This is an automated email from the ASF dual-hosted git repository. baibaichen pushed a commit to branch ansi-test-trigger in repository https://gitbox.apache.org/repos/asf/gluten.git
commit 397f1674e0bf3d166fdb2f113de32f71007d5120 Author: Chang chen <[email protected]> AuthorDate: Sun Apr 26 23:06:35 2026 +0800 [GLUTEN-10134][VL] Fix marker pollution, multi-line run_id, and comment spoofing in analyze-only mode - Fix workflow_dispatch analyze-only being misidentified as full mode - Fix paginated jq producing multiple run_id lines (use tail -1) - Restrict marker search to github-actions[bot] comments only - Validate --run input as numeric, take only first match - Add explicit permissions to check-comment job Co-Authored-By: Claude Opus 4 <[email protected]> --- .github/workflows/velox_backend_ansi.yml | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/.github/workflows/velox_backend_ansi.yml b/.github/workflows/velox_backend_ansi.yml index 87345cb3b2..7bd4cdc990 100644 --- a/.github/workflows/velox_backend_ansi.yml +++ b/.github/workflows/velox_backend_ansi.yml @@ -58,6 +58,9 @@ jobs: (contains(github.event.comment.body, '/ansi-test') || contains(github.event.comment.body, '/ansi-analyze'))) runs-on: ubuntu-22.04 + permissions: + contents: read + pull-requests: write outputs: pr_number: ${{ steps.pr-info.outputs.pr_number }} pr_sha: ${{ steps.pr-info.outputs.pr_sha }} @@ -73,10 +76,15 @@ jobs: run: | AI_MODEL=$(echo "$COMMENT" | grep -oP '(?<=--model\s)\S+' || echo "") echo "ai_model=${AI_MODEL}" >> $GITHUB_OUTPUT - RUN_ID=$(echo "$COMMENT" | grep -oP '(?<=--run\s)\d+' || echo "${{ inputs.run_id }}") + RUN_ID=$(echo "$COMMENT" | grep -oPm1 '(?<=--run\s)\d+' || echo "${{ inputs.run_id }}") + if [[ -n "$RUN_ID" ]] && ! [[ "$RUN_ID" =~ ^[0-9]+$ ]]; then + echo "::error::Invalid run_id: ${RUN_ID}"; exit 1 + fi echo "run_id=${RUN_ID}" >> $GITHUB_OUTPUT if echo "$COMMENT" | grep -q '/ansi-analyze'; then echo "mode=analyze-only" >> $GITHUB_OUTPUT + elif [[ "${{ inputs.mode }}" == "analyze-only" ]]; then + echo "mode=analyze-only" >> $GITHUB_OUTPUT else echo "mode=full" >> $GITHUB_OUTPUT fi @@ -561,9 +569,9 @@ jobs: RUN_ID="$EXPLICIT_RUN_ID" else echo "Searching PR #${PR_NUM} comments for latest full-mode run..." - RUN_ID=$(gh api "repos/${REPO}/issues/${PR_NUM}/comments?per_page=100&direction=desc" --paginate \ - --jq '[.[] | select(.body | test("ansi-mode:full ansi-run:[0-9]+"))] | first | .body // empty' \ - | grep -oP 'ansi-run:\K[0-9]+' || echo "") + RUN_ID=$(gh api "repos/${REPO}/issues/${PR_NUM}/comments?per_page=100" --paginate \ + --jq '.[] | select(.user.login == "github-actions[bot]") | select(.body | test("ansi-mode:full ansi-run:[0-9]+")) | .body' \ + | grep -oP 'ansi-run:\K[0-9]+' | tail -1 || echo "") if [[ -n "$RUN_ID" ]]; then echo "Found run_id=${RUN_ID} from PR comment" fi --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
