The GitHub Actions job "CI" on rocketmq-dashboard.git/fix/tool-token-single-use-20260921 has failed. Run started by GitHub user pilichoumao (triggered by pilichoumao).
Head commit for run: 677197954f3465f3408a1fb97a7540874b5be916 / pilichoumao <[email protected]> fix(ai): consume confirmation tokens atomically before mutation Confirmation tokens issued by a dry-run preview were validated on every apply but never recorded as used, so one valid token could execute the same non-idempotent mutation repeatedly (message sends, offset resets, resource deletes), amplifying accidental replays. Each preview now embeds a random 16-hex token id in the signed v2 token, and apply verifies expiry, signature and bindings first, then consumes the id with a single putIfAbsent before the mutation runs. Concurrent or repeated applies of one token admit exactly one execution; a consumed token is rejected as 409 CONFLICT with a re-preview hint, while expired, tampered or rebound tokens keep their existing INVALID_ARGUMENT result. Consumed ids live in an in-memory store that matches the single-node deployment model and purges entries opportunistically once their token expires; legacy v1 tokens are rejected as invalid. This defines one-time consumption only: safe retries after a network timeout and plan-digest binding remain separate follow-ups. Co-Authored-By: Claude Code <[email protected]> Report URL: https://github.com/apache/rocketmq-dashboard/actions/runs/37096664646 With regards, GitHub Actions via GitBox
