runs on

.github/workflows/community-prs-ok-to-test.yaml

@@ -0,0 +1,24 @@
+name: Community PRs Approved to Run Workflows
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened, labeled]
+
+permissions:
+  contents: read
+
+jobs:
+  run-with-approval:
+    if: >
+      github.event.pull_request.head.repo.fork == true &&
+      contains(github.event.pull_request.labels.*.name, 'run-workflows')
+
+    environment: external-prs   # approval gate; no env secrets needed
+
+    uses: ./.github/workflows/pr-playwright-tests.yml
+    with:
+      pr_repo: ${{ github.event.pull_request.head.repo.full_name }}
+      pr_sha:  ${{ github.event.pull_request.head.sha }}
+      # If your policy forbids forks on self-hosted runners, uncomment:
+      # runner: '["ubuntu-latest"]'
+    secrets: inherit

.github/workflows/pr-playwright-tests.yml

@@ -1,34 +1,56 @@
 name: Run Playwright Tests
+
+on:
+  push:            # keeps existing internal runs
+  workflow_call:   # allows a caller to run this against a fork PR
+    inputs:
+      pr_repo:
+        type: string
+        required: false
+        default: ${{ github.repository }}
+      pr_sha:
+        type: string
+        required: false
+        default: ${{ github.sha }}
+      # Optional: let the caller switch runners for forks
+      runner:
+        type: string
+        required: false
+        default: '["runs-on","runner=32cpu-linux-x64","disk=large","run-id=${{ github.run_id }}"]'
+
+permissions:
+  contents: read
+
 concurrency:
-  group: Run-Playwright-Tests-${{ github.workflow }}-${{ github.head_ref || github.event.workflow_run.head_branch || github.run_id }}
+  group: Run-Playwright-Tests-${{ github.workflow }}-${{ inputs.pr_sha || github.head_ref || (github.event_name == 'workflow_run' && github.event.workflow_run.head_branch) || github.ref_name || github.run_id }}
   cancel-in-progress: true
 
-on: push
-
 env:
-  OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
-  SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
-  GEN_AI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
   MOCK_LLM_RESPONSE: true
   PYTEST_PLAYWRIGHT_SKIP_INITIAL_RESET: true
 
 jobs:
   playwright-tests:
     name: Playwright Tests
+    runs-on: ${{ inputs.runner || '["runs-on","runner=32cpu-linux-x64","disk=large","run-id=${{ github.run_id }}"]' }}
+
+    # Secrets come from the caller (via `secrets: inherit`)
+    env:
+      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+      SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+      GEN_AI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+      # Vars (non-secret) pulled from repo/org vars:
+      RUNS_ON_AWS_REGION: ${{ vars.RUNS_ON_AWS_REGION }}
+      RUNS_ON_S3_BUCKET_CACHE: ${{ vars.RUNS_ON_S3_BUCKET_CACHE }}
 
-    # See https://runs-on.com/runners/linux/
-    runs-on:
-      [
-        runs-on,
-        runner=32cpu-linux-x64,
-        disk=large,
-        "run-id=${{ github.run_id }}",
-      ]
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
         with:
+          repository: ${{ inputs.pr_repo }}
+          ref: ${{ inputs.pr_sha }}
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Set up Python
         uses: actions/setup-python@v5

backend/onyx/connectors/sharepoint/connector.py

@@ -506,6 +506,7 @@ class SharepointConnector(
         self.include_site_documents = include_site_documents
         self.sp_tenant_domain: str | None = None
 
+    def validate_connector_settings(self) -> None:
         # Validate that at least one content type is enabled
         if not self.include_site_documents and not self.include_site_pages:
             raise ConnectorValidationError(

backend/tests/daily/connectors/sharepoint/test_sharepoint_connector.py

@@ -138,7 +138,9 @@ def test_sharepoint_connector_specific_folder(
     ):
         # Initialize connector with the test site URL and specific folder
         connector = SharepointConnector(
-            sites=[os.environ["SHAREPOINT_SITE"] + "/Shared Documents/test"]
+            sites=[os.environ["SHAREPOINT_SITE"] + "/Shared Documents/test"],
+            include_site_pages=False,
+            include_site_documents=True,
         )
 
         # Load credentials
@@ -216,7 +218,9 @@ def test_sharepoint_connector_other_library(
         connector = SharepointConnector(
             sites=[
                 os.environ["SHAREPOINT_SITE"] + "/Other Library",
-            ]
+            ],
+            include_site_pages=False,
+            include_site_documents=True,
         )
 
         # Load credentials