '',
+    `Analyzed commit: \`${context.sha}\`.`,
+    '',
+    changed ? `${instructions} [View the schema patch in the workflow run](${run}).`
+      : `[View the workflow run](${run}).`,
+  ].join('\n');
+
+  // The PR may have advanced while comments were being fetched.
+  await readCopiedPullRequest({ github, context });
+  if (existing) {
+    await github.rest.issues.updateComment({ ...context.repo, comment_id: existing.id, body });
+  } else {
+    await github.rest.issues.createComment({ ...context.repo, issue_number: pr.number, body });
+  }
+}
+
+module.exports = { reportOpenAPI };

.github/workflows/install.yml

@@ -19,15 +19,10 @@ concurrency:
 
 permissions:
   contents: read
-  id-token: write
 
 jobs:
   import:
-    environment: gha-kumo-workflow-tests
     runs-on: ubuntu-24.04
-    env:
-      AWS_TEST_ROLE_ARN: arn:aws:iam::926922431314:role/gha-kumo-preprod-test-s3
-
     steps:
       - name: Checkout repository and submodules
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
@@ -42,25 +37,18 @@ jobs:
           files: |
             ui/**
 
-      - name: Set up Python ${{ matrix.python-version }}
+      - name: Set up Python
         if: steps.ui-changes.outputs.only_changed != 'true'
         uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b  # v8.1.0
         with:
           python-version: '3.14'
           activate-environment: true
 
-      - name: Configure AWS credentials
-        if: steps.ui-changes.outputs.only_changed != 'true'
-        uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6
-        with:
-          role-to-assume: arn:aws:iam::926922431314:role/gha-kumo-workflow-tests
-          aws-region: us-west-2
-
       - name: Install Kumo package
         if: steps.ui-changes.outputs.only_changed != 'true'
         uses: ./.github/actions/setup
         with:
-          github_token: ${{ secrets.KUMO_GITHUB_BOT_TOKEN }}
+          github_token: ${{ github.token }}
 
       - name: Test imports
         if: steps.ui-changes.outputs.only_changed != 'true'