The GitHub Actions job "Tests (AMD)" on airflow.git/resolve-team-namespaced-env-secret-only-for-its-team has succeeded. Run started by GitHub user potiuk (triggered by potiuk).
Head commit for run: bc3b9168c498cbbffec2f6845d3a13d5eaa0f23d / Jarek Potiuk <[email protected]> Only resolve a team namespaced environment secret for its own team A team specific Connection or Variable lives in the `_<TEAM_NAME>___<SECRET_ID>` namespace of the environment. An id that already spells such a namespace out therefore reaches that variable through the team agnostic lookup, which is only correct when the namespace is the one the lookup is made for. The check guarding that had two gaps. Its pattern, `_[^_]+___.+`, could not span an underscore in the team name, and team names may contain underscores. And it only applied when no team was in scope, so with a team in scope it did nothing: the team scoped probe only returns on a hit, and a miss fell through to the team agnostic name, which is byte identical to the other team's variable. Recognise a namespaced id without assuming the team name has no underscores, deny it outright when no team is in scope, and otherwise allow it only when it begins with the namespace prefix that the team in scope itself builds. The stored id is deliberately not parsed: a team name may contain underscores, so `_a___b___c` is both team `a` with id `b___c` and team `a___b` with id `c`, and no pattern separates them. Comparing against the prefix the caller builds needs no such reading. Both lookups share the helper, so this covers Connections and Variables. Generated-by: Claude Opus 5 (1M context) following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions Report URL: https://github.com/apache/airflow/actions/runs/30531718594 With regards, GitHub Actions via GitBox --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
