The GitHub Actions job "Tests (AMD)" on airflow.git/backport-ed87a1a-v3-3-test has succeeded. Run started by GitHub user potiuk (triggered by potiuk).
Head commit for run: cb8258212b5729f35001ff88e4c91a662ffc63b6 / Jarek Potiuk <[email protected]> [v3-3-test] Refuse a separator-bearing secret id before the team scoped lookup (#70902) * Refuse a separator-bearing secret id before the team scoped lookup The team scoped lookup builds PREFIX + _<TEAM>___ + <ID>, so an id that itself contains ___ makes that string ambiguous. A caller in team_a asking for the bare id prod___dbconn builds AIRFLOW_CONN__TEAM_A___PROD___DBCONN, byte-identical to what team team_a___prod builds for its own id dbconn -- and that lookup hits, so the guard that ran only ahead of the team agnostic fall-through was never reached. Move the check ahead of both lookups and widen it from "spells out a team namespace" to "contains the separator". The narrower form had to reason about which team an id might name, which is unanswerable while a team name may itself contain the separator; the broader form does not, and it no longer depends on stored team names being valid. Costs an id that itself contains ___, which is now unreachable in either scope including for its owning team. That is deliberate and tested: the string such an id builds is one another team's name could build, and nothing in it says which reading was meant. This matches what the provider secrets backends already do. * Condense the collision rationale to one site Both lookups carried the same five-line explanation verbatim. (cherry picked from commit ed87a1a024a55aaa494e6a718cb876f0cbe47b44) Co-authored-by: Jarek Potiuk <[email protected]> Report URL: https://github.com/apache/airflow/actions/runs/30866053428 With regards, GitHub Actions via GitBox --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
