Update labeled PR CI checks #12344

shamil-mubarakshin · 2025-06-09T15:52:26Z

Description

This PR:

Adds 2 jobs to trigger-ubuntu-win-build.yml:
- wait-completion will periodically check status of the remote workflow run
- cancel-workflow will cancel remote workflow run if check is cancelled
Adds GitHubApi.psm1 and WaitWorkflowCompletion.ps1 to support new functionality
Refactors trigger-workflow job

Related issue: https://github.com/github/hosted-runners-images/issues/98

Check list

Related issue / work item is attached
Tests are written (if applicable)
Documentation is updated (if applicable)
Changes are tested and related VM images are successfully generated

Copilot

Pull Request Overview

This PR enhances the CI by adding jobs to monitor and cancel remote workflow runs, introduces reusable helper modules for GitHub API interactions, and refactors the dispatch step.

Add wait-completion and cancel-workflow jobs to poll a triggered workflow and cancel it on cancellation.
Introduce GitHubApi.psm1 and WaitWorkflowCompletion.ps1 helpers for dispatching and polling workflows.
Refactor trigger-workflow step in trigger-ubuntu-win-build.yml to use the new GitHubApi module.

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
helpers/WaitWorkflowCompletion.ps1	New script to locate, poll, retry, and cancel a triggered workflow run
helpers/GitHubApi.psm1	New PowerShell module encapsulating GitHub REST API calls (dispatch, list, cancel, rerun)
.github/workflows/trigger-ubuntu-win-build.yml	Updated CI workflow: dispatch step refactored; added wait-completion and cancel-workflow jobs

Comments suppressed due to low confidence (3)

helpers/GitHubApi.psm1:1

Rename the class to GitHubApi to match the module/file name casing and maintain consistency with GitHub branding.

class GithubApi

helpers/WaitWorkflowCompletion.ps1:17

[nitpick] Add comment-based help (e.g., <# .SYNOPSIS ... #>) for this public function to describe its purpose and parameters.

function Find-TriggeredWorkflow($WorkflowFileName, $WorkflowSearchPattern) {

helpers/WaitWorkflowCompletion.ps1:1

There are no unit or integration tests covering these new helper scripts; consider adding tests to validate the polling, retry, and cancellation logic.

Param (

Copilot · 2025-06-09T15:55:02Z

helpers/GitHubApi.psm1

+        if ([string]::IsNullOrEmpty($AccessToken)) {
+            return $null
+        }
+        $base64AuthInfo = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes("'':${AccessToken}"))


The string '' before the colon will produce an invalid credential; use ":${AccessToken}" or include a username (e.g., username:${AccessToken}) when encoding.

Suggested change

$base64AuthInfo = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes("'':${AccessToken}"))

$base64AuthInfo = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes(":${AccessToken}"))

Copilot · 2025-06-09T15:55:03Z

helpers/WaitWorkflowCompletion.ps1

+            "CI_WORKFLOW_RUN_RESULT=$($workflowRun.status)/timeout" | Out-File -Append -FilePath $env:GITHUB_ENV
+            "CI_WORKFLOW_RUN_URL=$($workflowRun.html_url)" | Out-File -Append -FilePath $env:GITHUB_ENV


Specify the file encoding (e.g., -Encoding UTF8) when writing to $GITHUB_ENV to ensure the environment file is parsed correctly.

Suggested change

"CI_WORKFLOW_RUN_RESULT=$($workflowRun.status)/timeout" | Out-File -Append -FilePath $env:GITHUB_ENV

"CI_WORKFLOW_RUN_URL=$($workflowRun.html_url)" | Out-File -Append -FilePath $env:GITHUB_ENV

"CI_WORKFLOW_RUN_RESULT=$($workflowRun.status)/timeout" | Out-File -Append -FilePath $env:GITHUB_ENV -Encoding UTF8

"CI_WORKFLOW_RUN_URL=$($workflowRun.html_url)" | Out-File -Append -FilePath $env:GITHUB_ENV -Encoding UTF8

helpers/WaitWorkflowCompletion.ps1

yalan2ny

New changes and updates help fix problems and improve the build process,

paveliak · 2025-06-24T13:09:10Z

.github/workflows/trigger-ubuntu-win-build.yml

      - name: Trigger Build workflow
        env:
          CI_PR_TOKEN: ${{ secrets.CI_PR_TOKEN }}
          PR_TITLE: ${{ github.event.pull_request.title }}
-          CI_PR: ${{ secrets.CI_REPO }}
+          CI_REPO: ${{ vars.CI_REPO }}


This would expose CI repo name. Probably not a big deal but curious if this is a deliberate change?

Change is intentional, as we want to get run URL for easier troubleshooting

paveliak · 2025-06-24T13:11:43Z

helpers/GitHubApi.psm1

+        }
+        $base64AuthInfo = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes("'':${AccessToken}"))
+        return @{
+            Authorization = "Basic ${base64AuthInfo}"


Previously we used Bearer auth and passed token directly, which also helps with secret masking because token value is unchanged. Is there a particular reason in switching to Basic auth? It looks like you use the same API.

There is no particular reason other than reusing the code. As far as I know, Actions mask popular encodings of the secret in the logs with base64 being one of them

paveliak · 2025-06-24T13:19:28Z

helpers/WaitWorkflowCompletion.ps1

+
+if ($finishedWorkflowRun.conclusion -eq "success") {
+    exit 0
+} elseif ($finishedWorkflowRun.conclusion -in ("failure", "cancelled")) {


Are there any other choices for the workflow conclusion that could fall through into else?

There are, should probably add timed_out as fail case

paveliak · 2025-06-24T13:23:21Z

helpers/WaitWorkflowCompletion.ps1

+            "CI_WORKFLOW_RUN_RESULT=$($workflowRun.status)/timeout" | Out-File -Append -FilePath $env:GITHUB_ENV
+            "CI_WORKFLOW_RUN_URL=$($workflowRun.html_url)" | Out-File -Append -FilePath $env:GITHUB_ENV
+            $gitHubApi.CancelWorkflowRun($workflowRunId)
+            throw "The workflow run is still in the '$($workflowRun.status)' state for $AttemptTimeoutInMinutes minutes. Cancelling the run."


There is a way to define workflow timeout on the yaml. If we want to terminate CI earlier than the default 6 hours then we probably should define the timeout on the CI workflow. I do not think this code should act as a watchdog for the CI, it just needs to wait...

Makes sense, don't really see $AttemptTimeoutInMinutes usefulness at the moment, will remove related code

paveliak · 2025-06-24T13:28:17Z

.github/workflows/trigger-ubuntu-win-build.yml

+    runs-on: ubuntu-latest
+    needs: trigger-workflow
+    outputs:
+      ci_workflow_run_id: ${{ steps.wait.outputs.ci_workflow_run_id }}


nit: Consider resolving workflow run ID in the trigger job. The this job is solely responsible for awaiting the given workflow run and cancellation job would not need to depend on it (except for ordering reasons).

Ideally repo dispatch event would return workflow run id (which is a feature community has been longing for) and once it is supported in Actions we would simply switch to using it instead of resolving workflow id from the title.

paveliak · 2025-06-24T13:30:37Z

helpers/WaitWorkflowCompletion.ps1

+    } elseif ($finishedWorkflowRun.conclusion -eq "failure") {
+        if ($attempt -le $MaxRetryCount) {
+            Write-Host "Workflow run will be restarted. Attempt $attempt of $MaxRetryCount"
+            $gitHubApi.ReRunFailedJobs($workflowRunId)


Can we restart this job by restarting the failed check run on the PR? This would make it a natural fit into the PR experience. Normally when a check fails it requires a manual rerun. And if it already works today then we do not need these retries (besides I do not think you use them anyway)

From what I have seen, while workflow run is in progress its jobs cannot be restarted. Such functionality will require something like a separate workflow, which is run on failure of the PR check and restarts it.
It will surely make things more robust if we want to consider retries in the future, in cases such as windows build failing due to sporadic issue 3 hours into the run, but will add complexity

paveliak · 2025-06-24T13:31:55Z

helpers/WaitWorkflowCompletion.ps1

+
+function Find-TriggeredWorkflow($WorkflowFileName, $WorkflowSearchPattern) {
+    $workflowRuns = $gitHubApi.GetWorkflowRuns($WorkflowFileName).workflow_runs
+    $workflowRunId = ($workflowRuns | Where-Object {$_.display_title -match $WorkflowSearchPattern}).id | Select-Object -First 1


If job is retried I assume there will be multiple runs that match the pattern? Will it pick latest? Or should we filter only the "running" workflows?

Retry in this case refers to re-running the workflow run, which increases attempt count. Filtering will pick up the latest

Update labeled PR CI checks

6b1ea32

Copilot AI review requested due to automatic review settings June 9, 2025 15:52

Copilot AI reviewed Jun 9, 2025

View reviewed changes

yalan2ny reviewed Jun 16, 2025

View reviewed changes

Update MaxRetryCount

1d24880

paveliak reviewed Jun 24, 2025

View reviewed changes

shamil-mubarakshin added 3 commits June 30, 2025 08:49

Remove AttemptTimeoutInMinutes logic

c9e7e6d

Update WaitWorkflowCompletion.ps1 exit logic

6879635

Update Resolve Workflow Run ID implementation

4c00120

	$base64AuthInfo = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes("'':${AccessToken}"))
	$base64AuthInfo = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes(":${AccessToken}"))

		"CI_WORKFLOW_RUN_RESULT=$($workflowRun.status)/timeout" \| Out-File -Append -FilePath $env:GITHUB_ENV
		"CI_WORKFLOW_RUN_URL=$($workflowRun.html_url)" \| Out-File -Append -FilePath $env:GITHUB_ENV

Update labeled PR CI checks #12344

Are you sure you want to change the base?

Update labeled PR CI checks #12344

Uh oh!

Conversation

shamil-mubarakshin commented Jun 9, 2025

Description

Related issue: https://github.com/github/hosted-runners-images/issues/98

Check list

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Jun 9, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jun 9, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

yalan2ny left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!