mirror of
https://github.com/rustfs/rustfs.git
synced 2026-08-06 21:33:14 +00:00
Zhengchao An
2b31bda6d1
actions/checkout writes its token into .git/config as an http extraheader, where it stays for the rest of the job. That matters more here than usual: pull_request jobs run on self-hosted runners and execute the PR's own build.rs, proc-macros and tests, any of which can read that file. Test and Lint holds actions: write on top of that, so its token can cancel runs and delete the Actions caches the whole pipeline now depends on — it was given persist-credentials: false when that permission was added, and this extends the same treatment to the other 45 checkouts. Two are exempt because the token IS the credential the job needs. helm-package's publish job pushes to rustfs/helm with it; clearing it would break chart publishing. nix-flake-update is exempt pending verification: it passes FLAKE_UPDATE_TOKEN to create-pull-request directly rather than reusing .git/config, so it very likely does not need persistence, but that is unproven and a broken weekly bot is not worth the guess. Both carry a persist-credentials-exempt comment saying which. scripts/security/check_persist_credentials.sh requires every checkout to either clear its credentials or carry that comment, so the decision stays visible in review rather than being an omission nobody notices. Refs: rustfs/backlog#1598, rustfs/backlog#1602
72 lines
2.6 KiB
YAML
72 lines
2.6 KiB
YAML
# Copyright 2024 RustFS Team
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
# Manual drill for the scheduled-failure alerting path (backlog#1149 ci-8).
|
|
#
|
|
# Forces a job failure and then runs .github/actions/schedule-failure-issue
|
|
# through the exact `needs` + `always() && contains(needs.*.result,
|
|
# 'failure')` wiring used by the real consumers (e2e-s3tests, mint, fuzz,
|
|
# performance-ab). Dispatch it twice to verify both the issue-creation and
|
|
# the dedupe-comment paths, then close the resulting
|
|
# "[scheduled-failure] Schedule Failure Alert Drill" issue.
|
|
#
|
|
# The run itself is expected to end red (the forced failure); only the
|
|
# alert-on-failure job result matters.
|
|
|
|
# DISABLED. This workflow is switched off in the repository's Actions settings
|
|
# (state: disabled_manually) and does not run on any trigger, including its cron
|
|
# and workflow_dispatch. That state lives in GitHub's UI and is invisible when
|
|
# reading this file, which has already misled at least one audit — hence this
|
|
# banner. Re-enabling is a UI action; anyone doing so should first check that the
|
|
# workflow still matches the current CI layout. See rustfs/backlog#1603.
|
|
#
|
|
name: Schedule Failure Alert Drill
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
forced-failure:
|
|
name: Forced failure
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
steps:
|
|
- name: Fail on purpose
|
|
run: |
|
|
echo "Deliberate failure so alert-on-failure exercises the real consumer wiring."
|
|
exit 1
|
|
|
|
alert-on-failure:
|
|
name: Alert on scheduled failure
|
|
needs: [forced-failure]
|
|
# Mirrors the consumer wiring, minus the schedule-event guard (this
|
|
# workflow is dispatch-only by design).
|
|
if: always() && contains(needs.*.result, 'failure')
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
permissions:
|
|
contents: read
|
|
issues: write
|
|
steps:
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
|
|
with:
|
|
persist-credentials: false
|
|
- name: Open or update failure-tracking issue
|
|
uses: ./.github/actions/schedule-failure-issue
|
|
with:
|
|
github-token: ${{ secrets.GITHUB_TOKEN }}
|