ci: dispatch coverage-fanout on merged source PRs by eric-wang-1990 · Pull Request #426 · databricks/databricks-sql-go

eric-wang-1990 · 2026-07-23T20:32:55Z

Summary

Wires databricks-sql-go into the multi-language coverage fan-out in databricks/databricks-driver-test. When a PR merges to main and touched Go driver source, dispatch a coverage-fanout repository_dispatch to driver-test; its coverage-fanout-tracker.yml opens a tracking issue and runs the language-agnostic fan-out (a spec authored from this PR's diff, conformed as tests across every driver: csharp/python/go/nodejs/rust/kernel/jdbc).

Same sender adbc-drivers/databricks already runs; this PR (and siblings in sql-python / sql-nodejs / sql-kernel / databricks-jdbc) brings the remaining driver repos onto the flow.

What it does

Adds closed to the pull_request trigger types; the new trigger-coverage-fanout job gates on github.event.pull_request.merged == true.
Source-path filter: fires only when the merge changed a non-test .go file outside examples/ and testdata/ — docs/CI/test-only merges don't kick off a full 7-leg fan-out.
Reuses the existing INTEGRATION_TEST_APP_ID/_PRIVATE_KEY App token (scoped to driver-test) and the same peter-evans/repository-dispatch pin adbc uses.
Tightens skip-integration-tests-pr's guard to exclude closed so it doesn't re-stamp a check on merged PRs.

Test Plan

YAML validates; job-guard audit confirms no existing job misfires on the new closed event.
After merge: a subsequent merged source PR should show a coverage-fanout dispatch + a new tracking issue in databricks/databricks-driver-test.

This pull request and its description were written by Isaac.

…ce PRs Wires databricks-sql-go into the multi-language coverage fan-out. When a PR merges to main and touched Go driver source (a non-test .go file outside examples/ and testdata/), dispatch a `coverage-fanout` repository_dispatch to databricks/databricks-driver-test. Its coverage-fanout-tracker.yml then opens a tracking issue and runs the language-agnostic fan-out (a spec authored from this PR's diff, conformed across every driver incl. go). - Adds `closed` to the pull_request trigger types; the new trigger-coverage-fanout job gates on `pull_request.merged == true`. - Source-path filter: docs/CI/test-only merges don't warrant a full 7-leg fan-out. - Reuses the existing INTEGRATION_TEST App token (scoped to driver-test) and the same peter-evans/repository-dispatch pin adbc-drivers/databricks already uses. - Tightens skip-integration-tests-pr's guard to exclude `closed` so it doesn't re-stamp a check on merged PRs now that `closed` is a trigger. Co-authored-by: Isaac Signed-off-by: Eric Wang <e.wang@databricks.com>

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

…ermissions peco-review-bot findings on the coverage-fanout sender (apply to all driver repos — the job is identical everywhere): - F1 (Medium): the merged-PR guard didn't constrain the base branch, so a PR merged into a release/feature branch that touched source would also dispatch a full fan-out authoring a spec from a diff that never reached main. Add `github.event.pull_request.base.ref == 'main'` to match the stated intent. - F2 (Low): the job declared no permissions block, relying on the default GITHUB_TOKEN read scope for github.rest.pulls.listFiles; if org defaults tighten to none it 403s silently. Scope it explicitly: contents: read + pull-requests: read. Co-authored-by: Isaac Signed-off-by: Eric Wang <e.wang@databricks.com>

Further peco-review-bot findings on the coverage-fanout sender: - Narrow the minted App installation token with `permission-contents: write` (all coverage_fanout needs is repository_dispatch → contents:write), matching the defense-in-depth the other dispatch jobs in these repos already use — so a leaked token can only fire dispatches, not exercise the App's full scope. - Restore the version tag in two action-pin comments (`# pinned` → the exact `# vX.Y.Z` the SHA corresponds to, per repo convention) for auditability. Co-authored-by: Isaac Signed-off-by: Eric Wang <e.wang@databricks.com>

sreekanth-db

Approving — reviewed with Isaac Review, no blocking issues.

github-actions · 2026-07-24T19:07:05Z

Go integration tests triggered (thrift / replay). View workflow runs.

github-actions · 2026-07-24T19:23:33Z

Integration test approval reset.

New commits were pushed to this PR. Label(s) integration-test were removed for security.

A maintainer must re-review and re-add a label to preview tests again. (The real gate runs in the merge queue.)

Latest commit: c59f259

github-actions · 2026-07-24T19:50:58Z

Go integration tests triggered (thrift / replay). View workflow runs.

The `Go Integration Tests` required check is pinned (in the branch ruleset) to the driver-test GitHub App. The old PR-open stub posted a same-named check via `github.token` (github-actions app), which (a) can't satisfy an app-pinned gate and (b) can't post at all on fork PRs, whose `pull_request` runs get a read-only token and no secrets — so fork PRs couldn't enter the merge queue without a maintainer label (and a labeled fork PR still can't run the real suite, since fork `pull_request` events have no secret access). Replace the inline stub with a companion `skip-checks-reporter.yml` triggered by `workflow_run`. That runs in the base-repo context with full secret access even for fork-triggered runs, mints the driver-test App token, and posts `Go Integration Tests`=success on the PR head as the app — so every PR (internal or fork) auto-enqueues, and the placeholder satisfies the app-pinned gate. The real suite is unchanged: it runs as the required gate on the merge_group commit and as a label preview on internal PRs. Mirrors adbc-drivers/databricks skip-checks-reporter.yml. The reporter never checks out or executes PR/fork content (its only fork-controlled input is the opaque head SHA), so it does not expose secrets to untrusted code. Co-authored-by: Isaac Signed-off-by: eric-wang-1990 <115501094+eric-wang-1990@users.noreply.github.com>

github-actions · 2026-07-24T20:43:02Z

Go integration tests triggered (thrift / replay). View workflow runs.

The merge queue evaluates every required status check on the queue's transient merge commit. `Lint` and `Test and Build (1.25.x/1.26.x)` are required (branch protection) but go.yml only triggered on push/pull_request, so they never ran on the merge commit — the required contexts stayed pending and the queue entry was evicted at the check-response timeout. Add a `merge_group` trigger so these jobs also run on the queue's merge commit and report there, matching the sql-python workflows. Co-authored-by: Isaac Signed-off-by: eric-wang-1990 <115501094+eric-wang-1990@users.noreply.github.com>

github-actions · 2026-07-24T21:00:55Z

Go integration tests triggered (thrift / replay). View workflow runs.

Copilot AI review requested due to automatic review settings July 23, 2026 20:32

Copilot AI reviewed Jul 23, 2026

eric-wang-1990 added 2 commits July 23, 2026 15:20

eric-wang-1990 enabled auto-merge (squash) July 23, 2026 22:45

sreekanth-db approved these changes Jul 24, 2026

View reviewed changes