The GitHub Actions job "Tests (AMD)" on airflow.git/forbid-underscore-in-team-names has failed. Run started by GitHub user potiuk (triggered by potiuk).
Head commit for run: e1f888f9657edebe4ef114ba5b987d69b7405ab4 / Jarek Potiuk <[email protected]> Forbid consecutive underscores in team names, not every underscore A team secret lives at _<TEAM>___<ID>, so the namespace is only unambiguous while no team name can contain the ___ separator. Forbidding every underscore achieves that but is broader than needed and invalidates ordinary names like team_a. Forbidding two in a row is the smallest rule that makes the separator unspellable, so the split becomes a single partition on the first ___. That closes a cross-team read no guard on the team agnostic fall-through could reach: a caller in team_a asking for the bare id prod___dbconn builds AIRFLOW_CONN__TEAM_A___PROD___DBCONN, byte-identical to what team team_a___prod builds for id dbconn -- and the scoped lookup hits, so the fall-through is never consulted. team_a___prod is no longer a name a team can have. teams sync now validates stored names as well as the ones in the bundle config. It shipped without validation, so an upgrading deployment can already hold a name the guard cannot recognise, and that guard is what keeps one team's namespace out of another's reach. The pattern is defined once in the secrets backend and imported by the CLI, with a test pinning that they agree. It is unanchored and always used with re.fullmatch: re.match against a $-anchored pattern also accepts a trailing newline, and the sync path has no .strip(). Report URL: https://github.com/apache/airflow/actions/runs/30695929042 With regards, GitHub Actions via GitBox --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
