* ci(ksai): start a KSAI run only for people who can write to the repository
A comment or review now starts the KSAI run job only when its author
can write to this repository. A new authorize job reads the author's
permission with the workflow token, and the run job needs it. A
dispatched run starts as before.
Signed-off-by: Bart Smykla <bartek@smykla.com>
* ci(ksai): fail the authorize step when the permission read fails
A failed permission read used to answer writes=false with a green
job, so a writer's comment started nothing and the log said nothing.
The step now fails on a read error, the run job still does not start,
and the log names the error. An author who cannot write still reads
as writes=false.
Signed-off-by: Bart Smykla <bartek@smykla.com>
---------
Signed-off-by: Bart Smykla <bartek@smykla.com>
A public repository cannot call a reusable workflow in the internal
KSAI repository, so the setup workflow fails before any job starts
with "workflow was not found". Call the published snapshot instead,
pinned to the current release and following its consumer template,
with every command enabled and a review on each opened pull request.
The snapshot names no model gateway of its own, so the call passes the
organization's gateway variable. It runs on GitHub-hosted runners,
because the Kong runner pool serves no public repository, and with no
GitHub App at all: push_as_app is false and no key is passed, so every
read and write goes through GITHUB_TOKEN.
Signed-off-by: Bart Smykla <bartek@smykla.com>
Bart Smykla