andygrove opened a new issue, #7319:
URL: https://github.com/apache/datafusion-comet/issues/7319
## What is the problem?
`publish_snapshot.yml` has a `dry_run` input that builds and verifies the
jars without deploying them. A dry run skips the "Configure Maven server
credentials" step and uses the `install` goal, but the `Build and install` step
still sets both Nexus secrets in its environment:
```yaml
- name: Build and ${{ inputs.dry_run && 'install' || 'deploy' }}
env:
NEXUS_USER: ${{ secrets.NEXUS_USER }}
NEXUS_PW: ${{ secrets.NEXUS_PW }}
GOAL: ${{ inputs.dry_run && 'install' || 'deploy' }}
```
So a dry run is not credential-free. Maven, its plugins and the build
scripts they run can all read `NEXUS_USER` and `NEXUS_PW`, though a dry run
never needs them.
This is hardening, not a known leak. The secrets are repository Actions
secrets, and anyone with write access can already run a modified workflow that
uses them. The point is that a run advertised as safe to try, and one that
`changes` allows in a fork (`if: github.repository == 'apache/datafusion-comet'
|| inputs.dry_run`), should not carry the publishing credentials at all.
## Proposal
Make a dry run credential-free. The smallest change is to leave the
variables empty when `dry_run` is set:
```yaml
NEXUS_USER: ${{ inputs.dry_run && '' || secrets.NEXUS_USER }}
NEXUS_PW: ${{ inputs.dry_run && '' || secrets.NEXUS_PW }}
```
A stronger form builds and verifies the jars in one job with no secrets,
uploads them, and deploys from a second job that has the secrets and runs only
`deploy` on the verified output. That also keeps the credentials away from the
five-variant `clean` and compile loop in a real run.
Raised in review of #7311, which does not touch this file.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
