CI: Add label check and signature verification in GitHub Actions#203
Merged
5 commits merged intoJul 4, 2026
Merged
Conversation
Merged
rorsc
reviewed
Jun 18, 2026
Member
|
please complete the PR with the outstanding changes. What is here is ok so far, see the one comment. |
- Add check-labels job that runs first on the PR events
- Fail early if none of the mandatory CI labels are present
(BUILD-ONLY, documentation, 4G-LTE, 5G-NR, nrUE, CI, retrigger-ci)
- Skip detect-changes, require-maintainer-approval and trigger-jenkins
when no mandatory CI label is found
- Push events are unaffected by the label check
- For labeled events, only retrigger-ci triggers the pipeline;
any other label addition is skipped
Co-authored-by: Shubhika Garg <shubhika.garg@openairinterface.org>
Signed-off-by: Jaroslava Fiedlerova <jaroslava.fiedlerova@openairinterface.org>
jfiedlerova
force-pushed
the
ci-duranta-fixes
branch
from
June 18, 2026 12:22
6da1c8b to
d2db2a1
Compare
sgarg00
force-pushed
the
ci-duranta-fixes
branch
from
June 18, 2026 13:23
d2db2a1 to
eb0c61a
Compare
sgarg00
force-pushed
the
ci-duranta-fixes
branch
from
June 18, 2026 14:58
eb0c61a to
46aca7d
Compare
arora-sagar
reviewed
Jun 26, 2026
rorsc
reviewed
Jun 26, 2026
rorsc
left a comment
rorsc
left a comment
Member
There was a problem hiding this comment.
is ok for me if we address the two changes.
Jaroslava did not want to merge it with the normal integration branch, is this still the case?
sgarg00
force-pushed
the
ci-duranta-fixes
branch
from
June 26, 2026 11:50
d77088c to
f9240c9
Compare
- Add verify-signed-commits job that runs on PR
- check-labels and all downstream jobs are skipped
if signed commmit verifications fails
- Fetch all commits in the PR via GitHub API
and check verification status
- Fail and print the unsigned commit SHAs if any
unsigned commits are found.
Co-authored-by: Shubhika Garg <shubhika.garg@openairinterface.org>
Signed-off-by: Jaroslava Fiedlerova <jaroslava.fiedlerova@openairinterface.org>
Signed-off-by: Shubhika Garg <shubhika.garg@openairinterface.org>
- Previously the label was only removed when it was the labeled event
that triggered the workflow. If a PR was synchronized or reopened
while the label was already present, it would not be removed by
the workflow.
- Created a dedicated cleanup job that depends on all other jobs
with if: always(), ensuring it runs regardless of whether upstream
jobs succeeded, failed, or were skipped.
- Now the cleanup runs on every pull_request_target event and removes
the label if present, ensuring it is always cleared after CI completes.
Co-authored-by: Jaroslava Fiedlerova <jaroslava.fiedlerova@openairinterface.org>
Signed-off-by: Shubhika Garg <shubhika.garg@openairinterface.org>
sgarg00
force-pushed
the
ci-duranta-fixes
branch
from
June 26, 2026 11:58
f9240c9 to
328968c
Compare
Contributor
When I checked with her last week, she told that this branch would be merged separately as per discussion with you. |
Merged
rorsc
approved these changes
Jun 26, 2026
sgarg00
approved these changes
Jul 2, 2026
arora-sagar
approved these changes
Jul 2, 2026
- The require-maintainer-approval job was being skipped on push event
when upstream jobs (verify-signed-commits and check-labels) were skipped,
even though detect-changes job successfully marked protected files as changed.
- GitHub Actions may skip dependent jobs due to upstream skipped states before
evaluating custom conditions.
- Adding always() ensures the job condition is evaluated regardless of
the status of upstream jobs, while still enforcing the rule that the job
only runs when protected_files_changed == true.
Signed-off-by: Shubhika Garg <shubhika.garg@openairinterface.org>
Merged
rorsc
added a commit
that referenced
this pull request
Jul 3, 2026
…on_2026_w27 CI: Add label check and signature verification in GitHub Actions (#203) - Update contributing guidelines for signing of commits - Check for unsigned commits in the github actions workflow - Skip CI when no mandatory CI label present on the PR - Always remove retrigger-ci label when present - Like post-always or post-cleanup Reviewed-by: Robert Schmidt <robert.schmidt@openairinterface.org> Reviewed-by: Sagar Arora <sagar.arora@openairinterface.org> Reviewed-by: Shubhika Garg <shubhika.garg@openairinterface.org>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
TODO:
retrigger-cilabel when present - Like post-always or post-cleanupTesting PR, on
jfiedlerovafork:To always remove the
retrigger-cilabel: GitHub Actions Run #1, GitHub Actions Run #2, GitHub Actions Run #3: Test GitHub Actions Workflow jfiedlerova/openairinterface5g#31In case of missing mandatory labels, https://github.com/jfiedlerova/openairinterface5g/actions/runs/28595375541/job/84789328408
When adding again one of the mandatory labels, like
documentation, https://github.com/jfiedlerova/openairinterface5g/actions/runs/28596301504/job/84792521919check-labelsandverify-signed-commitsare skipped and then rest of the jobs continue as shown here -> https://github.com/jfiedlerova/openairinterface5g/actions/runs/28647207409, https://github.com/jfiedlerova/openairinterface5g/actions/runs/28658340108/job/84993409338