This is an automated email from the ASF dual-hosted git repository.
potiuk pushed a commit to branch v3-0-test
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/v3-0-test by this push:
new 9fdb73d0f69 [v3-0-test] Avoid pushing images in test canary runs
(#49950) (#50110)
9fdb73d0f69 is described below
commit 9fdb73d0f6971ed84f556851c4dc0e6c5514a36f
Author: Jarek Potiuk <[email protected]>
AuthorDate: Fri May 2 07:34:47 2025 +0200
[v3-0-test] Avoid pushing images in test canary runs (#49950) (#50110)
When testing canary runs from PRs, we cannot push to the image
registry because there is no permission to push the images from
a fork. This leads to misleading "forbidden" error when you set
"canary" label on a PR.
We limit pushing to registry only to "schedule" and "workflow-dispatch"
only - which means that the push will only happen when we either the
scheduled run runs or when committers will trigger the run via the
"workflow-dispatch" mechanism
(cherry picked from commit af97463ee66571eadc0c8a04eb73321acfa9d316)
---
.github/workflows/additional-ci-image-checks.yml | 4 +++-
.github/workflows/ci-image-checks.yml | 4 +++-
.github/workflows/finalize-tests.yml | 14 +++++++++++---
3 files changed, 17 insertions(+), 5 deletions(-)
diff --git a/.github/workflows/additional-ci-image-checks.yml
b/.github/workflows/additional-ci-image-checks.yml
index e9529bd0d08..c4faa7dac05 100644
--- a/.github/workflows/additional-ci-image-checks.yml
+++ b/.github/workflows/additional-ci-image-checks.yml
@@ -116,7 +116,9 @@ jobs:
include-success-outputs: ${{ inputs.include-success-outputs }}
docker-cache: ${{ inputs.docker-cache }}
disable-airflow-repo-cache: ${{ inputs.disable-airflow-repo-cache }}
- if: inputs.branch == 'main'
+ if: >
+ inputs.canary-run == 'true' &&
+ (github.event_name == 'schedule' || github.event_name ==
'workflow_dispatch')
# Check that after earlier cache push, breeze command will build quickly
check-that-image-builds-quickly:
diff --git a/.github/workflows/ci-image-checks.yml
b/.github/workflows/ci-image-checks.yml
index 215e587ae8e..096824a87fe 100644
--- a/.github/workflows/ci-image-checks.yml
+++ b/.github/workflows/ci-image-checks.yml
@@ -324,7 +324,9 @@ jobs:
INCLUDE_SUCCESS_OUTPUTS: "${{ inputs.include-success-outputs }}"
PYTHON_MAJOR_MINOR_VERSION: "${{ inputs.default-python-version }}"
VERBOSE: "true"
- if: inputs.canary-run == 'true' && inputs.branch == 'main'
+ if: >
+ inputs.canary-run == 'true' &&
+ (github.event_name == 'schedule' || github.event_name ==
'workflow_dispatch')
steps:
- name: "Cleanup repo"
shell: bash
diff --git a/.github/workflows/finalize-tests.yml
b/.github/workflows/finalize-tests.yml
index 47db38269b3..ad02cb07d1f 100644
--- a/.github/workflows/finalize-tests.yml
+++ b/.github/workflows/finalize-tests.yml
@@ -127,7 +127,9 @@ jobs:
run: ./scripts/ci/constraints/ci_commit_constraints.sh
if: inputs.canary-run == 'true'
- name: "Push changes"
- if: inputs.canary-run == 'true'
+ if: >
+ inputs.canary-run == 'true' &&
+ (github.event_name == 'schedule' || github.event_name ==
'workflow_dispatch')
working-directory: "constraints"
run:
git push
@@ -138,6 +140,8 @@ jobs:
uses: ./.github/workflows/push-image-cache.yml
permissions:
contents: read
+ # This write is only given here for `push` events from "apache/airflow"
repo. It is not given for PRs
+ # from forks. This is to prevent malicious PRs from creating images in
the "apache/airflow" repo.
packages: write
with:
runs-on-as-json-public: ${{ inputs.runs-on-as-json-public }}
@@ -153,7 +157,9 @@ jobs:
include-success-outputs: ${{ inputs.include-success-outputs }}
docker-cache: ${{ inputs.docker-cache }}
disable-airflow-repo-cache: ${{ inputs.disable-airflow-repo-cache }}
- if: inputs.canary-run == 'true'
+ if: >
+ inputs.canary-run == 'true' &&
+ (github.event_name == 'schedule' || github.event_name ==
'workflow_dispatch')
# push-buildx-cache-to-github-registry-arm:
# name: Push Regular ARM Image Cache
@@ -175,7 +181,9 @@ jobs:
# use-uv: "true"
# include-success-outputs: ${{ inputs.include-success-outputs }}
# docker-cache: ${{ inputs.docker-cache }}
- # if: inputs.canary-run == 'true'
+ # if: >
+ # inputs.canary-run == 'true' &&
+ # (github.event_name == 'schedule' || github.event_name ==
'workflow_dispatch')
summarize-warnings:
timeout-minutes: 15
