potiuk commented on PR #70927:
URL: https://github.com/apache/airflow/pull/70927#issuecomment-5318670072
Agreed — these are the same change, and since you've already pulled the
versioning bundle across, #71192 is the one to land. Your token model is the
better of the two: mine only forces the workload token to be validated once,
whereas yours makes it single-use and narrows what the callback can do after
the exchange. Closing this one as superseded.
Two things worth carrying over before it goes:
1. The `supervise_callback` tests from here —
`test_claim_runs_before_the_subprocess_starts` and
`test_a_rejected_claim_prevents_the_subprocess_from_starting`. #71192 tests the
endpoint and the client, but nothing at the supervisor level, and the ordering
assertion is what actually pins the property we care about: no callback code
runs until the token is redeemed.
2. `callback:self` → `cb:self`, to match the existing `ti:self` / `ct:self`
naming.
Happy to port both over to your branch myself if that's easier — just say
the word and I'll open a PR against it.
One thing that came over from my branch and needs a fresh look on rebase:
the bundle now has `Version("2026-08-01", AddCallbackRunEndpoint)` sitting
below `Version("2026-10-30", ...)`. The date was fine when I opened this on Aug
1, but 2026-10-30 has since shipped without the endpoint, so as it stands a
client negotiating 2026-10-30 gets a route introduced by an earlier-dated
version. Worth re-dating past 2026-10-30.
No need to port `TestCbSelfScopeEnforcement` — your real-JWT test in
`versions/head/test_callbacks.py` covers that ground better.
---
Drafted-by: Claude Code (Opus 5); reviewed by @potiuk before posting
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
