diff --git a/.github/workflows/noema-review.yml b/.github/workflows/noema-review.yml index 7ac746c95f..00dc5cd67d 100644 --- a/.github/workflows/noema-review.yml +++ b/.github/workflows/noema-review.yml @@ -56,6 +56,7 @@ jobs: || ( github.event_name == 'workflow_run' && github.event.workflow_run.conclusion != 'cancelled' + && github.event.workflow_run.pull_requests[0].number ) || ( github.event_name == 'pull_request_target' @@ -106,7 +107,9 @@ jobs: } if [ -z "${TOKEN_EXCHANGE_URL:-}" ]; then - fail_unavailable "Noema app token exchange unavailable: NOEMA_TOKEN_EXCHANGE_URL or NOEMA_EXCHANGE_URL is not configured." + echo "available=false" >>"$GITHUB_OUTPUT" + echo "::warning::Noema app token exchange disabled: NOEMA_TOKEN_EXCHANGE_URL or NOEMA_EXCHANGE_URL is not configured; skipping independent Noema review." + exit 0 fi if [ -z "${ACTIONS_ID_TOKEN_REQUEST_TOKEN:-}" ] || [ -z "${ACTIONS_ID_TOKEN_REQUEST_URL:-}" ]; then @@ -168,6 +171,10 @@ jobs: echo "No pull request number was available for this event; skipping." exit 0 fi + if [ "${{ steps.noema_app_token.outputs.available }}" != "true" ]; then + echo "Noema app token exchange is not configured; independent Noema review skipped." + exit 0 + fi if [ -z "${GH_TOKEN:-}" ]; then echo "::error::Noema app token is unavailable; review cannot submit a verdict." exit 1 diff --git a/tests/test_required_workflow_queue_contract.py b/tests/test_required_workflow_queue_contract.py index 6b5869b9f5..d0615720b2 100644 --- a/tests/test_required_workflow_queue_contract.py +++ b/tests/test_required_workflow_queue_contract.py @@ -120,20 +120,29 @@ def test_cancelled_review_workflow_runs_do_not_spawn_more_queue_work() -> None: assert "github.event.workflow_run.conclusion != 'cancelled'" in workflow -def test_noema_review_fails_closed_when_required_configuration_is_missing() -> None: +def test_noema_review_workflow_runs_require_an_associated_pull_request() -> None: + workflow = workflow_text("noema-review.yml") + job_guard = workflow.split("env:", 1)[0] + + assert "github.event_name == 'workflow_run'" in job_guard + assert "github.event.workflow_run.conclusion != 'cancelled'" in job_guard + assert "github.event.workflow_run.pull_requests[0].number" in job_guard + + +def test_noema_review_skips_when_disabled_but_fails_closed_after_configuration() -> None: workflow = workflow_text("noema-review.yml") assert "fail_unavailable()" in workflow assert 'echo "::error::$message"' in workflow assert "vars.NOEMA_TOKEN_EXCHANGE_URL || vars.NOEMA_EXCHANGE_URL || ''" in workflow - assert "Noema app token exchange unavailable: NOEMA_TOKEN_EXCHANGE_URL or NOEMA_EXCHANGE_URL is not configured." in workflow + assert "Noema app token exchange disabled: NOEMA_TOKEN_EXCHANGE_URL or NOEMA_EXCHANGE_URL is not configured; skipping independent Noema review." in workflow assert "Noema app token exchange unavailable: OIDC request environment is missing." in workflow assert "Noema app token exchange unavailable: OIDC token request did not complete." in workflow assert "Noema app token exchange unavailable: OIDC token response was empty." in workflow assert "Noema app token exchange unavailable: app token request did not complete." in workflow assert "Noema app token exchange unavailable: app token response was empty." in workflow + assert "Noema app token exchange is not configured; independent Noema review skipped." in workflow assert "::error::Noema app token is unavailable; review cannot submit a verdict." in workflow - assert "Noema app token is unavailable; review skipped." not in workflow def test_unassociated_review_workflow_runs_do_not_scan_the_whole_pr_queue() -> None: