OWNERS files support for approving pull-requests before executing pipelines

[nagasree9]

Feature request

I would like to have a github interceptor that blocks a pull request trigger from being executed unless invoked by an owner or with a configurable comment by an owner, for example /ok_to_test. Owners would be defined in an OWNERS file at the root of the repository

Use case

We have a few terraform modules in which a lot of developers from different teams contribute into. We run into situations where developers are first time contributors and it would be helpful to trigger a pull request pipeline run only after reviewed by an owner of the module. This would save the resources of the namespace for approved pipelines

[dibyom]

Related Work: we were building something similar for Tekton's own CI tektoncd/plumbing#482

[nagasree9]

I have created a POC for the issue described and here is the link https://github.com/nagasree9/githubowners-interceptor

This cluster interceptor will check if the pull_request sender or the pull_request comment sender with body /ok-to-test is a member of organization or repository or the owners file. If either of these returns true the response to trigger is continue:true and would trigger the taskrun, if neither of these returns true the response to trigger is continue:false and would not trigger any taskrun

FYI - The enterprise example will not be useable unless changes are made, it is used for internal testing at the moment.

[dibyom]

@nagasree9 thank you! I haven't gone through all the code but from looking at the examples this works the way I'd expect. I think we could potentially bikeshed on naming the paramters + how to specify the enterprise owners but those are minor issues.

I think it might make sense to see if we can add this functionality to the github interceptor we ship as part of triggers - the owner approval etc. will be optional fields - what do you think @khrm @savitaashture ? Also, are you open to contributing this to triggers @nagasree9 ?

[nagasree9]

@dibyom yes, I am open to contribute into triggers github interceptor.

Could you please throw some light on what you are thinking areound with this "how to specify the enterprise owners".

[dibyom]

@dibyom yes, I am open to contribute into triggers github interceptor.

Awesome!

Could you please throw some light on what you are thinking areound with this "how to specify the enterprise owners".

I was referring to supporting for GitHub enterprise and how that can be configured on the interceptor!

[nagasree9]

@dibyom @savitaashture @khrm While integrating the owners feature into github interceptor should this code go into github.go (pkg/interceptors/github/github.go) or should it be a separate go file (pkg/interceptors/github/owners.go) of its own and call it into the github.go process. What is the recommendation here if there is a specific direction?

[khrm]

It's fine to use the same file.

[nagasree9]

sure, Thank you

[dibyom]

Yeah, we can split it out if necessary but using the same file sounds good for now!

[vdemeester]

/area roadmap