mirror of
https://github.com/rustfs/rustfs.git
synced 2026-08-01 19:12:14 +00:00
Zhengchao An
2b31bda6d1
actions/checkout writes its token into .git/config as an http extraheader, where it stays for the rest of the job. That matters more here than usual: pull_request jobs run on self-hosted runners and execute the PR's own build.rs, proc-macros and tests, any of which can read that file. Test and Lint holds actions: write on top of that, so its token can cancel runs and delete the Actions caches the whole pipeline now depends on — it was given persist-credentials: false when that permission was added, and this extends the same treatment to the other 45 checkouts. Two are exempt because the token IS the credential the job needs. helm-package's publish job pushes to rustfs/helm with it; clearing it would break chart publishing. nix-flake-update is exempt pending verification: it passes FLAKE_UPDATE_TOKEN to create-pull-request directly rather than reusing .git/config, so it very likely does not need persistence, but that is unproven and a broken weekly bot is not worth the guess. Both carry a persist-credentials-exempt comment saying which. scripts/security/check_persist_credentials.sh requires every checkout to either clear its credentials or carry that comment, so the decision stays visible in review rather than being an omission nobody notices. Refs: rustfs/backlog#1598, rustfs/backlog#1602
78 lines
2.9 KiB
YAML
78 lines
2.9 KiB
YAML
# Copyright 2024 RustFS Team
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
name: Update Nix Flake
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
schedule:
|
|
- cron: '0 5 * * 0' # Weekly on Sunday 05:00 UTC (staggered after the midnight ci/build crons)
|
|
|
|
# GITHUB_TOKEN only needs to read the repository here: the branch push and the
|
|
# pull request are both created by update-flake-lock using the
|
|
# FLAKE_UPDATE_TOKEN PAT below, not by this token. Leaving write on it hands a
|
|
# repo-write credential to an unattended weekly job that does not use it.
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
update-flake:
|
|
name: Update flake.lock
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 90
|
|
env:
|
|
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
|
|
# persist-credentials-exempt: update-flake-lock pushes the branch and opens
|
|
# the PR. It passes FLAKE_UPDATE_TOKEN to create-pull-request itself rather
|
|
# than reusing .git/config, but that is unverified — exempt until a
|
|
# workflow_dispatch run confirms it (rustfs/backlog#1602).
|
|
|
|
- name: Install Nix
|
|
uses: DeterminateSystems/determinate-nix-action@629b284231c2a82554b724e357e47fc6020833c8 # v3
|
|
|
|
- name: Cache Nix
|
|
uses: DeterminateSystems/flakehub-cache-action@1f9a51a2959d3e26c7838c6f3bf9f48acae525ea # v3.20.0
|
|
|
|
- name: Check Nix flake inputs
|
|
uses: DeterminateSystems/flake-checker-action@3164002371bc90729c68af0e24d5aacf20d7c9f6 # v12
|
|
|
|
- name: Update flake.lock
|
|
id: update
|
|
uses: DeterminateSystems/update-flake-lock@fd9359ac79d0e912f1b4b947a48470b3e2799b56 # main
|
|
with:
|
|
git-author-name: houseme
|
|
git-author-email: housemecn@gmail.com
|
|
git-committer-name: houseme
|
|
git-committer-email: housemecn@gmail.com
|
|
pr-title: "chore(deps): update flake.lock"
|
|
pr-labels: |
|
|
dependencies
|
|
nix
|
|
automated
|
|
commit-msg: "chore(deps): update flake.lock"
|
|
pr-reviewers: overtrue, majinghe
|
|
token: ${{ secrets.FLAKE_UPDATE_TOKEN }}
|
|
|
|
- name: Log PR details
|
|
if: steps.update.outputs.pull-request-number
|
|
run: |
|
|
echo "Pull Request created: ${{ steps.update.outputs.pull-request-number }}"
|