villebro commented on code in PR #44250:
URL: https://github.com/apache/superset/pull/44250#discussion_r4053647008
##########
.github/workflows/docker.yml:
##########
@@ -80,23 +75,132 @@ jobs:
# so a regression in supersetbot itself (dropping the py311/py312
# PY_VER pin, or reordering args so our override no longer lands
# last) is caught here too, instead of only surfacing on master.
+ docker_command() {
+ local preset="$1" extra_flags="$2"
+ shift 2
+ # Supersetbot adds its own --cache-to whenever DOCKERHUB_TOKEN is
+ # present. Hide the token from Supersetbot so cache export is
+ # controlled only by docker-build-extra-flags.sh.
+ DOCKERHUB_TOKEN= supersetbot docker \
Review Comment:
You are right that the existing assertion only proves our own helper stays
quiet — the harness was suppressing the very behaviour the production guard
exists to stop, so it could not distinguish the two.
Partially fixed in cf214febd7. I added
`assert_supersetbot_exports_cache_with_token`, which runs the same
release-branch validation command with `DOCKERHUB_TOKEN=dummy` visible to
Supersetbot and asserts the result **does** contain `--cache-to=type=registry`.
That pins the reason the token-hiding at the build step exists: if Supersetbot
ever stops adding the implicit export, the check goes red and tells us the
guard is obsolete rather than leaving us guessing. The blanked-token assertions
are unchanged.
What that still does not do is fail if someone deletes the blanking from
`docker.yml` itself, because the check assembles its own command. The complete
fix is to extract the Supersetbot invocation into a shared
`scripts/docker-build.sh` used by both the build step and the check — the same
move `docker-build-plan.sh` already made for the event/ref decision. I held off
here because it puts the live publish path behind a new indirection in a PR
whose main purpose is retiring the standalone `websocket`/`dockerize` variants.
Happy to do it in this PR if you would rather not split it; otherwise I will
open it as a follow-up.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
