From 742a3ad93df7bb43b1fa0b1e8eb3adba915bcaf3 Mon Sep 17 00:00:00 2001 From: Joshua Valluru <326636767+joshua-berri@users.noreply.github.com> Date: Sat, 19 Sep 2026 13:30:36 -0700 Subject: [PATCH] ci(e2e): trigger OAuth acceptance on relevant pull requests --- .github/workflows/test-mcp-oauth-e2e.yml | 20 ++++++++++++++++++++ tests/e2e/CONTRIBUTING.md | 13 ++++++++++--- 2 files changed, 30 insertions(+), 3 deletions(-) diff --git a/.github/workflows/test-mcp-oauth-e2e.yml b/.github/workflows/test-mcp-oauth-e2e.yml index 7625fb4d59f..034b9fe49ec 100644 --- a/.github/workflows/test-mcp-oauth-e2e.yml +++ b/.github/workflows/test-mcp-oauth-e2e.yml @@ -1,6 +1,26 @@ name: MCP OAuth happy path on: + pull_request: + paths: + - '.github/workflows/test-mcp-oauth-e2e.yml' + - '.github/e2e-stack/**' + - 'tests/e2e/*.py' + - 'tests/e2e/pytest.ini' + - 'tests/e2e/idp_realm.json' + - 'tests/e2e/mcp/**' + - 'litellm/experimental_mcp_client/**' + - 'litellm/proxy/_experimental/mcp_server/**' + - 'litellm/proxy/auth/**' + - 'litellm/proxy/management_endpoints/*sso*.py' + - 'litellm/proxy/management_endpoints/sso/**' + - 'litellm/proxy/common_utils/encrypt_decrypt_utils.py' + - 'litellm/proxy/proxy_server.py' + - 'litellm/proxy/schema.prisma' + - 'ui/litellm-dashboard/src/app/connect/**' + - 'ui/litellm-dashboard/src/app/mcp/oauth/**' + - 'pyproject.toml' + - 'uv.lock' workflow_dispatch: permissions: {} diff --git a/tests/e2e/CONTRIBUTING.md b/tests/e2e/CONTRIBUTING.md index 2adac08329f..6c3dc4d0bd1 100644 --- a/tests/e2e/CONTRIBUTING.md +++ b/tests/e2e/CONTRIBUTING.md @@ -281,9 +281,16 @@ aggregate client never injects a gateway header; the explicitly labeled JWT variant configures `x-litellm-api-key` for the first consent and reconnects with only its gateway JWT after restart -`.github/workflows/test-mcp-oauth-e2e.yml` runs the four cases in the protected -`e2e-changed` environment. Provision `E2E_LINEAR_STORAGE_STATE_B64` as a secret -there and retain the existing E2E license/AWS role configuration. A missing or +`.github/workflows/test-mcp-oauth-e2e.yml` automatically requests a run for +same-repository pull requests changing MCP, gateway authentication/SSO, consent +UI, dependencies or the relevant E2E harness/workflow paths. It retains manual +`workflow_dispatch` for targeted verification. The four cases run in the +protected `e2e-changed` environment after its normal deployment approval; +reviewers should approve and inspect this separate OAuth check when it appears. +Fork pull requests do not run this credentialed job; use a reviewed +same-repository branch for their verification. The workflow's path-filtered +check is not configured here as a globally required branch-protection check. +Provision `E2E_LINEAR_STORAGE_STATE_B64` as a secret there and retain the existing E2E license/AWS role configuration. A missing or expired session fails the job; collection, deselection and skips are not passes. The generic changed-test job excludes this file because it requires an owned proxy and consent UI. No LLM call is needed