Feature/922 make permissions configurable for custom workflows by ArBridgeman · Pull Request #923 · exasol/python-toolbox

ArBridgeman · 2026-07-09T11:58:44Z

closes #922

Checklist

Note: If any of the items in the checklist are not relevant to your PR, just check the box.

For any Pull Request

Is the following correct:

the title of the Pull Request?
the title of the corresponding issue?
there are no other open Pull Requests for the same update/change?
that the issue which this Pull Request fixes ("Fixes...") is mentioned?

When Changes Were Made

Did you:

update the changelog?
update the cookiecutter-template?
update the implementation?
check coverage and add tests: unit tests and, if relevant, integration tests?
update the User Guide & other documentation?
resolve any failing CI criteria (incl. Sonar quality gate)?

When Preparing a Release

Have you:

thought about version number (major, minor, patch)?
checked Exasol packages for updates and resolved open vulnerabilities, if easily possible?

…flows

… be handled separately

…in ALL anymore

- This is already present in the CLI of the nox sessions workflow:check and workflow:generate - This is already required by the WorkflowOrchestrator which is a pydantic model which restricts WorkflowChoice and hard-code maps it to the right values.

ArBridgeman · 2026-07-10T09:49:51Z

@codex

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 69e8d1492a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

…r_custom_workflows

ckunki · 2026-07-13T07:10:44Z

+Custom Workflow Metadata
+^^^^^^^^^^^^^^^^^^^^^^^^
+
+The PTB extracts metadata from reusable custom workflow files and exposes it


I like the general and technical description.

Could we, for more straight-forward and impatient users, add a small section with concrete instructions?

What do I need to do?

When? (In which Scenario / Use Case / Problem)

Example, maybe a pointer to one of the PTB's workflow templates illustrating the usage?

I think for impatient users they can use codex to summarize what's already there.
There really isn't in my opinion too much text.
Each section already has an example showing what to do.

Perhaps, there was some confusion as the headers weren't properly defined. I've fixed that in a commit so it looks like.

ckunki · 2026-07-13T07:15:00Z

+    (% if custom_workflows["merge-gate"].permissions %)
    permissions:
-      contents: read
+      (% for permission_name, permission_level in custom_workflows["merge-gate"].permissions.items() %)


As this pattern repeats 3-4 times - would it make sense to move the functionality into an API function
and in the jinja template only have a call like this (not sure if this is possible)?:

(% workflow_permissions("merge-gate") %)

I implemented this separately for secrets being passed and permissions.

ckunki · 2026-07-13T07:23:56Z

+        raise ValueError(f"Unknown GitHub permission level: {value!r}")
+
+
+def merge_permissions(permission_maps: list[dict[str, str]]) -> dict[str, str]:


I think I can get the goal of the implementation, but my stomach says there must be a simpler, shorter way.

How about this approach?

Permissions: TypeAlias = dict[str, str] """ Each permission is defined by a name as it key and a value, which is either None, or "read" or "write". """ def merge_permissions(permission_maps: list[Permissions]) -> Permissions: """Merge permission maps to keep the greater permission.""" rank = {None: 0, "read": 1, "write": 2} result = {} def max_permission(perm: str, value: str) -> str: current = result.get(perm) return value if rank[value] > rank[current] else current for other in permission_maps: result |= {p: max_permission(p, v) for p, v in other.items()} return result

No enum required, < 70% characters, tests still green.

Ok, I removed the enum and simplified it.

sonarqubecloud · 2026-07-14T14:14:33Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

stale

ArBridgeman added 5 commits July 9, 2026 10:48

Fix typos in changelogs

7a832d8

Make permissions block present in workflows that call the custom work…

c37d96c

…flows

Add documentation for new feature

5d7f0ed

Add jinja test

620fde3

Prepare config test

24cfb7b

ArBridgeman requested a deployment to manual-approval July 9, 2026 11:58 — with GitHub Actions Waiting

Add extract_permissions

bea075f

ArBridgeman force-pushed the feature/922_make_permissions_configurable_for_custom_workflows branch from 10e54e9 to 3b03bca Compare July 10, 2026 08:53

ArBridgeman requested a deployment to manual-approval July 10, 2026 08:53 — with GitHub Actions Waiting

ArBridgeman requested a deployment to manual-approval July 10, 2026 08:55 — with GitHub Actions Waiting

ArBridgeman added 5 commits July 10, 2026 10:57

Remove not-maintained workflows from get_workflow_templates - need to…

92a1ae4

… be handled separately

Remove now unneeded custom exception as not maintained workflows not …

c3d2872

…in ALL anymore

Remove redundant check

0a36b86

- This is already present in the CLI of the nox sessions workflow:check and workflow:generate - This is already required by the WorkflowOrchestrator which is a pydantic model which restricts WorkflowChoice and hard-code maps it to the right values.

Ensure NOT_MAINTAINED_WORKFLOWS are seeded first

1ac5e10

Tighten wording in documentation

69e8d14

ArBridgeman force-pushed the feature/922_make_permissions_configurable_for_custom_workflows branch from 1eae0d1 to 69e8d14 Compare July 10, 2026 08:58

ArBridgeman temporarily deployed to manual-approval July 10, 2026 08:58 — with GitHub Actions Inactive

ArBridgeman commented Jul 10, 2026

View reviewed changes

Comment thread exasol/toolbox/util/workflows/workflow_orchestrator.py

chatgpt-codex-connector Bot reviewed Jul 10, 2026

View reviewed changes

Comment thread exasol/toolbox/util/workflows/custom_workflow.py

Comment thread exasol/toolbox/util/workflows/custom_workflow.py

Merge branch 'main' into feature/922_make_permissions_configurable_fo…

30a3ac2

…r_custom_workflows

ArBridgeman temporarily deployed to manual-approval July 10, 2026 12:15 — with GitHub Actions Inactive

kratz00 reviewed Jul 13, 2026

View reviewed changes

Comment thread doc/changes/unreleased.md Outdated

Comment thread exasol/toolbox/util/workflows/custom_workflow.py Outdated

ckunki previously requested changes Jul 13, 2026

View reviewed changes

Apply text changes from reviewers

08f30e6

Resolve sonar finding

98dbec0

ArBridgeman requested a deployment to manual-approval July 14, 2026 13:17 — with GitHub Actions Waiting

Fix type hints

3663d2b

ArBridgeman force-pushed the feature/922_make_permissions_configurable_for_custom_workflows branch from fa2b11c to 3663d2b Compare July 14, 2026 13:27

ArBridgeman requested a deployment to manual-approval July 14, 2026 13:27 — with GitHub Actions Waiting

ArBridgeman requested review from ckunki and kratz00 July 14, 2026 13:28

Resolve sonar finding - attempt 2

5087874

ArBridgeman requested a deployment to manual-approval July 14, 2026 13:35 — with GitHub Actions Waiting

Set autoescape=False as unneeded

d9b094c

ArBridgeman requested a deployment to manual-approval July 14, 2026 13:42 — with GitHub Actions Waiting

Simplify tests as already covered

85d2873

ArBridgeman requested a deployment to manual-approval July 14, 2026 13:49 — with GitHub Actions Waiting

Resolve sonar finding - attempt 3

f9680a8

ArBridgeman requested a deployment to manual-approval July 14, 2026 13:52 — with GitHub Actions Waiting

Resolve sonar finding - attempt 4

923c88e

ArBridgeman requested a deployment to manual-approval July 14, 2026 13:58 — with GitHub Actions Waiting

Resolve new sonar finding

4e01cdf

ArBridgeman deployed to manual-approval July 14, 2026 14:02 — with GitHub Actions Active

ArBridgeman temporarily deployed to manual-approval July 14, 2026 14:02 — with GitHub Actions Inactive

kratz00 approved these changes Jul 14, 2026

View reviewed changes

		raise ValueError(f"Unknown GitHub permission level: {value!r}")


		def merge_permissions(permission_maps: list[dict[str, str]]) -> dict[str, str]:

Uh oh!

Conversation

ArBridgeman commented Jul 9, 2026

Checklist

For any Pull Request

When Changes Were Made

When Preparing a Release

Uh oh!

Uh oh!

ArBridgeman commented Jul 10, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ckunki Jul 13, 2026

Choose a reason for hiding this comment

Uh oh!

ArBridgeman Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ArBridgeman Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ckunki Jul 13, 2026

Choose a reason for hiding this comment

Uh oh!

ArBridgeman Jul 14, 2026

Choose a reason for hiding this comment

Uh oh!

ckunki Jul 13, 2026

Choose a reason for hiding this comment

Uh oh!

ArBridgeman Jul 14, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sonarqubecloud Bot commented Jul 14, 2026

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

ArBridgeman Jul 14, 2026 •

edited

Loading

ArBridgeman Jul 14, 2026 •

edited

Loading