ci: a publish_snapshot.yml dry run still passes the Nexus secrets to the build
维护者通常 2 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 2/5
- 预计耗时
- 1-3 小时
- 新手友好度
- 74/100
调研方向
阅读publish_snapshot.yml，检查Build and install步骤的环境，以及 issue 中描述的dry_run条件。确认 workflow 在试运行和发布运行中如何处理凭据，然后确保试运行不会暴露 Nexus secrets，同时正常发布仍可部署；检查 workflow diff 中这两种路径。
由索引模型根据 Issue 内容生成。
描述
What is the problem?
publish_snapshot.yml has a dry_run input that builds and verifies the jars without deploying them. A dry run skips the "Configure Maven server credentials" step and uses the install goal, but the Build and install step still sets both Nexus secrets in its environment:
- name: Build and ${{ inputs.dry_run && 'install' || 'deploy' }}
env:
NEXUS_USER: ${{ secrets.NEXUS_USER }}
NEXUS_PW: ${{ secrets.NEXUS_PW }}
GOAL: ${{ inputs.dry_run && 'install' || 'deploy' }}
So a dry run is not credential-free. Maven, its plugins and the build scripts they run can all read NEXUS_USER and NEXUS_PW, though a dry run never needs them.
This is hardening, not a known leak. The secrets are repository Actions secrets, and anyone with write access can already run a modified workflow that uses them. The point is that a run advertised as safe to try, and one that changes allows in a fork (if: github.repository == 'apache/datafusion-comet' || inputs.dry_run), should not carry the publishing credentials at all.
Proposal
Make a dry run credential-free. The smallest change is to leave the variables empty when dry_run is set:
NEXUS_USER: ${{ inputs.dry_run && '' || secrets.NEXUS_USER }}
NEXUS_PW: ${{ inputs.dry_run && '' || secrets.NEXUS_PW }}
A stronger form builds and verifies the jars in one job with no secrets, uploads them, and deploys from a second job that has the secrets and runs only deploy on the verified output. That also keeps the credentials away from the five-variant clean and compile loop in a real run.
Raised in review of #7311, which does not touch this file.
- 主要语言
- Scala
- 星标
- 1.3k
- 派生
- 398
- 平均合并
- 3 天 4 小时
- 30 天内合并 PR
- 363
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
apache/datafusion-comet 的其他 Issue
-
area:ci bug priority:low requires-triage
难度 2/5 1-3 小时 新手友好度 78/100
apache/datafusion-comet#7315 ·
维护者通常 2 天内回复
-
requires-triage
难度 2/5 1-3 小时 新手友好度 72/100
apache/datafusion-comet#7240 ·
维护者通常 2 天内回复
-
bug priority:low
难度 2/5 1-3 小时 新手友好度 82/100
apache/datafusion-comet#7176 ·
维护者通常 2 天内回复
-
docs: update Scala comments that reference the removed iceberg-writes.md page可能已有人在做 关联的 PR 仍在进行中或已合并。 未关闭enhancement
难度 1/5 1-3 小时 新手友好度 83/100
apache/datafusion-comet#7101 ·
维护者通常 2 天内回复
-
requires-triage
难度 2/5 1-3 小时 新手友好度 68/100
apache/datafusion-comet#7001 ·
维护者通常 2 天内回复
查看 apache/datafusion-comet 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 65/100
lichess-org/lila#22324 · 1 条评论 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 73/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 68/100
canton-network/splice#8087 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 82/100
维护者通常 1 天内回复
-
[Task] add `glide-rdma` and `glide-libfabric-sys` to dependabot workflow可能已有人在做 @currantw 今天认领。 未关闭Task 🔧
难度 1/5 1 小时以内 新手友好度 88/100
valkey-io/valkey-glide#7455 · 已指派 1 人 ·
维护者通常 1 天内回复