feat(ci): add /ci-run-regression trigger + accept refs in inputs (#25245)

thomasqueirozb · web-flow · commit 39138e0e7b73 · 2026-05-08T15:27:00.000Z
* chore(ci): accept refs in regression workflow and add /ci-run-regression trigger

* Shorten /ci-run-regression description

* chore(ci): drop unneeded actions: write and grant id-token on regression caller

* chore(ci): use startsWith and simplify regression baseline parsing
diff --git a/.github/workflows/ci-review-trigger.yml b/.github/workflows/ci-review-trigger.yml
@@ -23,6 +23,17 @@
 # /ci-run-unit-windows        : runs Unit - Windows
 # /ci-run-environment         : runs Environment Suite
 # /ci-run-k8s                 : runs K8s E2E Suite
+#
+# Not included in /ci-run-all:
+#
+# /ci-run-regression          : runs Regression Detection Suite. The comparison ref is
+#                               the review's commit. An optional baseline ref can be
+#                               passed as an argument, otherwise the baseline defaults
+#                               to the SHA from 7 days ago. Examples:
+#                                 /ci-run-regression
+#                                 /ci-run-regression origin/master
+#                                 /ci-run-regression v0.55.0
+#                               Not included in `/ci-run-all` because it is expensive.
 
 name: CI Review Trigger
 
@@ -70,6 +81,7 @@ jobs:
       || startsWith(github.event.review.body, '/ci-run-unit-windows')
       || startsWith(github.event.review.body, '/ci-run-environment')
       || startsWith(github.event.review.body, '/ci-run-k8s')
+      || startsWith(github.event.review.body, '/ci-run-regression')
     steps:
       - name: Generate authentication token
         id: generate_token
@@ -197,6 +209,40 @@ jobs:
       ref: ${{ github.event.review.commit_id }}
     secrets: inherit
 
+  # Parse an optional baseline ref from a `/ci-run-regression <ref>` comment line.
+  # The captured ref is passed to the regression workflow; an empty value lets it
+  # fall back to its default (the SHA from 7 days ago).
+  regression-parse:
+    needs: validate
+    if: startsWith(github.event.review.body, '/ci-run-regression')
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    outputs:
+      baseline-sha: ${{ steps.parse.outputs.baseline }}
+    steps:
+      - name: Parse baseline ref from review body
+        id: parse
+        env:
+          REVIEW_BODY: ${{ github.event.review.body }}
+        run: |
+          # The body starts with `/ci-run-regression`; take the second whitespace-
+          # delimited token on the first line as the optional baseline ref.
+          read -r _ BASELINE _ <<< "${REVIEW_BODY}"
+          echo "Parsed baseline ref: '${BASELINE}'"
+          echo "baseline=${BASELINE}" >> "$GITHUB_OUTPUT"
+
+  regression:
+    needs: [validate, regression-parse]
+    if: startsWith(github.event.review.body, '/ci-run-regression')
+    permissions:
+      contents: read # Required to checkout code
+      id-token: write # Required for AWS OIDC token exchange in regression.yml
+    uses: ./.github/workflows/regression.yml
+    with:
+      baseline-sha: ${{ needs.regression-parse.outputs.baseline-sha }}
+      comparison-sha: ${{ github.event.review.commit_id }}
+    secrets: inherit
+
   coverage:
     needs: validate
     if: contains(github.event.review.body, '/ci-run-coverage')
diff --git a/.github/workflows/regression.yml b/.github/workflows/regression.yml
@@ -1,15 +1,20 @@
 # Regression Detection Suite
 #
 # This workflow runs under the following conditions:
-#   - Once per day, based on a schedule
-#   - On demand, triggered from https://github.com/vectordotdev/vector/actions/workflows/regression_v2.yml
+#   - Once per week, based on a schedule
+#   - On demand, triggered from https://github.com/vectordotdev/vector/actions/workflows/regression.yml
+#   - On demand, via the `/ci-run-regression` (or `/ci-run-all`) PR review comment,
+#     which invokes this workflow via `workflow_call` from `ci-review-trigger.yml`.
 #
 # The workflow accepts two optional inputs:
-#   - The baseline SHA:
+#   - The baseline ref:
 #     - If not specified, the SHA from 7 days ago on origin/master is used.
-#   - The comparison SHA:
+#   - The comparison ref:
 #     - If not specified, the current HEAD of origin/master is used.
 #
+# Both inputs accept any git ref that `git rev-parse` can resolve: a full commit
+# SHA, a short SHA, a branch name (e.g. `origin/master`), or a tag.
+#
 # This workflow runs regression detection experiments, performing relative
 # evaluations of the baseline SHA and comparison SHA. The exact SHAs are determined
 # by how the workflow is triggered.
@@ -26,11 +31,21 @@ on:
   workflow_dispatch:
     inputs:
       baseline-sha:
-        description: "The SHA to use as the baseline (optional). If not provided, it defaults to the SHA from 7 days ago."
+        description: "Baseline git ref (full/short SHA, branch such as `origin/master`, or tag). Defaults to the SHA from 7 days ago."
+        required: false
+      comparison-sha:
+        description: "Comparison git ref (full/short SHA, branch such as `origin/master`, or tag). Defaults to the current HEAD of origin/master."
+        required: false
+  workflow_call:
+    inputs:
+      baseline-sha:
+        description: "Baseline git ref (full/short SHA, branch such as `origin/master`, or tag). Defaults to the SHA from 7 days ago."
         required: false
+        type: string
       comparison-sha:
-        description: "The SHA to use for comparison (optional). If not provided, it defaults to the current HEAD of the origin/master branch."
+        description: "Comparison git ref (full/short SHA, branch such as `origin/master`, or tag). Defaults to the current HEAD of origin/master."
         required: false
+        type: string
   schedule:
     - cron: "0 7 * * 1" # Runs at 7 AM UTC on Mondays
 
@@ -60,39 +75,32 @@ jobs:
 
       - name: Set and Validate SHAs
         id: set_and_validate_shas
+        env:
+          BASELINE_INPUT: ${{ inputs.baseline-sha }}
+          COMPARISON_INPUT: ${{ inputs.comparison-sha }}
         run: |
-          # Set baseline SHA
-          if [ -z "${{ github.event.inputs.baseline-sha }}" ]; then
+          # Resolve baseline ref to a full commit SHA
+          if [ -z "${BASELINE_INPUT}" ]; then
             BASELINE_SHA=$(git rev-list -n 1 --before="7 days ago" origin/master)
             echo "Using baseline SHA from 7 days ago: ${BASELINE_SHA}"
           else
-            BASELINE_SHA="${{ github.event.inputs.baseline-sha }}"
-            echo "Using provided baseline SHA: ${BASELINE_SHA}"
+            if ! BASELINE_SHA=$(git rev-parse --verify "${BASELINE_INPUT}^{commit}" 2>/dev/null); then
+              echo "Invalid baseline ref: '${BASELINE_INPUT}'. Expected a full/short SHA, branch (e.g. origin/master), or tag."
+              exit 1
+            fi
+            echo "Resolved baseline input '${BASELINE_INPUT}' to SHA: ${BASELINE_SHA}"
           fi
 
-          # Validate baseline SHA
-          if [ -n "${BASELINE_SHA}" ] && git cat-file -e "${BASELINE_SHA}^{commit}"; then
-            echo "Baseline SHA is valid."
-          else
-            echo "Invalid baseline SHA: ${BASELINE_SHA}."
-            exit 1
-          fi
-
-          # Set comparison SHA
-          if [ -z "${{ github.event.inputs.comparison-sha }}" ]; then
+          # Resolve comparison ref to a full commit SHA
+          if [ -z "${COMPARISON_INPUT}" ]; then
             COMPARISON_SHA=$(git rev-parse origin/master)
-            echo "Using current HEAD for comparison SHA: ${COMPARISON_SHA}"
+            echo "Using current HEAD of origin/master as comparison SHA: ${COMPARISON_SHA}"
           else
-            COMPARISON_SHA="${{ github.event.inputs.comparison-sha }}"
-            echo "Using provided comparison SHA: ${COMPARISON_SHA}"
-          fi
-
-          # Validate comparison SHA
-          if [ -n "${COMPARISON_SHA}" ] && git cat-file -e "${COMPARISON_SHA}^{commit}"; then
-            echo "Comparison SHA is valid."
-          else
-            echo "Invalid comparison SHA: ${COMPARISON_SHA}."
-            exit 1
+            if ! COMPARISON_SHA=$(git rev-parse --verify "${COMPARISON_INPUT}^{commit}" 2>/dev/null); then
+              echo "Invalid comparison ref: '${COMPARISON_INPUT}'. Expected a full/short SHA, branch (e.g. origin/master), or tag."
+              exit 1
+            fi
+            echo "Resolved comparison input '${COMPARISON_INPUT}' to SHA: ${COMPARISON_SHA}"
           fi
 
           # Set tags and export them
@@ -192,10 +200,6 @@ jobs:
     needs:
       - should-run-gate
       - resolve-inputs
-    # Job-level permissions for artifact upload
-    permissions:
-      contents: read # Required to checkout code
-      actions: write # Required to upload artifacts
     steps:
       - uses: colpal/actions-clean@36e6ca1abd35efe61cb60f912bd7837f67887c8a # v1.1.1
 
@@ -235,10 +239,6 @@ jobs:
     needs:
       - should-run-gate
       - resolve-inputs
-    # Job-level permissions for artifact upload
-    permissions:
-      contents: read # Required to checkout code
-      actions: write # Required to upload artifacts
     steps:
       - uses: colpal/actions-clean@36e6ca1abd35efe61cb60f912bd7837f67887c8a # v1.1.1
 
@@ -392,10 +392,8 @@ jobs:
       - resolve-inputs
       - upload-baseline-image-to-ecr
       - upload-comparison-image-to-ecr
-    # Job-level permissions for artifact upload
     permissions:
       contents: read # Required to checkout code
-      actions: write # Required to upload artifacts
       id-token: write # Required for GitHub OIDC token exchange
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -513,10 +511,8 @@ jobs:
       - should-run-gate
       - submit-job
       - resolve-inputs
-    # Job-level permissions for artifact upload
     permissions:
       contents: read # Required to checkout code
-      actions: write # Required to upload artifacts
       id-token: write # Required for GitHub OIDC token exchange
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
