Repository navigation
feat(runs): submit and manage runs as a team - #2929
Merged
Merged
Conversation
🎩 PreviewA preview build has been created at: |
This was referenced Oct 22, 2026
camielvs
force-pushed
the
cvs/team-run-methods
branch
from
October 22, 2026 20:12
4835e22 to
96d0264
Compare
This was referenced Oct 22, 2026
camielvs
force-pushed
the
cvs/team-run-methods
branch
from
October 23, 2026 22:58
96d0264 to
9a8d18e
Compare
camielvs
force-pushed
the
cvs/team-run-methods
branch
from
October 26, 2026 21:56
9a8d18e to
ebba8b8
Compare
camielvs
force-pushed
the
cvs/team-run-methods
branch
2 times, most recently
from
October 29, 2026 20:21
eee9b42 to
859263c
Compare
camielvs
force-pushed
the
cvs/team-run-methods
branch
from
October 29, 2026 23:33
859263c to
32568ba
Compare
camielvs
commented
Oct 30, 2026
camielvs
force-pushed
the
cvs/team-run-methods
branch
from
October 30, 2026 18:51
32568ba to
788ca7a
Compare
camielvs
force-pushed
the
cvs/team-run-methods
branch
from
October 30, 2026 20:35
788ca7a to
c75f89a
Compare
camielvs
marked this pull request as ready for review
October 30, 2026 21:24
camielvs
force-pushed
the
cvs/team-run-methods
branch
from
October 30, 2026 21:46
c75f89a to
aae5a6c
Compare
maxy-shpfy
approved these changes
Oct 30, 2026
A run looks up its secrets in the account of whoever created it, so a run that uses a team's secrets has to be created as that team. Once it is, the backend only lets the run's creator change it. These methods now take an optional team id and send the impersonation header when given one. Every caller still passes none, so nothing changes yet. - `submitPipelineRun` takes `teamId` and passes it to `createPipelineRun`. - `saveRunAnnotations` and `updateRunAnnotation` take it too. The notes and tags written right after submit are separate requests, and without the header they would be refused for a run the team created. - `cancelPipelineRun` takes it, for cancelling a run the team created. - `useTeamForRunAnnotations` resolves the team of the projects a run is filed under. That one rule serves both a run about to be submitted (the annotations it will carry) and a run already stored, so a rerun or cancel from a run page outside any project still finds the team. - `referencedSecretNames` and `missingSecretNames` find the secrets a run needs and which of them an account lacks, for a check before submit. A secret reference holds only a name, so a run submitted from the wrong context would otherwise fail at launch or quietly use a same-named secret from another account. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
camielvs
force-pushed
the
cvs/team-run-methods
branch
from
October 31, 2026 00:12
aae5a6c to
aa794b5
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
A run looks up its secrets in the account of whoever created it, so a run that uses a team's secrets has to be created as that team. Once it is, the backend only lets the run's creator annotate it, and only its creator or someone with wider rights, such as an admin, cancel it. These methods now take an optional team id and send the impersonation header when given one. Every caller still passes none, so nothing changes yet.
submitPipelineRuntakesteamIdand passes it tocreatePipelineRun.saveRunAnnotationsandupdateRunAnnotationtake it too. The notes and tags written right after submit are separate requests. Without the header they would be refused for a run the team created.cancelPipelineRuntakes it, so a run the team created can be cancelled.useTeamForRunAnnotationsresolves the team of the projects a run is filed under. The same rule covers a run about to be submitted (the annotations it will carry) and a run already stored. So a rerun or cancel from a run page outside any project still finds the team.referencedSecretNamesandmissingSecretNamesfind the secrets a run needs and which of them an account lacks, for a check before submit. A secret reference holds only a name. Without this check, a run submitted from the wrong context would fail at launch, or quietly use a same-named secret from another account.Related Issue and Pull requests
Type of Change
Line Breakdown
Checklist
Screenshots (if applicable)
None. There's no UI change.
Test Instructions
To check by hand that nothing regressed:
All three should behave as on
master.Additional Comments
submitPipelineassertions gained a trailingundefinedfor the newteamIdargument. None of their expectations changed.cancelPipelineRunandupdateRunAnnotationgo throughfetchWithErrorHandling, which drops the response'sdetail. A refused impersonation there surfaces as a generic error until that's handled.🤖 Generated with Claude Code