Copilot commented on code in PR #9167:
URL: https://github.com/apache/cloudstack/pull/9167#discussion_r4246579867
##########
.github/workflows/ci.yml:
##########
@@ -28,6 +28,8 @@ concurrency:
cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
permissions:
contents: read
+env:
+ DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
Review Comment:
Setting `DEVELOCITY_ACCESS_KEY` at the workflow level makes the secret
available to every step in the workflow, increasing the chance of accidental
exposure via logs or third-party actions. Prefer scoping it to only the step(s)
that invoke Maven/Develocity (or at least the specific job) to reduce blast
radius.
##########
.mvn/develocity.xml:
##########
@@ -0,0 +1,50 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
+<!--
+
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+
+-->
+
+<develocity
+ xmlns="https://www.gradle.com/develocity-maven";
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";
+ xsi:schemaLocation="https://www.gradle.com/develocity-maven
https://www.gradle.com/schema/develocity-maven.xsd";>
+ <server>
+ <url>https://develocity.apache.org</url>
+ <allowUntrusted>false</allowUntrusted>
+ </server>
+ <buildScan>
+
<backgroundBuildScanUpload>#{isFalse(env['GITHUB_ACTIONS'])}</backgroundBuildScanUpload>
+ <obfuscation>
+ <ipAddresses>#{{'0.0.0.0'}}</ipAddresses>
Review Comment:
The `#{{ ... }}` syntax looks malformed for Develocity's expression
interpolation (typically `#{ ... }`). As written, this may fail XML/config
parsing or prevent IP obfuscation from being applied. Adjust to the correct
expression form supported by Develocity so this value is reliably set.
##########
.github/workflows/build.yml:
##########
@@ -28,6 +28,8 @@ concurrency:
cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
permissions:
contents: read
+env:
+ DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
Review Comment:
The same `env: DEVELOCITY_ACCESS_KEY` block is duplicated across several
workflows in this PR. To reduce future update burden (e.g., secret name changes
or additional env flags), consider centralizing via a reusable workflow
(`workflow_call`) or a shared composite action that sets up Develocity auth and
runs Maven.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
