Merged
Conversation
rauchy
requested review from
andrewnester,
anton-107,
denik,
pietern and
shreyas-goenka
as code owners
rauchy
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
rauchy
force-pushed
the
fix-integration-check-app-ownership
branch
from
99473ab to
532a9a4
Compare
rauchy
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
Collaborator
|
Commit: 2985d69
18 interesting tests: 9 SKIP, 7 KNOWN, 2 flaky
Top 19 slowest tests (at least 2 minutes):
|
simonfaltum
reviewed
Mar 12, 2026
Member
simonfaltum
left a comment
simonfaltum
left a comment
There was a problem hiding this comment.
Review (automated, 2 agents)
Verdict: Approve | 0 Critical | 0 Major | 0 Gap | 2 Nit | 2 Suggestion
Clean fix for a real CI problem. The approach is correct.
[Nit] Hardcoded owner: databricks instead of secrets.ORG_NAME
Existing token generation step uses owner: ${{ secrets.ORG_NAME }}. New step hardcodes databricks. Inconsistent.
[Nit] Token generation condition broader than consuming steps
Token is generated for PRs with test-exp-ssh but not test, even though no step uses it in that case. Harmless but imprecise.
[Suggestion] Missing repositories scope on new token
Token is scoped to all repos in the org installation. Add repositories: ${{ secrets.REPO_NAME }} to follow least privilege, matching the existing token step.
[Suggestion] Pin token permissions
Consider adding explicit permission scoping (e.g., permission-checks: write) for minimal scope.
simonfaltum
approved these changes
Mar 12, 2026
Member
simonfaltum
left a comment
simonfaltum
left a comment
There was a problem hiding this comment.
Take a look at the nits/suggestions otherwise its fine :)
rauchy
requested review from
a team,
alexott,
jefferycheng1,
kanterov,
lennartkats-db and
nfx
as code owners
rauchy
force-pushed
the
fix-integration-check-app-ownership
branch
from
8103eee to
2985d69
Compare
Collaborator
|
Commit: 8c7ec3b
36 interesting tests: 17 RECOVERED, 9 KNOWN, 8 flaky, 1 FAIL, 1 SKIP
Top 50 slowest tests (at least 2 minutes):
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The "mark as pending" job in the integration test workflow has been broken since late January. The nightly run fails with:
The "Auto-approve for merge group" and "Skip integration tests" steps in
push.ymlcreate "Integration Tests" checks usingactions/github-script, which runs under the built-inGITHUB_TOKEN— thegithub-actionsapp (ID 15368). When that same commit lands on main and triggers the nightly, theupdate-checkaction in eng-dev-ecosystem tries to update that check using theDECO_TEST_APPROVALapp token. GitHub's Checks API rejects this because only the app that created a check can modify it.This PR generates a
DECO_TEST_APPROVALtoken for both steps and passes it viagithub-tokentoactions/github-script, so checks are created by the same app that later updates them.