bitflicker64 commented on code in PR #779: URL: https://github.com/apache/hugegraph-toolchain/pull/779#discussion_r4187752206
########## .github/scripts/ci-policy.py: ########## @@ -0,0 +1,443 @@ +#!/usr/bin/env python3 +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +"""Conservative CI selection and GitHub-verified test receipt reuse.""" + +import argparse +import hashlib +import io +import json +import os +from pathlib import Path +import subprocess +import zipfile +from urllib.parse import urlencode + +MODULES = { + "server": ["server", "commons", "struct", "pd", "store", "hstore", "cluster", "docker", "helm", "dependency_license"], + "toolchain": ["client", "loader", "tools", "spark", "hubble", "go"], +} +PREFIXES = { + "server": {"hugegraph-server/": "server", "hugegraph-commons/": "commons", + "hugegraph-struct/": "struct", "hugegraph-pd/": "pd", "hugegraph-store/": "store", + "hugegraph-cluster-test/": "cluster", "docker/": "docker", "helm/": "helm"}, + "toolchain": {"hugegraph-client/": "client", "hugegraph-client-go/": "go", + "hugegraph-loader/": "loader", "hugegraph-tools/": "tools", + "hugegraph-spark-connector/": "spark", "hugegraph-hubble/": "hubble"}, +} +WORKFLOWS = { + "server": {"server-ci.yml": ["server"], "commons-ci.yml": ["commons"], + "pd-store-ci.yml": ["pd", "store", "hstore"], "cluster-test-ci.yml": ["cluster"], + "docker-build-ci.yml": ["docker"], "helm-chart-ci.yml": ["helm"], + "codeql-analysis.yml": [], "riscv64-ci.yml": ["server"], "check-dependencies.yml": ["dependency_license"]}, + "toolchain": {"client-ci.yml": ["client"], "client-go-ci.yml": ["go"], + "loader-ci.yml": ["loader"], "tools-ci.yml": ["tools"], + "spark-connector-ci.yml": ["spark"], "hubble-ci.yml": ["hubble"], + "codeql-analysis.yml": []}, +} +DEPENDENTS = { + "server": {"commons": ["server", "pd", "store", "hstore", "cluster"], + "struct": ["server", "pd", "store", "hstore", "cluster"], + "server": ["cluster"], "pd": ["store", "hstore", "cluster"], + "store": ["hstore", "cluster"], "hstore": ["cluster"]}, + "toolchain": {"client": ["loader", "tools", "spark", "hubble"], "loader": ["hubble"]}, +} + + +def git(*args): + return subprocess.check_output(["git", *args], text=True).strip() + + +def api(path, binary=False): + result = subprocess.run(["gh", "api", "--method", "GET", path], check=True, capture_output=True, timeout=30) + return result.stdout if binary else json.loads(result.stdout) + + +def documentation(path, mode="100644"): + """Only prose and static documentation assets; never source or config.""" + if mode != "100644": + return False + p = Path(path) + prose_names = {"README.md", "README_CN.md", "README_ZH.md", "AGENTS.md"} + module_roots = {prefix.rstrip("/") for mapping in PREFIXES.values() for prefix in mapping} + module_roots.update("hugegraph-server/" + module for module in [ + "hugegraph-api", "hugegraph-core", "hugegraph-dist", "hugegraph-example", + "hugegraph-hbase", "hugegraph-hstore", "hugegraph-rocksdb", "hugegraph-test"]) + if p.name in prose_names and (str(p.parent) == "." or str(p.parent) in module_roots): Review Comment: Minor: `hugegraph-hubble/README.md` is classified as documentation, but the Hubble release package audit checks it. The Hubble assembly packages `README*` from `hugegraph-hubble/` (hubble-dist/assembly/descriptor/assembly.xml:41), and the Release package audit step (`check-hubble-dist.sh`, lines 107 and 120) fails when `README.md` is missing or empty. For a PR that deletes, empties or renames this file, `select()` returns an empty set, `unsafe_documentation()` returns False because the base entry is 100644, and `affected-module-tests` passes with no Hubble run. The file is also excluded from `fingerprint()`, so a receipt can be reused across that change. Remove packaged module READMEs (at least hugegraph-hubble) from the allowlist, or treat a deleted or emptied documentation path as a non-documentation change. ########## .github/workflows/ci.yml: ########## @@ -0,0 +1,281 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +# + +name: Required CI + +on: + pull_request: + push: + branches: [master, 'release-*'] + workflow_dispatch: + +permissions: + contents: read + actions: read + pull-requests: read + security-events: write + +concurrency: + group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}-${{ github.run_attempt == 1 && 'head' || format('rerun-{0}', github.run_id) }} + cancel-in-progress: ${{ github.event_name == 'pull_request' }} + +jobs: + plan: + runs-on: ubuntu-latest + outputs: + server-repository: ${{ steps.baseline.outputs.repository }} + server-commit: ${{ steps.baseline.outputs.commit_id }} + server-ref: ${{ steps.baseline.outputs.fetch_ref }} + hubble-commit: ${{ steps.hubble-baseline.outputs.commit }} + client: ${{ steps.select.outputs.client }} + loader: ${{ steps.select.outputs.loader }} + tools: ${{ steps.select.outputs.tools }} + spark: ${{ steps.select.outputs.spark }} + hubble: ${{ steps.select.outputs.hubble }} + go: ${{ steps.select.outputs.go }} + needsFixture: ${{ steps.select.outputs.needsFixture }} + security: ${{ steps.select.outputs.security }} + steps: + - uses: actions/checkout@v7 + with: + fetch-depth: 0 + persist-credentials: false + - name: Test CI policy and retry guards + run: | + python3 -m unittest discover -s .github/scripts -p 'test_*.py' + python3 .github/actions/setup-hugegraph-server/runtime_test.py + node --test .github/actions/get-hugegraph-commit/resolve.test.cjs hugegraph-client/assembly/travis/checkout-server.test.cjs hugegraph-client/assembly/travis/install-server.test.cjs + - name: Resolve historical Server 1.7 baseline + id: baseline + uses: ./.github/actions/get-hugegraph-commit + with: + repository: apache/hugegraph + ref: refs/tags/1.7.0 + expected-commit: b12425c2032bf0d21a97b8221f42a18055c2982f + - name: Resolve Hubble's existing Server master baseline + id: hubble-baseline + env: + SERVER_REPOSITORY: https://github.com/apache/hugegraph.git + run: | + commit=$(git ls-remote "$SERVER_REPOSITORY" refs/heads/master | cut -f1) + [[ "$commit" =~ ^[0-9a-f]{40}$ ]] + echo "commit=$commit" >> "$GITHUB_OUTPUT" + - name: Record external test inputs + env: + SERVER_REPOSITORY: ${{ steps.baseline.outputs.repository }} + SERVER_COMMIT: ${{ steps.baseline.outputs.commit_id }} + SERVER_REF: ${{ steps.baseline.outputs.fetch_ref }} + HUBBLE_COMMIT: ${{ steps.hubble-baseline.outputs.commit }} + run: | + python3 - <<'PYINPUTS' + import json, os + inputs = { + 'server': {'repository': os.environ['SERVER_REPOSITORY'], 'commit': os.environ['SERVER_COMMIT'], + 'ref': os.environ['SERVER_REF'], 'jdk': '11'}, + 'hubble': {'repository': 'apache/hugegraph', 'commit': os.environ['HUBBLE_COMMIT'], + 'ref': os.environ['HUBBLE_COMMIT'], 'branch': 'master', 'jdk': '17'}, + 'toolchainJDK': '17', 'config': 'release-current-ci-v2' + } + with open('inputs.json', 'w') as stream: + json.dump(inputs, stream, sort_keys=True) + PYINPUTS + - name: Select affected modules and verified successes + id: select + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: >- + python3 .github/scripts/ci-policy.py plan --project toolchain + --event-path "$GITHUB_EVENT_PATH" --repository "$GITHUB_REPOSITORY" + --inputs-json inputs.json --output plan.json + - uses: actions/upload-artifact@v7 + with: + name: ci-plan + path: plan.json + overwrite: true + retention-days: 14 + + fixture: + needs: plan + if: needs.plan.outputs.needsFixture == 'true' + runs-on: ubuntu-latest + outputs: + artifact: ${{ steps.identity.outputs.artifact }} + steps: + - uses: actions/checkout@v7 + with: + persist-credentials: false + - name: Name immutable Server artifact + id: identity + run: echo "artifact=fixture-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_OUTPUT" + - uses: ./.github/actions/setup-java-env + with: + java-version: '11' + distribution: temurin + use-stage: 'true' + - name: Build reusable Server package + uses: ./.github/actions/setup-hugegraph-server + with: + mode: build + artifact-name: ${{ steps.identity.outputs.artifact }} + repository: ${{ needs.plan.outputs.server-repository }} + commit-id: ${{ needs.plan.outputs.server-commit }} + fetch-ref: ${{ needs.plan.outputs.server-ref }} + java-version: '11' + + hubble-fixture: + needs: plan + if: needs.plan.outputs.hubble == 'true' + runs-on: ubuntu-latest + outputs: + artifact: ${{ steps.identity.outputs.artifact }} + steps: + - uses: actions/checkout@v7 + with: + persist-credentials: false + - name: Name immutable Server artifact + id: identity + run: echo "artifact=hubble-fixture-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" >> "$GITHUB_OUTPUT" + - uses: ./.github/actions/setup-java-env + with: + java-version: '17' + distribution: temurin + use-stage: 'true' + - name: Build reusable Server package + uses: ./.github/actions/setup-hugegraph-server + with: + mode: build + artifact-name: ${{ steps.identity.outputs.artifact }} + commit-id: ${{ needs.plan.outputs.hubble-commit }} + fetch-ref: ${{ needs.plan.outputs.hubble-commit }} + java-version: '17' + + client: + needs: [plan, fixture] + if: ${{ needs.plan.outputs.client == 'true' }} + uses: ./.github/workflows/client-ci.yml + with: + artifact-name: ${{ needs.fixture.outputs.artifact }} + server-repository: ${{ needs.plan.outputs.server-repository }} + server-commit: ${{ needs.plan.outputs.server-commit }} + server-ref: ${{ needs.plan.outputs.server-ref }} + secrets: inherit + + loader: + needs: [plan, fixture] + if: ${{ needs.plan.outputs.loader == 'true' }} + uses: ./.github/workflows/loader-ci.yml + with: + artifact-name: ${{ needs.fixture.outputs.artifact }} + server-repository: ${{ needs.plan.outputs.server-repository }} + server-commit: ${{ needs.plan.outputs.server-commit }} + server-ref: ${{ needs.plan.outputs.server-ref }} + secrets: inherit + + tools: + needs: [plan, fixture] + if: ${{ needs.plan.outputs.tools == 'true' }} + uses: ./.github/workflows/tools-ci.yml + with: + artifact-name: ${{ needs.fixture.outputs.artifact }} + server-repository: ${{ needs.plan.outputs.server-repository }} + server-commit: ${{ needs.plan.outputs.server-commit }} + server-ref: ${{ needs.plan.outputs.server-ref }} + secrets: inherit + + spark: + needs: [plan, fixture] + if: ${{ needs.plan.outputs.spark == 'true' }} + uses: ./.github/workflows/spark-connector-ci.yml + with: + artifact-name: ${{ needs.fixture.outputs.artifact }} + server-repository: ${{ needs.plan.outputs.server-repository }} + server-commit: ${{ needs.plan.outputs.server-commit }} + server-ref: ${{ needs.plan.outputs.server-ref }} + secrets: inherit + + hubble: + needs: [plan, fixture, hubble-fixture] + if: ${{ needs.plan.outputs.hubble == 'true' }} + uses: ./.github/workflows/hubble-ci.yml + with: + current-artifact-name: ${{ needs.hubble-fixture.outputs.artifact }} + current-commit: ${{ needs.plan.outputs.hubble-commit }} + artifact-name: ${{ needs.fixture.outputs.artifact }} + server-repository: ${{ needs.plan.outputs.server-repository }} + server-commit: ${{ needs.plan.outputs.server-commit }} + server-ref: ${{ needs.plan.outputs.server-ref }} + secrets: inherit + + go: + needs: [plan, fixture] + if: ${{ needs.plan.outputs.go == 'true' }} + uses: ./.github/workflows/client-go-ci.yml + with: + artifact-name: ${{ needs.fixture.outputs.artifact }} + server-repository: ${{ needs.plan.outputs.server-repository }} + server-commit: ${{ needs.plan.outputs.server-commit }} + server-ref: ${{ needs.plan.outputs.server-ref }} + secrets: inherit + + affected-module-tests: + name: affected-module-tests + needs: [plan, fixture, hubble-fixture, client, loader, tools, spark, hubble, go] + if: ${{ !cancelled() }} + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v7 + with: + persist-credentials: false + - uses: actions/download-artifact@v7 + with: + name: ci-plan + - name: Require every selected module to succeed + env: + RESULTS: ${{ toJSON(needs) }} + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: | + printf '%s' "$RESULTS" > results.json + python3 .github/scripts/ci-policy.py gate --plan plan.json --results results.json --output receipt.json + - name: Publish verified test receipt + uses: actions/upload-artifact@v7 + with: + name: ci-test-receipt + path: receipt.json + overwrite: true + retention-days: 14 + + security: + needs: [plan, affected-module-tests] + if: >- + needs.affected-module-tests.result == 'success' && + (needs.plan.outputs.security == 'true' || + (github.event_name == 'pull_request' && vars.CI_OPTIMIZED_REQUIRED != 'true')) + uses: ./.github/workflows/codeql-analysis.yml + secrets: inherit + + legacy-java-analysis: + name: Analyze (java) + needs: security + if: ${{ !cancelled() && vars.CI_OPTIMIZED_REQUIRED != 'true' }} Review Comment: Important: `Analyze (java)` fails on every documentation-only push to master or release-*. On a push, `security` runs only when `needs.plan.outputs.security == 'true'`. For a push that touches only README.md or docs/, the planner returns `selected=[]` and `security=false` (ci-policy.py:368), so `security` is skipped. This job still runs because of `!cancelled()`, and `test "skipped" = success` fails. While `CI_OPTIMIZED_REQUIRED` is not `true`, the run concludes failure and Rerun CI retries the failed job twice if master has not moved: three red attempts for a README edit. I reproduced the plan values by calling `create_plan` with a push event whose diff is `README.md` and `docs/ci.md`. Limit this job to `github.event_name == 'pull_request'`, or accept `skipped` when the plan did not request security. ########## .github/scripts/ci-policy.py: ########## @@ -0,0 +1,443 @@ +#!/usr/bin/env python3 +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +"""Conservative CI selection and GitHub-verified test receipt reuse.""" + +import argparse +import hashlib +import io +import json +import os +from pathlib import Path +import subprocess +import zipfile +from urllib.parse import urlencode + +MODULES = { + "server": ["server", "commons", "struct", "pd", "store", "hstore", "cluster", "docker", "helm", "dependency_license"], + "toolchain": ["client", "loader", "tools", "spark", "hubble", "go"], +} +PREFIXES = { + "server": {"hugegraph-server/": "server", "hugegraph-commons/": "commons", + "hugegraph-struct/": "struct", "hugegraph-pd/": "pd", "hugegraph-store/": "store", + "hugegraph-cluster-test/": "cluster", "docker/": "docker", "helm/": "helm"}, + "toolchain": {"hugegraph-client/": "client", "hugegraph-client-go/": "go", + "hugegraph-loader/": "loader", "hugegraph-tools/": "tools", + "hugegraph-spark-connector/": "spark", "hugegraph-hubble/": "hubble"}, +} +WORKFLOWS = { + "server": {"server-ci.yml": ["server"], "commons-ci.yml": ["commons"], + "pd-store-ci.yml": ["pd", "store", "hstore"], "cluster-test-ci.yml": ["cluster"], + "docker-build-ci.yml": ["docker"], "helm-chart-ci.yml": ["helm"], + "codeql-analysis.yml": [], "riscv64-ci.yml": ["server"], "check-dependencies.yml": ["dependency_license"]}, + "toolchain": {"client-ci.yml": ["client"], "client-go-ci.yml": ["go"], + "loader-ci.yml": ["loader"], "tools-ci.yml": ["tools"], + "spark-connector-ci.yml": ["spark"], "hubble-ci.yml": ["hubble"], + "codeql-analysis.yml": []}, +} +DEPENDENTS = { + "server": {"commons": ["server", "pd", "store", "hstore", "cluster"], + "struct": ["server", "pd", "store", "hstore", "cluster"], + "server": ["cluster"], "pd": ["store", "hstore", "cluster"], + "store": ["hstore", "cluster"], "hstore": ["cluster"]}, + "toolchain": {"client": ["loader", "tools", "spark", "hubble"], "loader": ["hubble"]}, Review Comment: Important: Go is missing from the dependents of the shared Client server scripts. client-go-ci.yml sets `TRAVIS_DIR: hugegraph-client/assembly/travis`, so Go starts its Server through `hugegraph-client/assembly/travis/install-hugegraph-from-source.sh` and `start-hugegraph-servers.sh` (this PR adds readiness waits there). `select('toolchain', ['hugegraph-client/assembly/travis/start-hugegraph-servers.sh'])` returns client, hubble, loader, spark and tools, without go. A change that breaks the Go server setup passes the gate, and the master push uses the same selection. The old path filters had the same gap, so this is not a regression, but this map is now the only source of truth. Select go for `hugegraph-client/assembly/travis/` paths. ########## .github/workflows/ci.yml: ########## @@ -0,0 +1,281 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +# + +name: Required CI + +on: + pull_request: + push: + branches: [master, 'release-*'] + workflow_dispatch: + +permissions: + contents: read + actions: read + pull-requests: read + security-events: write + +concurrency: + group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}-${{ github.run_attempt == 1 && 'head' || format('rerun-{0}', github.run_id) }} + cancel-in-progress: ${{ github.event_name == 'pull_request' }} + +jobs: + plan: + runs-on: ubuntu-latest + outputs: + server-repository: ${{ steps.baseline.outputs.repository }} + server-commit: ${{ steps.baseline.outputs.commit_id }} + server-ref: ${{ steps.baseline.outputs.fetch_ref }} + hubble-commit: ${{ steps.hubble-baseline.outputs.commit }} + client: ${{ steps.select.outputs.client }} + loader: ${{ steps.select.outputs.loader }} + tools: ${{ steps.select.outputs.tools }} + spark: ${{ steps.select.outputs.spark }} + hubble: ${{ steps.select.outputs.hubble }} + go: ${{ steps.select.outputs.go }} + needsFixture: ${{ steps.select.outputs.needsFixture }} + security: ${{ steps.select.outputs.security }} + steps: + - uses: actions/checkout@v7 + with: + fetch-depth: 0 + persist-credentials: false + - name: Test CI policy and retry guards + run: | + python3 -m unittest discover -s .github/scripts -p 'test_*.py' + python3 .github/actions/setup-hugegraph-server/runtime_test.py + node --test .github/actions/get-hugegraph-commit/resolve.test.cjs hugegraph-client/assembly/travis/checkout-server.test.cjs hugegraph-client/assembly/travis/install-server.test.cjs + - name: Resolve historical Server 1.7 baseline + id: baseline + uses: ./.github/actions/get-hugegraph-commit + with: + repository: apache/hugegraph + ref: refs/tags/1.7.0 + expected-commit: b12425c2032bf0d21a97b8221f42a18055c2982f + - name: Resolve Hubble's existing Server master baseline + id: hubble-baseline + env: + SERVER_REPOSITORY: https://github.com/apache/hugegraph.git + run: | + commit=$(git ls-remote "$SERVER_REPOSITORY" refs/heads/master | cut -f1) + [[ "$commit" =~ ^[0-9a-f]{40}$ ]] + echo "commit=$commit" >> "$GITHUB_OUTPUT" + - name: Record external test inputs + env: + SERVER_REPOSITORY: ${{ steps.baseline.outputs.repository }} + SERVER_COMMIT: ${{ steps.baseline.outputs.commit_id }} + SERVER_REF: ${{ steps.baseline.outputs.fetch_ref }} + HUBBLE_COMMIT: ${{ steps.hubble-baseline.outputs.commit }} + run: | + python3 - <<'PYINPUTS' + import json, os + inputs = { + 'server': {'repository': os.environ['SERVER_REPOSITORY'], 'commit': os.environ['SERVER_COMMIT'], + 'ref': os.environ['SERVER_REF'], 'jdk': '11'}, + 'hubble': {'repository': 'apache/hugegraph', 'commit': os.environ['HUBBLE_COMMIT'], Review Comment: Minor: Result reuse depends on the apache/hugegraph master commit even when Hubble is not selected. `inputs.json` records `hubble.commit` from `git ls-remote ... refs/heads/master`, and `create_plan` hashes all external inputs into `inputFingerprint`. A docs follow-up on a Client-only PR cannot reuse its receipt once Server master moves (8 commits between 2026-10-02 and 2026-10-05). Add the Hubble baseline to the fingerprint only when `hubble` is in `expected`. ########## .github/workflows/spark-connector-ci.yml: ########## @@ -33,29 +25,21 @@ jobs: strategy: fail-fast: false matrix: - JAVA_VERSION: [ '11', '17' ] + JAVA_VERSION: ['17'] Review Comment: Minor: This drops Spark's Java 11 leg (`['11', '17']`). The PR body moves Toolchain checks to Java 17, but with every module now on 17 no Toolchain test runs on Java 11 while the root pom targets 1.8 bytecode. Consider keeping one Java 11 leg on pushes to master, or note in docs/ci.md that Java 11 runtime coverage is dropped. ########## .github/workflows/ci.yml: ########## @@ -0,0 +1,281 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +# + +name: Required CI + +on: + pull_request: + push: + branches: [master, 'release-*'] + workflow_dispatch: + +permissions: + contents: read + actions: read + pull-requests: read + security-events: write Review Comment: Minor: `security-events: write` applies to every job in this workflow, including the reusable module jobs that run PR test code with `secrets: inherit`. Only `security` needs it. Move it to a job-level `permissions` block on `security` (with contents and actions read) and keep the workflow default read-only. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
