Skip to content

Route integration-tests trigger through emu-access runner#769

Merged
mihaimitrea-db merged 2 commits intomainfrom
mihaimitrea-db/unblock-trigger-tests-emu-access
Apr 20, 2026
Merged

Route integration-tests trigger through emu-access runner#769
mihaimitrea-db merged 2 commits intomainfrom
mihaimitrea-db/unblock-trigger-tests-emu-access

Conversation

@mihaimitrea-db
Copy link
Copy Markdown
Contributor

Summary

Moves the trigger-tests job in .github/workflows/integration-tests.yml from the databricks-deco-testing-runner-group to databricks-release-runner-group-emu-access, so the cross-org GitHub App installation lookup against databricks-eng can succeed.

Before After
Runner group databricks-deco-testing-runner-group databricks-release-runner-group-emu-access
Label ubuntu-latest-deco linux-ubuntu-latest-emu-access

Why

Between 2026-04-17 and 2026-04-20, the databricks org tightened its IP allow list. Since then, every PR-triggered Integration Tests run on this repo has failed:

  • create-github-app-token resolves the installation for ${{ secrets.ORG_NAME }} (databricks-eng) by calling /repos/databricks-eng/.../installation.
  • The deco runner group's egress IPs are no longer on the allow list, so that call returns 403.
  • The downstream gh workflow run sdk-java-isolated-pr.yml -R databricks-eng/... dispatch never happens.
  • Merges still go through only because merge_group auto-approves the check without running tests.

The emu-access runner pool's egress IPs are on the allow list, so the installation lookup succeeds from there.

Where the changes come from

Ported from the Go SDK fix: databricks/databricks-sdk-go#1638 (supersedes #1616, verified green end-to-end on 2026-04-10).

The Go PR splits trigger-tests into two jobs:

  • create-check — stays on deco, creates a same-org check run via the databricks/... check-runs API.
  • trigger-tests — moves to emu-access, performs the cross-org workflow_dispatch.

What this PR does differently

The Java SDK's integration-tests.yml does not create a check run in the PR flow — trigger-tests only performs the cross-org dispatch. Nothing needs to stay on the deco runner, so the equivalent minimal fix is a single runner-group change on the existing job rather than a two-job split. No job splitting, added dependencies, or check_run_id plumbing was needed here.

Matches the equivalent Python SDK fix: databricks/databricks-sdk-py#1396.

How is this tested

This PR's own Integration Tests run is the test. Expected outcome:

  • trigger-tests runs on the emu-access runner and create-github-app-token succeeds (no 403).
  • A sdk-java-isolated-pr workflow_dispatch event appears on databricks-eng/eng-dev-ecosystem.
  • The Integration Tests check on this PR transitions to success / failure based on the dispatched run.

NO_CHANGELOG=true

This pull request and its description were written by Isaac.

@github-actions
Copy link
Copy Markdown
Contributor

If integration tests don't run automatically, an authorized user can run them manually by following the instructions below:

Trigger:
go/deco-tests-run/sdk-java

Inputs:

  • PR number: 769
  • Commit SHA: 5e4c0259e83aca64b293a4571830682ac91271cf

Checks will be approved automatically on success.

@mihaimitrea-db mihaimitrea-db added this pull request to the merge queue Apr 20, 2026
Merged via the queue into main with commit 870c4e0 Apr 20, 2026
17 checks passed
@mihaimitrea-db mihaimitrea-db deleted the mihaimitrea-db/unblock-trigger-tests-emu-access branch April 20, 2026 14:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants