pr-checks-master.yml

name: Sagemaker PR Checks (Master)
on:
  pull_request_target:
    branches:
      - "master"
      - "master-mtrl-trainer"
      - "master-mtrl-release"
    paths:
      - 'sagemaker-train/**'
      - 'sagemaker-serve/**'
      - 'sagemaker-mlops/**'
      - 'sagemaker-core/**'

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.head_ref }}
  cancel-in-progress: true

permissions:
  id-token: write

jobs:
  collab-check:
    runs-on: ubuntu-latest
    outputs:
      approval-env: ${{ steps.collab-check.outputs.result }}
    steps:
      - name: Collaborator Check
        uses: actions/github-script@v7
        id: collab-check
        with:
          github-token: ${{ secrets.COLLAB_CHECK_TOKEN }}
          result-encoding: string
          script: | 
            try {
              const res = await github.rest.repos.checkCollaborator({
                owner: context.repo.owner,
                repo: context.repo.repo,
                username: "${{ github.event.pull_request.user.login }}",
              });
              console.log("Verifed ${{ github.event.pull_request.user.login }} is a repo collaborator. Auto Approving PR Checks.")
              return res.status == "204" ? "auto-approve" : "manual-approval"
            } catch (error) {
              console.log("${{ github.event.pull_request.user.login }} is not a collaborator. Requiring Manual Approval to run PR Checks.")
              return "manual-approval"
            }
  wait-for-approval:
    runs-on: ubuntu-latest
    needs: [ collab-check ]
    environment: ${{ needs.collab-check.outputs.approval-env }}
    steps:
      - run: echo "Workflow Approved! Starting PR Checks."
  detect-changes:
    runs-on: ubuntu-latest
    needs: [wait-for-approval]
    outputs:
      submodules: ${{ steps.check-changes.outputs.submodules }}
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0
          token: ${{ secrets.GH_PAT }}
          ref: ${{ github.event.pull_request.base.ref }}
      - name: Detect Changes
        id: check-changes
        run: |
          set -e
          
          echo "Target Branch: ${{ github.event.pull_request.base.ref }}"
          echo "Current Target SHA: $(git rev-parse HEAD)"
          echo "PR Number: ${{ github.event.pull_request.number }}"
          echo "PR Latest SHA: ${{ github.event.pull_request.head.sha }}"
          
          git fetch origin pull/${{ github.event.pull_request.number }}/head
          CHANGES=$(git diff --name-only HEAD FETCH_HEAD)
          
          echo "Changed files:"
          echo "$CHANGES"
          
          # Function to extract dependencies from pyproject.toml
          get_dependencies() {
            local module=$1
            grep "sagemaker-" "$module/pyproject.toml" | grep -o 'sagemaker-[a-z]*' | sort -u
          }
          
          # Function to find all modules that depend on a given module (recursively)
          find_dependents() {
            local target=$1
            local all_modules=("sagemaker-core" "sagemaker-train" "sagemaker-serve" "sagemaker-mlops")
            local dependents=()
            
            for module in "${all_modules[@]}"; do
              if [ "$module" != "$target" ]; then
                if get_dependencies "$module" | grep -q "^$target$"; then
                  dependents+=("$module")
                fi
              fi
            done
            
            echo "${dependents[@]}"
          }
          
          # Initialize set of submodules to test (using associative array)
          declare -A SUBMODULES_SET
          
          # Function to recursively add module and all its dependents
          add_module_and_dependents() {
            local module=$1
            
            if [ -z "${SUBMODULES_SET[$module]}" ]; then
              SUBMODULES_SET["$module"]=1
              echo "Adding $module to test set"
              
              # Find all modules that depend on this one and add them recursively
              local dependents=$(find_dependents "$module")
              for dependent in $dependents; do
                add_module_and_dependents "$dependent"
              done
            fi
          }
          
          # Determine whether a module has any non-test changes. A change counts
          # as a source change if it touches anything under the module other than
          # its tests/ directory (e.g. src/, pyproject.toml, tox.ini, VERSION).
          # This is intentionally conservative: only changes confined entirely to
          # tests/ are treated as test-only.
          is_source_changed() {
            local module=$1
            echo "$CHANGES" | grep "^$module/" | grep -qv "^$module/tests/"
          }
          
          all_modules=("sagemaker-core" "sagemaker-train" "sagemaker-serve" "sagemaker-mlops")
          
          # Pass 1: modules with source changes pull in themselves plus every
          # module that (transitively) depends on them, since a source change can
          # affect downstream behaviour. This preserves the original logic.
          for module in "${all_modules[@]}"; do
            if is_source_changed "$module"; then
              echo "$module has source changes - adding it and all dependents"
              add_module_and_dependents "$module"
            fi
          done
          
          # Pass 2: modules with test-only changes add only themselves and skip
          # dependency propagation, since changing a module's tests cannot affect
          # other modules. Run after Pass 1 so source-change propagation is never
          # short-circuited by a test-only module already being in the set.
          for module in "${all_modules[@]}"; do
            if echo "$CHANGES" | grep -q "^$module/" && ! is_source_changed "$module"; then
              if [ -z "${SUBMODULES_SET[$module]}" ]; then
                echo "$module has test-only changes - adding only $module"
                SUBMODULES_SET["$module"]=1
              fi
            fi
          done
          
          # Convert associative array to JSON array
          SUBMODULES='[]'
          for submodule in "${!SUBMODULES_SET[@]}"; do
            if [ "$SUBMODULES" = '[]' ]; then
              SUBMODULES="[\"$submodule\"]"
            else
              SUBMODULES=$(echo $SUBMODULES | sed "s/\]$/,\"$submodule\"\]/")
            fi
          done
          
          echo "Final SUBMODULES: $SUBMODULES"
          echo "submodules=$SUBMODULES" >> $GITHUB_OUTPUT

  codestyle-doc-tests:
    runs-on: ubuntu-latest
    needs: [detect-changes]
    if: needs.detect-changes.outputs.submodules != '[]'
    strategy:
      fail-fast: false
      matrix:
        submodule: ${{ fromJson(needs.detect-changes.outputs.submodules) }}
    steps:
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.CI_AWS_ROLE_ARN }}
          aws-region: us-west-2
          role-duration-seconds: 10800

      - name: Run CodeBuild for ${{ matrix.submodule }}
        uses: aws-actions/aws-codebuild-run-build@v1
        with:
          project-name: ${{ github.event.repository.name }}-ci-${{ matrix.submodule }}-codestyle-doc-tests
          source-version-override: 'refs/pull/${{ github.event.pull_request.number }}/head^{${{ github.event.pull_request.head.sha }}}'

  unit-tests:
    runs-on: ubuntu-latest
    needs: [detect-changes]
    if: needs.detect-changes.outputs.submodules != '[]'
    strategy:
      fail-fast: false
      matrix:
        submodule: ${{ fromJson(needs.detect-changes.outputs.submodules) }}
    steps:
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.CI_AWS_ROLE_ARN }}
          aws-region: us-west-2
          role-duration-seconds: 10800

      - name: Run Unit Tests for ${{ matrix.submodule }}
        uses: aws-actions/aws-codebuild-run-build@v1
        with:
          project-name: ${{ github.event.repository.name }}-ci-${{ matrix.submodule }}-unit-tests
          source-version-override: 'refs/pull/${{ github.event.pull_request.number }}/head^{${{ github.event.pull_request.head.sha }}}'

  integ-tests:
    runs-on: ubuntu-latest
    needs: [detect-changes]
    if: needs.detect-changes.outputs.submodules != '[]'
    strategy:
      fail-fast: false
      matrix:
        submodule: ${{ fromJson(needs.detect-changes.outputs.submodules) }}
    steps:
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.CI_AWS_ROLE_ARN }}
          aws-region: us-west-2
          role-duration-seconds: 10800

      - name: Run Integ Tests for ${{ matrix.submodule }}
        uses: aws-actions/aws-codebuild-run-build@v1
        with:
          project-name: ${{ github.event.repository.name }}-ci-${{ matrix.submodule }}-integ-tests
          source-version-override: 'refs/pull/${{ github.event.pull_request.number }}/head^{${{ github.event.pull_request.head.sha }}}'

  integ-tests-us-east-1:
    runs-on: ubuntu-latest
    needs: [detect-changes]
    if: needs.detect-changes.outputs.submodules != '[]'
    steps:
      - name: Configure AWS Credentials (us-east-1)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.CI_AWS_ROLE_US_EAST_1_ARN }}
          aws-region: us-east-1
          role-duration-seconds: 10800

      - name: Run us-east-1 Integ Tests (all submodules)
        uses: aws-actions/aws-codebuild-run-build@v1
        with:
          project-name: ${{ github.event.repository.name }}-ci-integ-tests-us-east-1
          source-version-override: 'refs/pull/${{ github.event.pull_request.number }}/head^{${{ github.event.pull_request.head.sha }}}'