Add external plugin quality gates and maintainer override flow (#1860)

* Add external plugin quality gates and override flow

Introduce a dedicated reusable quality-gates workflow for external plugin submissions and wire intake/rerun orchestration to consume its results. Add quality-aware intake state handling, including a submitter-fix blocker state and richer intake comments.

Also add a maintainer /mark-ready-for-review command workflow for explicit overrides, update related approval-label handling, and document the new external plugin review flow in CONTRIBUTING and AGENTS guidance.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* fix: use specific auth/network patterns in classifySmokeFailure

Co-authored-by: aaronpowell <434140+aaronpowell@users.noreply.github.com>

* refactor: hoist INFRA_ERROR_PATTERNS to module level, fix timeout regex

Co-authored-by: aaronpowell <434140+aaronpowell@users.noreply.github.com>

* fix: install Copilot CLI in external-plugin-quality-gates workflow

Co-authored-by: aaronpowell <434140+aaronpowell@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: aaronpowell <434140+aaronpowell@users.noreply.github.com>
This commit is contained in:
Aaron Powell
2026-05-28 15:50:13 +10:00
committed by GitHub
parent f98dcc1c1f
commit 47701d25f4
10 changed files with 933 additions and 49 deletions
@@ -13,18 +13,26 @@ permissions:
issues: write
jobs:
handle-command:
parse-command:
runs-on: ubuntu-latest
if: >-
!github.event.issue.pull_request &&
startsWith(github.event.comment.body, '/rerun-intake')
outputs:
should-run: ${{ steps.evaluate.outputs.should-run }}
base-result: ${{ steps.evaluate.outputs.base-result }}
valid: ${{ steps.evaluate.outputs.valid }}
plugin-json: ${{ steps.evaluate.outputs.plugin-json }}
issue-state: ${{ steps.evaluate.outputs.issue-state }}
issue-labels: ${{ steps.evaluate.outputs.issue-labels }}
steps:
- name: Checkout staged branch
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with:
ref: staged
- name: Re-run external plugin intake
- name: Validate command and evaluate intake
id: evaluate
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -34,7 +42,8 @@ jobs:
const { pathToFileURL } = require('url');
const intake = await import(pathToFileURL(path.join(process.env.GITHUB_WORKSPACE, 'eng', 'external-plugin-intake.mjs')).href);
const intakeState = await import(pathToFileURL(path.join(process.env.GITHUB_WORKSPACE, 'eng', 'external-plugin-intake-state.mjs')).href);
core.setOutput('should-run', 'false');
const commentAuthor = context.payload.comment.user?.login;
if (!commentAuthor || context.payload.comment.user?.type === 'Bot' || commentAuthor === 'github-actions[bot]') {
@@ -91,34 +100,107 @@ jobs:
return;
}
const evaluation = await intake.evaluateExternalPluginIssue({
const baseResult = await intake.evaluateExternalPluginIssue({
issue: currentIssue,
token: process.env.GITHUB_TOKEN
});
core.setOutput('should-run', 'true');
core.setOutput('base-result', JSON.stringify(baseResult));
core.setOutput('valid', baseResult.valid ? 'true' : 'false');
core.setOutput('plugin-json', JSON.stringify(baseResult.plugin || {}));
core.setOutput('issue-state', currentIssue.state);
core.setOutput('issue-labels', JSON.stringify([...labelNames]));
quality-gates:
needs: parse-command
if: >-
needs.parse-command.outputs.should-run == 'true' &&
needs.parse-command.outputs.valid == 'true'
uses: ./.github/workflows/external-plugin-quality-gates.yml
with:
plugin-json: ${{ needs.parse-command.outputs.plugin-json }}
apply-state:
runs-on: ubuntu-latest
needs: [parse-command, quality-gates]
if: always() && needs.parse-command.outputs.should-run == 'true'
steps:
- name: Checkout staged branch
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
with:
ref: staged
- name: Apply merged intake evaluation
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
env:
BASE_RESULT_JSON: ${{ needs.parse-command.outputs.base-result }}
BASE_VALID: ${{ needs.parse-command.outputs.valid }}
QUALITY_RESULT_JSON: ${{ needs.quality-gates.outputs.quality-result }}
QUALITY_JOB_RESULT: ${{ needs.quality-gates.result }}
ISSUE_STATE: ${{ needs.parse-command.outputs.issue-state }}
ISSUE_LABELS: ${{ needs.parse-command.outputs.issue-labels }}
with:
script: |
const path = require('path');
const { pathToFileURL } = require('url');
const intake = await import(pathToFileURL(path.join(process.env.GITHUB_WORKSPACE, 'eng', 'external-plugin-intake.mjs')).href);
const intakeState = await import(pathToFileURL(path.join(process.env.GITHUB_WORKSPACE, 'eng', 'external-plugin-intake-state.mjs')).href);
const baseResult = JSON.parse(process.env.BASE_RESULT_JSON);
let finalResult = baseResult;
if (process.env.BASE_VALID === 'true') {
let qualityResult;
if (process.env.QUALITY_JOB_RESULT === 'failure' || process.env.QUALITY_JOB_RESULT === 'cancelled') {
qualityResult = {
overall_status: 'infra_error',
skill_validator_status: 'infra_error',
smoke_status: 'infra_error',
failure_class: 'infra',
summary: 'Quality-gate workflow failed unexpectedly. Re-run intake to retry.',
};
} else if (process.env.QUALITY_RESULT_JSON) {
qualityResult = JSON.parse(process.env.QUALITY_RESULT_JSON);
} else {
qualityResult = {
overall_status: 'infra_error',
skill_validator_status: 'infra_error',
smoke_status: 'infra_error',
failure_class: 'infra',
summary: 'Quality-gate workflow did not return results. Re-run intake to retry.',
};
}
finalResult = intake.applyQualityGateResult(baseResult, qualityResult);
}
await intakeState.applyExternalPluginIntakeEvaluation({
github,
owner: context.repo.owner,
repo: context.repo.repo,
issueNumber: context.issue.number,
evaluation
evaluation: finalResult
});
if (evaluation.valid && currentIssue.state === 'closed' && labelNames.has('rejected')) {
await github.rest.issues.update({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: context.issue.number,
state: 'open'
});
return;
}
if (!evaluation.valid && currentIssue.state === 'open') {
const issueState = process.env.ISSUE_STATE;
const labels = new Set(JSON.parse(process.env.ISSUE_LABELS || '[]'));
if (finalResult.intakeState === 'rejected' && issueState === 'open') {
await github.rest.issues.update({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: context.issue.number,
state: 'closed'
});
return;
}
if (finalResult.intakeState !== 'rejected' && issueState === 'closed' && labels.has('rejected')) {
await github.rest.issues.update({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: context.issue.number,
state: 'open'
});
}