Hi, I also think that a whitelist would be a good solution, in terms of security and trust it would be between no restrictions and committers only being able to run jobs. How would we proceed with this? Does it need to be voted on?
On Wed, Jan 8, 2020 at 12:50 AM Mark Liu <[email protected]> wrote: > Thank you Kenn. I'm also asking white-list for Beam jobs in INFRA-19670 > <https://issues.apache.org/jira/browse/INFRA-19670> if possible. > > Here are my experiences of job trigger in > https://github.com/apache/beam/pull/10051 (created by non-committer): > - committer's trigger ("Run XVR_Flink PostCommit") works, and job was > waiting in the queue immediately (job link > <https://builds.apache.org/view/A-D/view/Beam/view/All/job/beam_PostCommit_XVR_Flink_PR/53/> > ). > - there is no triggered job showing in the bottom of the PR page. Guess > something could go wrong in the Github plugin. > - sometimes manual trigger may miss jobs which could be hard to discover. > > Mark > > On Tue, Jan 7, 2020 at 3:08 PM Robert Bradshaw <[email protected]> > wrote: > >> I agree. If this can't be done, perhaps we could have a basic suite of >> smoke tests (at least) run on TravisCI. >> >> On Tue, Jan 7, 2020 at 2:53 PM Kenneth Knowles <[email protected]> wrote: >> >>> This new policy seems pretty unwelcoming. I would like to work with >>> INFRA to see if we can set up a sufficient sandbox that the security >>> concern goes away. Clearly this has been solved many times. >>> >>> Kenn >>> >>> On Tue, Jan 7, 2020 at 2:45 PM Valentyn Tymofieiev <[email protected]> >>> wrote: >>> >>>> jiangkai@ - done. >>>> >>>> I've been reviewing a few PRs, e.g. [1], from contributors who are not >>>> committers. My experience is as follows: >>>> - tests are not triggered by default, but trigger as soon as a >>>> committer leaves any comment on the PR . This happens only once, unless new >>>> commits are added to the PR. >>>> - sometimes committer's comment trigger only a subset of test suites, >>>> which creates an illusion that all test suites are passing while some were >>>> not triggered. >>>> - Some tests suites never trigger within a reasonable timeframe after >>>> "run suite X" command. For example, Run PythonLint precommit didn't trigger >>>> the suite after two requests, but did trigger it an hour later after yet >>>> another "Run PythonLint precommit". >>>> >>>> cc: @Mark Liu <[email protected]> @Alan Myrvold <[email protected]> >>>> >>>> [1] https://github.com/apache/beam/pull/10504 >>>> >>>> >>>> On Tue, Jan 7, 2020 at 1:18 PM Kai Jiang <[email protected]> wrote: >>>> >>>>> Hi Beam Committer, >>>>> >>>>> I appreciate if you could trigger precommit checks for >>>>> https://github.com/apache/beam/pull/9903. >>>>> >>>>> Run Flink ValidatesRunner >>>>> Run Flink Runner Nexmark Tests >>>>> Run SQL Postcommit >>>>> >>>>> Best, >>>>> Kai >>>>> >>>>> On Tue, Jan 7, 2020 at 8:17 AM Ismaël Mejía <[email protected]> wrote: >>>>> >>>>>> Done >>>>>> >>>>>> On Tue, Jan 7, 2020 at 5:09 PM Tomo Suzuki <[email protected]> >>>>>> wrote: >>>>>> >>>>>>> Hi Ismaël and Beam committer, >>>>>>> >>>>>>> I appreciate the help! Would you trigger precommit checks for >>>>>>> https://github.com/apache/beam/pull/10508. I also want the >>>>>>> following checks. >>>>>>> >>>>>>> Run Java PostCommit >>>>>>> Run Java HadoopFormatIO Performance Test >>>>>>> Run BigQueryIO Streaming Performance Test Java >>>>>>> Run Dataflow ValidatesRunner >>>>>>> Run Spark ValidatesRunner >>>>>>> Run SQL Postcommit >>>>>>> >>>>>>> Regards, >>>>>>> Tomo >>>>>>> >>>>>>> On Tue, Jan 7, 2020 at 9:27 AM Ismaël Mejía <[email protected]> >>>>>>> wrote: >>>>>>> >>>>>>>> Until we address this we can maybe use this thread/list to send the >>>>>>>> link for the PR(s) you want to be triggered. and the command if a >>>>>>>> special >>>>>>>> one is needed, so committers can help to manually do it. >>>>>>>> >>>>>>>> On Tue, Jan 7, 2020 at 3:00 PM Ismaël Mejía <[email protected]> >>>>>>>> wrote: >>>>>>>> >>>>>>>>> Thanks for bringing this info Michał. I think the security goal of >>>>>>>>> INFRA makes sense however it adds for committers the additional >>>>>>>>> burden of >>>>>>>>> having to manually trigger the CI. I hoped that the PR will run the >>>>>>>>> basic >>>>>>>>> precommit tests but it does not. >>>>>>>>> We have to (1) discuss a possible workaround or (2) find a way to >>>>>>>>> be notified of PRs that have not run its tests. >>>>>>>>> Any ideas? This looks like a quite critical issue to address. >>>>>>>>> >>>>>>>>> >>>>>>>>> On Tue, Jan 7, 2020 at 10:16 AM Michał Walenia < >>>>>>>>> [email protected]> wrote: >>>>>>>>> >>>>>>>>>> According to Daniel Gruno's comment in >>>>>>>>>> https://issues.apache.org/jira/browse/INFRA-19670 , there was a >>>>>>>>>> change in Jenkins job execution policy - non-committers can't run >>>>>>>>>> Jenkins >>>>>>>>>> workflows now, as it would be a security flaw in terms of arbitrary >>>>>>>>>> code >>>>>>>>>> execution. >>>>>>>>>> Does anyone know about this? When exactly was this changed for >>>>>>>>>> Beam? What are our options for testing our pull requests? >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> On Tue, Jan 7, 2020 at 3:26 AM Kai Jiang <[email protected]> >>>>>>>>>> wrote: >>>>>>>>>> >>>>>>>>>>> According to this comment >>>>>>>>>>> <https://issues.apache.org/jira/browse/INFRA-19626?focusedCommentId=17006030&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-17006030>, >>>>>>>>>>> it might be a Jenkins bug. >>>>>>>>>>> Meanwhile, I opened an infra ticket at >>>>>>>>>>> https://issues.apache.org/jira/browse/INFRA-19670 for Beam. >>>>>>>>>>> >>>>>>>>>>> On Mon, Jan 6, 2020 at 12:01 PM Andrew Pilloud < >>>>>>>>>>> [email protected]> wrote: >>>>>>>>>>> >>>>>>>>>>>> "Run precommits" seems to work sometimes: >>>>>>>>>>>> https://github.com/apache/beam/pull/10455 >>>>>>>>>>>> >>>>>>>>>>>> Has anyone opened a ticket with apache infra? >>>>>>>>>>>> >>>>>>>>>>>> On Mon, Jan 6, 2020 at 4:39 AM Rehman Murad Ali < >>>>>>>>>>>> [email protected]> wrote: >>>>>>>>>>>> >>>>>>>>>>>>> +1: https://github.com/apache/beam/pull/10506 >>>>>>>>>>>>> >>>>>>>>>>>>> any solution yet? >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> *Thanks & Regards* >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> <http://venturedive.com/> >>>>>>>>>>>>> >>>>>>>>>>>>> *Rehman Murad Ali* >>>>>>>>>>>>> Software Engineer >>>>>>>>>>>>> Mobile: +92 3452076766 <+92%20345%202076766> >>>>>>>>>>>>> Skype: rehman.muradali >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> On Sat, Jan 4, 2020 at 6:10 AM Heejong Lee <[email protected]> >>>>>>>>>>>>> wrote: >>>>>>>>>>>>> >>>>>>>>>>>>>> +1: https://github.com/apache/beam/pull/10051 >>>>>>>>>>>>>> >>>>>>>>>>>>>> force-pushing again. retest this please. nothing works :( >>>>>>>>>>>>>> >>>>>>>>>>>>>> On Fri, Jan 3, 2020 at 12:55 AM Michał Walenia < >>>>>>>>>>>>>> [email protected]> wrote: >>>>>>>>>>>>>> >>>>>>>>>>>>>>> Hi, >>>>>>>>>>>>>>> I'm also affected by this - I touched my PRs opened before >>>>>>>>>>>>>>> the holiday break and no jobs were triggered. Do we know what >>>>>>>>>>>>>>> breaks >>>>>>>>>>>>>>> Jenkins/fixes it when stuff like this happens? >>>>>>>>>>>>>>> Happy new year, >>>>>>>>>>>>>>> Michal >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> On Fri, Jan 3, 2020 at 1:42 AM Kai Jiang <[email protected]> >>>>>>>>>>>>>>> wrote: >>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> Thanks Alan for checking this out! I closed PR 9903 and >>>>>>>>>>>>>>>> reopen it in pull/10493 >>>>>>>>>>>>>>>> <https://github.com/apache/beam/pull/10493>. It seems new >>>>>>>>>>>>>>>> PR still did not trigger jenkins jobs. >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>> On Thu, Jan 2, 2020 at 2:55 PM Alan Myrvold < >>>>>>>>>>>>>>>> [email protected]> wrote: >>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>> Oh, the PR 9903 run is quite old; I don't see a recent one >>>>>>>>>>>>>>>>> yet. >>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>> On Thu, Jan 2, 2020 at 2:48 PM Alan Myrvold < >>>>>>>>>>>>>>>>> [email protected]> wrote: >>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>> For PR 10427, I see >>>>>>>>>>>>>>>>>> https://builds.apache.org/job/beam_PreCommit_Java_Phrase/1593/ >>>>>>>>>>>>>>>>>> For PR 9903, I see >>>>>>>>>>>>>>>>>> https://builds.apache.org/job/beam_PostCommit_Java_Nexmark_Flink_PR/22/ >>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>> Maybe the PR status is not being updated when the jobs >>>>>>>>>>>>>>>>>> run? >>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>> On Thu, Jan 2, 2020 at 2:37 PM Kai Jiang < >>>>>>>>>>>>>>>>>> [email protected]> wrote: >>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>> same for https://github.com/apache/beam/pull/9903 as >>>>>>>>>>>>>>>>>>> well >>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>> On Thu, Jan 2, 2020 at 1:40 PM Chamikara Jayalath < >>>>>>>>>>>>>>>>>>> [email protected]> wrote: >>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>>> Seems like Jenkins tests are not being triggered for >>>>>>>>>>>>>>>>>>>> this PR as well: >>>>>>>>>>>>>>>>>>>> https://github.com/apache/beam/pull/10427 >>>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>>> On Fri, Dec 20, 2019 at 2:16 PM Tomo Suzuki < >>>>>>>>>>>>>>>>>>>> [email protected]> wrote: >>>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>>>> Jenkins started working. Thank you for whoever fixed >>>>>>>>>>>>>>>>>>>>> it. >>>>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>>>> On Fri, Dec 20, 2019 at 1:42 PM Boyuan Zhang < >>>>>>>>>>>>>>>>>>>>> [email protected]> wrote: >>>>>>>>>>>>>>>>>>>>> > >>>>>>>>>>>>>>>>>>>>> > Same here. Even the phrase trigger doesn't work. >>>>>>>>>>>>>>>>>>>>> > >>>>>>>>>>>>>>>>>>>>> > On Fri, Dec 20, 2019 at 10:16 AM Luke Cwik < >>>>>>>>>>>>>>>>>>>>> [email protected]> wrote: >>>>>>>>>>>>>>>>>>>>> >> >>>>>>>>>>>>>>>>>>>>> >> I'm also affected by this. >>>>>>>>>>>>>>>>>>>>> >> >>>>>>>>>>>>>>>>>>>>> >> On Fri, Dec 20, 2019 at 10:13 AM Tomo Suzuki < >>>>>>>>>>>>>>>>>>>>> [email protected]> wrote: >>>>>>>>>>>>>>>>>>>>> >>> >>>>>>>>>>>>>>>>>>>>> >>> Hi Beam developers, >>>>>>>>>>>>>>>>>>>>> >>> >>>>>>>>>>>>>>>>>>>>> >>> Does anybody know why my PR does not trigger >>>>>>>>>>>>>>>>>>>>> Jenkins jobs today? >>>>>>>>>>>>>>>>>>>>> >>> https://github.com/apache/beam/pull/10438 >>>>>>>>>>>>>>>>>>>>> >>> >>>>>>>>>>>>>>>>>>>>> >>> -- >>>>>>>>>>>>>>>>>>>>> >>> Regards, >>>>>>>>>>>>>>>>>>>>> >>> Tomo >>>>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>>>> -- >>>>>>>>>>>>>>>>>>>>> Regards, >>>>>>>>>>>>>>>>>>>>> Tomo >>>>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>>>>>>> >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> -- >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> Michał Walenia >>>>>>>>>>>>>>> Polidea <https://www.polidea.com/> | Software Engineer >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> M: +48 791 432 002 <+48791432002> >>>>>>>>>>>>>>> E: [email protected] >>>>>>>>>>>>>>> >>>>>>>>>>>>>>> Unique Tech >>>>>>>>>>>>>>> Check out our projects! <https://www.polidea.com/our-work> >>>>>>>>>>>>>>> >>>>>>>>>>>>>> >>>>>>>>>> >>>>>>>>>> -- >>>>>>>>>> >>>>>>>>>> Michał Walenia >>>>>>>>>> Polidea <https://www.polidea.com/> | Software Engineer >>>>>>>>>> >>>>>>>>>> M: +48 791 432 002 <+48791432002> >>>>>>>>>> E: [email protected] >>>>>>>>>> >>>>>>>>>> Unique Tech >>>>>>>>>> Check out our projects! <https://www.polidea.com/our-work> >>>>>>>>>> >>>>>>>>> >>>>>>> >>>>>>> -- >>>>>>> Regards, >>>>>>> Tomo >>>>>>> >>>>>> -- Michał Walenia Polidea <https://www.polidea.com/> | Software Engineer M: +48 791 432 002 <+48791432002> E: [email protected] Unique Tech Check out our projects! <https://www.polidea.com/our-work>
