Copilot commented on code in PR #9167:
URL: https://github.com/apache/cloudstack/pull/9167#discussion_r4249900312
##########
.github/workflows/ci.yml:
##########
@@ -307,6 +309,8 @@ jobs:
mkdir -p ~/.m2/repository
tar -xzf /tmp/artifacts/m2-cloudstack.tar.gz -C ~/.m2/repository
- name: Setup Simulator Prerequisites
+ env:
+ DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
Review Comment:
`DEVELOCITY_ACCESS_KEY` is being injected into steps that don't invoke Maven
(including a step that installs Python packages, which executes third-party
code). This unnecessarily broadens secret exposure within the job. Scope the
access key env var only to the steps that actually run `mvn` (or other
Develocity-relevant tooling), and remove it from these non-Maven steps.
##########
.github/workflows/ci.yml:
##########
@@ -329,6 +335,8 @@ jobs:
echo -e "\nStarting Advanced Zone DataCenter deployment"
python3 tools/marvin/marvin/deployDataCenter.py -i
setup/dev/advdualzone.cfg 2>&1 || true
- name: Run Integration Tests with Simulator
+ env:
+ DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
Review Comment:
`DEVELOCITY_ACCESS_KEY` is being injected into steps that don't invoke Maven
(including a step that installs Python packages, which executes third-party
code). This unnecessarily broadens secret exposure within the job. Scope the
access key env var only to the steps that actually run `mvn` (or other
Develocity-relevant tooling), and remove it from these non-Maven steps.
##########
.github/workflows/ci.yml:
##########
@@ -319,6 +323,8 @@ jobs:
find . | grep "src/main/java" | sed 's/\/java\//\/java /g' | awk
'{print "--sourcefiles", $1, "\\"}' | sort | uniq >> jacoco-report.sh
echo "--xml jacoco-coverage.xml" >> jacoco-report.sh
- name: Start CloudStack Management Server with Simulator
+ env:
+ DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
Review Comment:
`DEVELOCITY_ACCESS_KEY` is being injected into steps that don't invoke Maven
(including a step that installs Python packages, which executes third-party
code). This unnecessarily broadens secret exposure within the job. Scope the
access key env var only to the steps that actually run `mvn` (or other
Develocity-relevant tooling), and remove it from these non-Maven steps.
##########
.mvn/develocity.xml:
##########
@@ -0,0 +1,50 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
+<!--
+
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+
+-->
+
+<develocity
+ xmlns="https://www.gradle.com/develocity-maven";
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";
+ xsi:schemaLocation="https://www.gradle.com/develocity-maven
https://www.gradle.com/schema/develocity-maven.xsd";>
+ <server>
+ <url>https://develocity.apache.org</url>
+ <allowUntrusted>false</allowUntrusted>
+ </server>
+ <buildScan>
+
<backgroundBuildScanUpload>#{isFalse(env['GITHUB_ACTIONS'])}</backgroundBuildScanUpload>
+ <obfuscation>
+ <ipAddresses>#{{'0.0.0.0'}}</ipAddresses>
+ </obfuscation>
+ <publishing>
+ <onlyIf>
+ <![CDATA[authenticated]]>
+ </onlyIf>
+ </publishing>
+ </buildScan>
+ <buildCache>
+ <local>
+ <enabled>false</enabled>
+ </local>
+ <remote>
+ <enabled>false</enabled>
+ <storeEnabled>#{isTrue(env['GITHUB_ACTIONS'])}</storeEnabled>
Review Comment:
With `<enabled>false</enabled>`, the remote build cache is disabled, so
`<storeEnabled>` will never take effect and is misleading. Either remove
`<storeEnabled>` to avoid confusion (aligning with the PR's 'caching disabled'
intent), or gate `<enabled>` itself via the same condition if the goal is to
selectively enable storing in CI.
##########
.mvn/develocity.xml:
##########
@@ -0,0 +1,50 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
+<!--
+
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied. See the License for the
+ specific language governing permissions and limitations
+ under the License.
+
+-->
+
+<develocity
+ xmlns="https://www.gradle.com/develocity-maven";
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";
+ xsi:schemaLocation="https://www.gradle.com/develocity-maven
https://www.gradle.com/schema/develocity-maven.xsd";>
+ <server>
+ <url>https://develocity.apache.org</url>
+ <allowUntrusted>false</allowUntrusted>
+ </server>
+ <buildScan>
+
<backgroundBuildScanUpload>#{isFalse(env['GITHUB_ACTIONS'])}</backgroundBuildScanUpload>
+ <obfuscation>
+ <ipAddresses>#{{'0.0.0.0'}}</ipAddresses>
Review Comment:
The expression syntax `#{{'0.0.0.0'}}` is likely invalid for
Develocity/Maven configuration interpolation (the usual form is `#{ ... }`, and
`ipAddresses` is commonly a literal value). As written, this risks the
Develocity config failing to parse and could break builds. Use a valid
single-expression form or a plain literal value for `<ipAddresses>`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
