DanielLeens commented on PR #12638: URL: https://github.com/apache/seatunnel/pull/12638#issuecomment-6368694277
One correction to my earlier CI follow-up: the website failure has a deterministic missing-token cause, so rerunning the unchanged workflow does not address that failure. At PR head `70d4b910cca6332bc2884578cd59b254ebdafac5`, [website job 111746855746](https://github.com/nankeChen75/seatunnel/actions/runs/37304928248/job/111746855746) checked out website commit `52c00582bdaea18d9a1e24798b49278dffbf5f08`. Its `npm run build` invokes `prebuild` → `team:contributors` → `tools/generate-team-pr-contributors.js`, which exits with: ```text GitHub token not found. Set GITHUB_TOKEN/GH_TOKEN or run `gh auth login` first. ``` The website build now needs an authenticated, read-only request for public contributor data (introduced in [website #475](https://github.com/apache/seatunnel-website/pull/475)); the release-line backend workflow never supplies the environment variable. I checked the script: it reads `GITHUB_TOKEN`/`GH_TOKEN`, sends HTTPS GETs to the public contributors endpoint, and does not print the token. Below is an independently applicable CI prerequisite patch against the exact PR head. It uses only the workflow-provided `${{ github.token }}`, restricts the website job to `contents: read`, and exposes it only to the build step. Both existing reusable-workflow callers need `contents: read` so the callee does not request permissions absent from the caller; their existing package permission stays available to the other jobs. No personal token or additional secret is needed. A committer can also land this CI fix on the release line separately so the backport itself remains focused. Save this as `website-token.patch`, then use `git apply --check website-token.patch` and `git apply website-token.patch` on the pinned head: ```diff diff --git a/.github/workflows/backend.yml b/.github/workflows/backend.yml index 7389fe43f8d..1215f667912 100644 --- a/.github/workflows/backend.yml +++ b/.github/workflows/backend.yml @@ -325,6 +325,8 @@ jobs: document: if: needs.changes.outputs.api == 'true' || needs.changes.outputs.docs == 'true' needs: [ changes, sanity-check ] + permissions: + contents: read name: Build website runs-on: ubuntu-latest timeout-minutes: 60 @@ -344,12 +346,17 @@ jobs: - uses: actions/setup-node@v2 with: node-version: 18.20.7 - - name: Run docusaurus build + - name: Install website dependencies run: | cd seatunnel-website npm set strict-ssl false npm install - npm run build + - name: Run docusaurus build + working-directory: seatunnel-website + env: + # The website prebuild fetches public contributor data from GitHub. + GITHUB_TOKEN: ${{ github.token }} + run: npm run build seatunnel-ui: if: needs.changes.outputs.api == 'true' diff --git a/.github/workflows/build_main.yml b/.github/workflows/build_main.yml index f4816940a88..d5110c50a45 100644 --- a/.github/workflows/build_main.yml +++ b/.github/workflows/build_main.yml @@ -27,6 +27,7 @@ on: jobs: call-build-and-test: permissions: + contents: read packages: write name: Run uses: ./.github/workflows/backend.yml diff --git a/.github/workflows/schedule_backend.yml b/.github/workflows/schedule_backend.yml index 9a6aa1cb90a..99bdae6510e 100644 --- a/.github/workflows/schedule_backend.yml +++ b/.github/workflows/schedule_backend.yml @@ -27,6 +27,7 @@ concurrency: jobs: call-build-and-test: permissions: + contents: read packages: write name: Run uses: ./.github/workflows/backend.yml ``` Validation: the three YAML files parsed successfully; `git diff --check` and `git apply --check --cached` passed; scoped `./mvnw spotless:apply -N -nsu -Dmaven.gitcommitid.skip=true` completed. These are syntax/format/applicability checks only. The patched workflow, token permissions and website build still require fresh GitHub CI; no build or functional test was run locally. This patch addresses the missing-token website failure only. It does not clear the rest of Build: the sampled unit job [111746855625](https://github.com/nankeChen75/seatunnel/actions/runs/37304928248/job/111746855625) failed `CoordinatorServiceTest.testMasterNodeActive:82` because an expected `SeaTunnelEngineException` was not thrown, and [connector job 111746856342](https://github.com/nankeChen75/seatunnel/actions/runs/37304928248/job/111746856342) logged `ClassNotFoundException: org.apache.seatunnel.connectors.cdc.base.source.BaseChangeStreamTableSourceFactory` during Iceberg CDC tests. Those failures need separate diagnosis; I am not treating all red jobs as transient. The `2.3.13-release` target and runtime guard are unchanged. I have read-only access, so a contributor/committer needs to apply and run the patch. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
