shahar1 commented on code in PR #76666:
URL: https://github.com/apache/airflow/pull/76666#discussion_r4500643324
##########
.github/workflows/java-sdk-dependabot-verification-metadata.yml:
##########
@@ -40,70 +61,147 @@
contents: read
concurrency:
- group: java-sdk-refresh-verification-metadata-${{
github.event.inputs.pr_number }}
+ group: java-sdk-refresh-verification-metadata-${{
github.event.pull_request.number || inputs.pr_number }}
cancel-in-progress: true
jobs:
- refresh-verification-metadata:
- name: Refresh Gradle verification-metadata.xml
+ resolve:
+ name: Resolve PR head
+ # The run for the bot's own commit normally finds no diff and pushes
nothing;
+ # any further commit needs approval again.
+ if: >-
+ github.event_name == 'workflow_dispatch' ||
+ github.event.pull_request.user.login == 'dependabot[bot]'
runs-on: ubuntu-slim
permissions:
- contents: write
+ contents: read
pull-requests: read
+ outputs:
+ head_ref: ${{ steps.pr.outputs.head_ref }}
+ head_sha: ${{ steps.pr.outputs.head_sha }}
steps:
- # Resolve the PR's head branch (and guard that it lives in this repo --
- # Dependabot pushes to apache/airflow itself, never a fork).
- - name: Resolve PR head branch
+ # Dependabot pushes to apache/airflow itself, never a fork.
+ - name: Resolve PR head
id: pr
env:
GH_TOKEN: ${{ github.token }}
- PR_NUMBER: ${{ github.event.inputs.pr_number }}
+ PR_NUMBER: ${{ github.event.pull_request.number || inputs.pr_number
}}
run: |
set -euo pipefail
- repo="${{ github.repository }}"
- head_repo=$(gh pr view "$PR_NUMBER" --repo "$repo" --json
headRepositoryOwner \
- --jq '.headRepositoryOwner.login')
- head_ref=$(gh pr view "$PR_NUMBER" --repo "$repo" --json headRefName
--jq '.headRefName')
- if [ "$head_repo" != "${repo%%/*}" ]; then
- echo "PR #$PR_NUMBER head is not in $repo (owner: $head_repo);
refusing to push." >&2
+ # A URL selector would make gh read a PR from another repo, where
isCrossRepository means nothing.
+ [[ "$PR_NUMBER" =~ ^[0-9]+$ ]] || { echo "pr_number must be a
number." >&2; exit 1; }
+ read -r cross_repo head_ref head_sha < <(gh pr view "$PR_NUMBER"
--repo "$GITHUB_REPOSITORY" \
+ --json isCrossRepository,headRefName,headRefOid \
+ --jq '[.isCrossRepository, .headRefName, .headRefOid] | @tsv')
+ if [ "$cross_repo" != "false" ]; then
+ echo "PR #$PR_NUMBER head is not in $GITHUB_REPOSITORY; refusing
to push." >&2
exit 1
fi
echo "head_ref=$head_ref" >> "$GITHUB_OUTPUT"
- - name: Checkout the PR head branch
+ echo "head_sha=$head_sha" >> "$GITHUB_OUTPUT"
+
+ regenerate:
+ name: Regenerate verification-metadata.xml
+ needs: resolve
+ runs-on: ubuntu-latest
+ timeout-minutes: 45
+ # Dependency code runs here, and a dispatch run could otherwise write to
the default branch's cache.
+ cache-mode: none
+ # Runs dependency code with verification off, so it holds no write token
+ # and passes only the generated file onward.
+ permissions:
+ contents: read
+ steps:
+ - name: Checkout the PR head
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #
v7.0.1
with:
- ref: ${{ steps.pr.outputs.head_ref }}
- fetch-depth: 0
+ ref: ${{ needs.resolve.outputs.head_sha }}
+ fetch-depth: 1
persist-credentials: false
- # 11: main build toolchain, 17/21: example toolchains + Gradle runtime.
+ # The last JDK is the default JAVA_HOME and runs Gradle; 11 matches the
default on
+ # the ubuntu-22.04 image Static checks uses, so the same plugin variants
get recorded.
- name: Install JDK toolchains
uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad #
v6.1.0
with:
distribution: temurin
java-version: |
- 11
17
21
+ 11
- name: Regenerate verification-metadata.xml
- working-directory: java-sdk
- # `build` resolves the same configurations the release-verify check
does,
- # so every newly-bumped artifact gets a recorded sha256.
- run: ./gradlew --no-daemon --write-verification-metadata sha256 build
+ run: python3
scripts/ci/prek/regenerate_java_sdk_verification_metadata.py
+ - name: Upload the regenerated file
Review Comment:
False positive
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
