github-actions[bot] commented on code in PR #66349:
URL: https://github.com/apache/doris/pull/66349#discussion_r3695605093
##########
.github/workflows/code-review-runner.yml:
##########
@@ -946,27 +949,46 @@ jobs:
OSS_ENDPOINT: oss-cn-hongkong.aliyuncs.com
OSS_CODEX_SESSION_PREFIX: oss://doris-community-ci/session
- - name: Sync Codex auth back to OSS
- if: ${{ always() }}
- continue-on-error: true
+ - name: Sync refreshed Codex auth back to OSS
+ if: ${{ always() && steps.auth.outcome == 'success' }}
timeout-minutes: 5
run: |
- if [ -z "$CODEX_AUTH_OSS_OBJECT" ]; then
- echo "No selected Codex auth object found; skipping OSS auth sync."
+ jq -e '
+ .auth_mode == "chatgpt"
+ and (.tokens.access_token | type == "string" and length > 0)
+ and (.tokens.refresh_token | type == "string" and length > 0)
+ ' "$CODEX_HOME/auth.json" >/dev/null
+
+ original_hash="$(<"$RUNNER_TEMP/codex-auth-original.sha256")"
+ local_hash="$(sha256sum "$CODEX_HOME/auth.json" | awk '{print $1}')"
+ if [ "$local_hash" = "$original_hash" ]; then
+ echo "Codex auth was not refreshed; skipping OSS auth sync."
exit 0
fi
- if [ ! -s "$CODEX_HOME/auth.json" ]; then
- echo "No Codex auth file found; skipping OSS auth sync."
+ remote_auth="$(mktemp "$RUNNER_TEMP/codex-auth-current.XXXXXX")"
+ trap 'rm -f "$remote_auth"' EXIT
+ chmod 600 "$remote_auth"
Review Comment:
[P2] Keep the downloaded credential copy private
This `chmod` only applies to the empty placeholder. Pinned `ossutil` v1.7.19
uses `aliyun-oss-go-sdk` v3.0.2, whose small-file
[`GetObjectToFile`](https://github.com/aliyun/aliyun-oss-go-sdk/blob/v3.0.2/oss/bucket.go#L152-L191)
writes to `filePath + ".temp"` with
[`FilePermMode=0664`](https://github.com/aliyun/aliyun-oss-go-sdk/blob/v3.0.2/oss/const.go#L240-L243)
and then renames that file over the destination; on a streaming error it can
leave the temp file behind. With the runner's default `0022` umask, the current
OSS auth (including access and refresh tokens) therefore becomes `0644`, while
this trap removes only the placeholder/final path. Please download inside a
`0700` temporary directory, or set `umask 077` and clean both the destination
and SDK temp path; a chmod only after success would still leave the failure
path exposed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
