Copilot commented on code in PR #12610: URL: https://github.com/apache/gluten/pull/12610#discussion_r3639486909
########## .github/workflows/velox_backend_x86.yml: ########## Review Comment: The workflow downloads and installs `gh`/`jq` binaries via `curl` (including a `curl | tar` pipeline) without verifying integrity (checksum/signature). This is a supply-chain risk in CI. Prefer verifying SHA256 checksums from the upstream release artifacts (or using a trusted package manager with signature verification) and avoid `curl | tar` by downloading to a file first, then verifying, then extracting. ########## .github/workflows/velox_backend_arm.yml: ########## Review Comment: The `case` statement has no default branch; if `uname -m` returns an unexpected value, `ARCH` remains unset and the subsequent URLs become invalid (leading to confusing 404s). Add an explicit default case that prints the unsupported architecture and exits non-zero (and consider enabling strict shell options so unset variables fail fast). ########## .github/workflows/velox_backend_arm.yml: ########## Review Comment: The `gh`/`jq` bootstrap logic is duplicated across multiple workflows/jobs (arm has it twice; x86 has a similar block). This increases maintenance cost when bumping versions or fixing the install logic. Consider extracting it into a reusable composite action (e.g., `.github/actions/install-stash-deps`) or a shared script referenced by the workflows. ########## .github/workflows/velox_backend_x86.yml: ########## Review Comment: The `gh`/`jq` versions are hard-coded inside the install script. To make upgrades safer and less error-prone, define versions once (workflow/job-level `env`, or in the extracted composite action) and reference them in the URLs/paths. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
