pr-checks-master.yml

name: Sagemaker PR Checks (Master)
on:
  pull_request_target:
    branches:
      - "master"
    paths:
      - 'sagemaker-train/**'
      - 'sagemaker-serve/**'
      - 'sagemaker-mlops/**'
      - 'sagemaker-core/**'

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.head_ref }}
  cancel-in-progress: true

permissions:
  id-token: write

jobs:
  collab-check:
    runs-on: ubuntu-latest
    outputs:
      approval-env: ${{ steps.collab-check.outputs.result }}
    steps:
      - name: Collaborator Check
        uses: actions/github-script@v7
        id: collab-check
        with:
          github-token: ${{ secrets.COLLAB_CHECK_TOKEN }}
          result-encoding: string
          script: | 
            try {
              const res = await github.rest.repos.checkCollaborator({
                owner: context.repo.owner,
                repo: context.repo.repo,
                username: "${{ github.event.pull_request.user.login }}",
              });
              console.log("Verifed ${{ github.event.pull_request.user.login }} is a repo collaborator. Auto Approving PR Checks.")
              return res.status == "204" ? "auto-approve" : "manual-approval"
            } catch (error) {
              console.log("${{ github.event.pull_request.user.login }} is not a collaborator. Requiring Manual Approval to run PR Checks.")
              return "manual-approval"
            }
  wait-for-approval:
    runs-on: ubuntu-latest
    needs: [ collab-check ]
    environment: ${{ needs.collab-check.outputs.approval-env }}
    steps:
      - run: echo "Workflow Approved! Starting PR Checks."
  detect-changes:
    runs-on: ubuntu-latest
    needs: [wait-for-approval]
    outputs:
      submodules: ${{ steps.check-changes.outputs.submodules }}
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0
          token: ${{ secrets.GH_PAT }}
          ref: ${{ github.event.pull_request.base.ref }}
      - name: Detect Changes
        id: check-changes
        run: |
          set -e
          
          echo "Target Branch: ${{ github.event.pull_request.base.ref }}"
          echo "Current Target SHA: $(git rev-parse HEAD)"
          echo "PR Number: ${{ github.event.pull_request.number }}"
          echo "PR Latest SHA: ${{ github.event.pull_request.head.sha }}"
          
          git fetch origin pull/${{ github.event.pull_request.number }}/head
          CHANGES=$(git diff --name-only HEAD FETCH_HEAD)
          
          echo "Changed files:"
          echo "$CHANGES"
          
          SUBMODULES=[]
          
          if echo "$CHANGES" | grep -q "^sagemaker-train/"; then
            SUBMODULES='["sagemaker-train"]'
          fi
          if echo "$CHANGES" | grep -q "^sagemaker-serve/"; then
            if [ "$SUBMODULES" = '[]' ]; then
              SUBMODULES='["sagemaker-serve"]'
            else
              SUBMODULES=$(echo $SUBMODULES | sed 's/\]$/,"sagemaker-serve"\]/')
            fi
          fi
          if echo "$CHANGES" | grep -q "^sagemaker-mlops/"; then
            if [ "$SUBMODULES" = '[]' ]; then
              SUBMODULES='["sagemaker-mlops"]'
            else
              SUBMODULES=$(echo $SUBMODULES | sed 's/\]$/,"sagemaker-mlops"\]/')
            fi
          fi
          if echo "$CHANGES" | grep -q "^sagemaker-core/"; then
            if [ "$SUBMODULES" = '[]' ]; then
              SUBMODULES='["sagemaker-core"]'
            else
              SUBMODULES=$(echo $SUBMODULES | sed 's/\]$/,"sagemaker-core"\]/')
            fi
          fi
          echo "Final SUBMODULES: $SUBMODULES"
          echo "submodules=$SUBMODULES" >> $GITHUB_OUTPUT

  codestyle-doc-tests:
    runs-on: ubuntu-latest
    needs: [detect-changes]
    if: needs.detect-changes.outputs.submodules != '[]'
    strategy:
      fail-fast: false
      matrix:
        submodule: ${{ fromJson(needs.detect-changes.outputs.submodules) }}
    steps:
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.CI_AWS_ROLE_ARN }}
          aws-region: us-west-2
          role-duration-seconds: 10800

      - name: Run CodeBuild for ${{ matrix.submodule }}
        uses: aws-actions/aws-codebuild-run-build@v1
        with:
          project-name: ${{ github.event.repository.name }}-ci-${{ matrix.submodule }}-codestyle-doc-tests
          source-version-override: 'refs/pull/${{ github.event.pull_request.number }}/head^{${{ github.event.pull_request.head.sha }}}'

  unit-tests:
    runs-on: ubuntu-latest
    needs: [detect-changes]
    if: needs.detect-changes.outputs.submodules != '[]'
    strategy:
      fail-fast: false
      matrix:
        submodule: ${{ fromJson(needs.detect-changes.outputs.submodules) }}
    steps:
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.CI_AWS_ROLE_ARN }}
          aws-region: us-west-2
          role-duration-seconds: 10800

      - name: Run Unit Tests for ${{ matrix.submodule }}
        uses: aws-actions/aws-codebuild-run-build@v1
        with:
          project-name: ${{ github.event.repository.name }}-ci-${{ matrix.submodule }}-unit-tests
          source-version-override: 'refs/pull/${{ github.event.pull_request.number }}/head^{${{ github.event.pull_request.head.sha }}}'

  integ-tests:
    runs-on: ubuntu-latest
    needs: [detect-changes]
    if: needs.detect-changes.outputs.submodules != '[]'
    strategy:
      fail-fast: false
      matrix:
        submodule: ${{ fromJson(needs.detect-changes.outputs.submodules) }}
    steps:
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.CI_AWS_ROLE_ARN }}
          aws-region: us-west-2
          role-duration-seconds: 10800

      - name: Run Integ Tests for ${{ matrix.submodule }}
        uses: aws-actions/aws-codebuild-run-build@v1
        with:
          project-name: ${{ github.event.repository.name }}-ci-${{ matrix.submodule }}-integ-tests
          source-version-override: 'refs/pull/${{ github.event.pull_request.number }}/head^{${{ github.event.pull_request.head.sha }}}'