Copilot commented on code in PR #308: URL: https://github.com/apache/calcite-avatica/pull/308#discussion_r3225087643
########## .github/workflows/build-1.28.0-docker-images.yml: ########## @@ -0,0 +1,81 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to you under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +name: Build Docker Hub Images + +on: [push, pull_request] + Review Comment: This workflow triggers on every push and pull_request, but it also logs into Docker Hub and sets `push: true`. On PRs (especially from forks) secrets won’t be available and the job will fail; on branch pushes it can also overwrite the `1.28.0` image tag with non-release content. Restrict the workflow to release tag pushes (as in `.github/workflows/build-docker-hub-images.yml`) and/or gate login/push with an `if` so PR builds don’t push. ########## .github/workflows/build-1.28.0-docker-images.yml: ########## @@ -0,0 +1,81 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to you under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +name: Build Docker Hub Images + +on: [push, pull_request] + +jobs: + build-avatica-image: + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v4 + - name: Generate Docker image tags + id: meta + uses: docker/metadata-action@v6 + with: + images: ${{ github.repository }} + flavor: | + latest=false + tags: | + type=raw,enable=true,priority=200,prefix=,suffix=,value=1.28.0 + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v4 + - name: Log in to Docker Hub + uses: docker/login-action@v4 + with: + username: ${{ secrets.DOCKERHUB_USER }} + password: ${{ secrets.DOCKERHUB_TOKEN }} + - name: Build and tag Docker image + uses: docker/build-push-action@v7 + with: + build-args: | + AVATICA_VERSION=1.28.0 + context: docker/src/main/dockerhub + push: true + tags: ${{ steps.meta.outputs.tags }} Review Comment: `push: true` will publish images for any run of this workflow. If this is meant to be runnable from PRs/branches for validation, make `push` conditional (or false) and only enable it for trusted events (e.g., tag push or manual dispatch) to avoid accidental publication/overwrites. ########## .github/workflows/build-1.28.0-docker-images.yml: ########## @@ -0,0 +1,81 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to you under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +name: Build Docker Hub Images Review Comment: The workflow name is identical to the existing `build-docker-hub-images.yml` workflow (`name: Build Docker Hub Images`). In the GitHub Actions UI this will be ambiguous; consider including the version (e.g., "Build Docker Hub Images (1.28.0)") or otherwise differentiating it. ########## .github/workflows/build-1.28.0-docker-images.yml: ########## @@ -0,0 +1,81 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to you under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +name: Build Docker Hub Images + +on: [push, pull_request] + +jobs: + build-avatica-image: + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v4 + - name: Generate Docker image tags + id: meta + uses: docker/metadata-action@v6 + with: + images: ${{ github.repository }} + flavor: | + latest=false + tags: | + type=raw,enable=true,priority=200,prefix=,suffix=,value=1.28.0 Review Comment: `1.28.0` is hardcoded both in the generated Docker tags and in `AVATICA_VERSION`. If this workflow is ever run from a commit that isn’t exactly the 1.28.0 release/tag, it can publish images whose contents don’t match the tag. Prefer deriving the version from the git ref (tag name) or otherwise asserting the ref/version match before pushing. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
