github-advanced-security[bot] commented on code in PR #5843:
URL: https://github.com/apache/datafusion-comet/pull/5843#discussion_r3982165564
##########
.github/workflows/ci.yml:
##########
@@ -367,3 +403,56 @@
spark-short: '4.1'
spark-full: '4.1.3'
java: 17
+
+ # ---------------------------------------------------------------------------
+ # required_checks: the single context listed in `required_status_checks` for
+ # `main` in `.asf.yaml`, and therefore the only thing the merge queue waits
+ # on.
+ #
+ # None of the jobs above can be required directly, because the name a caller
+ # of a reusable workflow publishes depends on whether it ran:
+ #
+ # skipped by `if:` one check run named exactly `PR Build (Linux)`
+ # actually ran only `PR Build (Linux) / Spark 4.1, JDK 17 [exec]`,
+ # ... and no bare `PR Build (Linux)` at all
+ #
+ # So requiring the bare name would block every code change, and requiring a
+ # nested name would block every docs-only change. Both hang rather than fail,
+ # and a required context that never reports also locks `.asf.yaml` itself,
+ # which then needs an INFRA ticket to unwedge. Aggregating into one flat job,
+ # whose name is published on every event, avoids the whole class of problem.
+ #
+ # `if: always()` is what makes this work: without it the job inherits the
+ # default `success()` and is itself skipped the moment any dependency fails.
+ # ---------------------------------------------------------------------------
+ required_checks:
+ name: Required Checks
+ if: always()
+ needs:
+ - preflight
+ - changes
+ - pr_build_linux
+ - pr_build_macos
+ - pr_benchmark_check
+ - spark_3_4
+ - spark_3_5
+ - spark_4_0
+ - spark_4_1
+ - iceberg_1_8
+ - iceberg_1_9
+ - iceberg_1_10
+ - iceberg_1_11
+ runs-on: ubuntu-slim
+ steps:
+ - name: Summarize upstream results
+ env:
+ NEEDS: ${{ toJSON(needs) }}
+ run: echo "$NEEDS"
+
+ # `skipped` is a pass: it means the change did not touch anything that
+ # job covers. Only `failure` and `cancelled` block the merge.
+ - name: Fail if any upstream job failed or was cancelled
+ if: contains(needs.*.result, 'failure') || contains(needs.*.result,
'cancelled')
+ run: |
+ echo "::error::One or more upstream jobs did not succeed. See the
results above."
+ exit 1
Review Comment:
## CodeQL / Workflow does not contain permissions
Actions job or workflow does not limit the permissions of the GITHUB_TOKEN.
Consider setting an explicit permissions block, using the following as a
minimal starting point: {{}}
[Show more
details](https://github.com/apache/datafusion-comet/security/code-scanning/147)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
