rustfs

mirror of https://github.com/rustfs/rustfs.git synced 2026-08-02 19:39:17 +00:00

Files

T

Zhengchao An 2b31bda6d1 ci: clear the checkout token in every job that does not push (#5547 )

actions/checkout writes its token into .git/config as an http extraheader,
where it stays for the rest of the job. That matters more here than usual:
pull_request jobs run on self-hosted runners and execute the PR's own build.rs,
proc-macros and tests, any of which can read that file. Test and Lint holds
actions: write on top of that, so its token can cancel runs and delete the
Actions caches the whole pipeline now depends on — it was given
persist-credentials: false when that permission was added, and this extends the
same treatment to the other 45 checkouts.

Two are exempt because the token IS the credential the job needs.
helm-package's publish job pushes to rustfs/helm with it; clearing it would
break chart publishing. nix-flake-update is exempt pending verification: it
passes FLAKE_UPDATE_TOKEN to create-pull-request directly rather than reusing
.git/config, so it very likely does not need persistence, but that is unproven
and a broken weekly bot is not worth the guess. Both carry a
persist-credentials-exempt comment saying which.

scripts/security/check_persist_credentials.sh requires every checkout to either
clear its credentials or carry that comment, so the decision stays visible in
review rather than being an omission nobody notices.

Refs: rustfs/backlog#1598, rustfs/backlog#1602

2026-08-01 11:48:47 +08:00

check_cache_save_if.sh

ci: fit the Rust caches back inside the 10GB quota (#5532 )

2026-08-01 11:06:31 +08:00

check_container_scan_workflow.sh

ci(docker): add release image scan report (#3382 )

2026-06-12 13:11:59 +08:00

check_job_timeouts.sh

ci: bound every job's runtime and stop pasting inputs into shell (#5537 )

2026-08-01 11:25:26 +08:00

check_persist_credentials.sh

ci: clear the checkout token in every job that does not push (#5547 )