Copilot commented on code in PR #9167:
URL: https://github.com/apache/cloudstack/pull/9167#discussion_r4246722697
##########
.github/workflows/ci.yml:
##########
@@ -28,6 +28,8 @@ concurrency:
cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
permissions:
contents: read
+env:
+ DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
Review Comment:
Setting `DEVELOCITY_ACCESS_KEY` at workflow scope makes it available to all
jobs/steps (including any third-party actions used in the workflow), which
increases the risk of accidental exposure in logs or action telemetry. Prefer
scoping the secret to only the specific job or `mvn` step that needs it (this
same pattern is repeated in the other updated workflows).
##########
.mvn/develocity.xml:
##########
@@ -0,0 +1,50 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
+<!--
+
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+
+-->
+
+<develocity
+ xmlns="https://www.gradle.com/develocity-maven";
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";
+ xsi:schemaLocation="https://www.gradle.com/develocity-maven
https://www.gradle.com/schema/develocity-maven.xsd";>
+ <server>
+ <url>https://develocity.apache.org</url>
+ <allowUntrusted>false</allowUntrusted>
+ </server>
+ <buildScan>
+
<backgroundBuildScanUpload>#{isFalse(env['GITHUB_ACTIONS'])}</backgroundBuildScanUpload>
+ <obfuscation>
+ <ipAddresses>#{{'0.0.0.0'}}</ipAddresses>
Review Comment:
The value expression syntax on `<ipAddresses>` appears invalid (`#{{ ...
}}`). Develocity Maven config expressions use `#{ ... }`, so this is likely to
fail parsing at runtime. Use the correct expression syntax (or a plain literal)
so IP obfuscation is applied as intended.
##########
.mvn/develocity.xml:
##########
@@ -0,0 +1,50 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
+<!--
+
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+
+-->
+
+<develocity
+ xmlns="https://www.gradle.com/develocity-maven";
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";
+ xsi:schemaLocation="https://www.gradle.com/develocity-maven
https://www.gradle.com/schema/develocity-maven.xsd";>
+ <server>
+ <url>https://develocity.apache.org</url>
+ <allowUntrusted>false</allowUntrusted>
+ </server>
+ <buildScan>
+
<backgroundBuildScanUpload>#{isFalse(env['GITHUB_ACTIONS'])}</backgroundBuildScanUpload>
+ <obfuscation>
+ <ipAddresses>#{{'0.0.0.0'}}</ipAddresses>
+ </obfuscation>
+ <publishing>
+ <onlyIf>
+ <![CDATA[authenticated]]>
+ </onlyIf>
+ </publishing>
Review Comment:
The PR description says a build scan is published for every CI build, but
`onlyIf` set to `authenticated` means CI runs without an access key (e.g.,
typical forked PR builds where secrets are not provided) will not publish
scans. Either adjust the description to clarify which CI builds are expected to
publish, or broaden the condition (if acceptable) to include CI environments
explicitly.
##########
.mvn/develocity.xml:
##########
@@ -0,0 +1,50 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
+<!--
+
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+
+-->
+
+<develocity
+ xmlns="https://www.gradle.com/develocity-maven";
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";
+ xsi:schemaLocation="https://www.gradle.com/develocity-maven
https://www.gradle.com/schema/develocity-maven.xsd";>
+ <server>
+ <url>https://develocity.apache.org</url>
+ <allowUntrusted>false</allowUntrusted>
+ </server>
+ <buildScan>
+
<backgroundBuildScanUpload>#{isFalse(env['GITHUB_ACTIONS'])}</backgroundBuildScanUpload>
+ <obfuscation>
+ <ipAddresses>#{{'0.0.0.0'}}</ipAddresses>
+ </obfuscation>
+ <publishing>
+ <onlyIf>
+ <![CDATA[authenticated]]>
+ </onlyIf>
+ </publishing>
+ </buildScan>
+ <buildCache>
+ <local>
+ <enabled>false</enabled>
+ </local>
+ <remote>
+ <enabled>false</enabled>
Review Comment:
With `<remote><enabled>false</enabled>`, the `<storeEnabled>` setting is
ineffective and may be confusing to future maintainers. Either remove
`<storeEnabled>` while remote caching is disabled, or add a brief comment
explaining that it is intentionally pre-configured for a future enablement.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
