The GitHub Actions job "Tests (AMD)" on airflow.git/scope-yandex-lockbox-lookups-to-their-team has failed. Run started by GitHub user potiuk (triggered by potiuk).
Head commit for run: 62d3c2657d5cc8b561648ec96cf4258a78e04668 / Jarek Potiuk <[email protected]> Refuse the team agnostic fall-through for a team scoped Lockbox secret name The team scoped lookup is tried first and then, on a miss, the lookup falls through to the team agnostic name. A guard was meant to stop a caller naming another team's secret, but its first condition is `team_name is None`, so it does nothing whenever a team scope is supplied -- exactly when it matters. A caller authorised for one team could therefore supply an id that spells out another team's namespace and resolve that team's secret. Refuse the fall-through instead. The team scoped lookup still runs first and is safe by construction, since it can only ever build the caller's own namespace. After it misses, an id that spells out any team namespace is refused rather than resolved through the team agnostic name. The id is never parsed to work out which team it names, because it cannot be: a team name may itself contain the separator, so nothing distinguishes one team's namespace from another whose name extends it. Comparing the id against the prefix the caller's own team builds looks equivalent and is not -- a caller in team `a` matches `a--b`'s namespace on the prefix and would read its secrets. Generated-by: Claude Opus 5 (1M context) following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions Report URL: https://github.com/apache/airflow/actions/runs/30671136266 With regards, GitHub Actions via GitBox --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
