diff --git a/.changeset/e2e-staging-permissions-check.md b/.changeset/e2e-staging-permissions-check.md new file mode 100644 index 00000000000..a845151cc84 --- /dev/null +++ b/.changeset/e2e-staging-permissions-check.md @@ -0,0 +1,2 @@ +--- +--- diff --git a/.github/workflows/e2e-staging.yml b/.github/workflows/e2e-staging.yml index f6b233bb20c..f2967cd05b2 100644 --- a/.github/workflows/e2e-staging.yml +++ b/.github/workflows/e2e-staging.yml @@ -37,8 +37,39 @@ concurrency: cancel-in-progress: true jobs: + permissions-check: + name: Check Permissions + runs-on: 'blacksmith-8vcpu-ubuntu-2204' + steps: + - name: Check org membership + uses: actions/github-script@v7 + with: + script: | + const org = context.repo.owner; + const username = process.env.GITHUB_TRIGGERING_ACTOR || context.actor; + + try { + const { status } = await github.rest.orgs.checkMembershipForUser({ + org, + username, + }); + + if (status !== 204) { + core.setFailed(`User '${username}' is not a member of the '${org}' organization.`); + } + } catch (error) { + if (error?.status === 404) { + core.setFailed(`User '${username}' is not a member of the '${org}' organization.`); + } else { + core.setFailed( + `Org membership check failed for '${username}' in '${org}' (status: ${error?.status ?? 'unknown'}): ${error?.message ?? 'unknown error'}` + ); + } + } + validate-instances: name: Validate Staging Instances + needs: [permissions-check] runs-on: 'blacksmith-8vcpu-ubuntu-2204' steps: - name: Checkout Repo @@ -56,6 +87,7 @@ jobs: integration-tests: name: Integration Tests (${{ matrix.test-name }}, ${{ matrix.test-project }}) + needs: [permissions-check] runs-on: 'blacksmith-8vcpu-ubuntu-2204' defaults: run: