ErikBPF commented on issue #7319:
URL:
https://github.com/apache/datafusion-comet/issues/7319#issuecomment-6505655520
### P2 — Proposed `NEXUS_USER` / `NEXUS_PW` expressions — Do not fall back
to the secret during a dry run
`inputs.dry_run && '' || secrets.NEXUS_USER` returns the configured secret
for both input values. When `dry_run` is true, the `&&` result is the falsy
empty string, so `||` selects the secret. A fork without configured secrets
would conceal this error. The password expression has the same problem.
**Evidence**
> `NEXUS_USER: ${{ inputs.dry_run && '' || secrets.NEXUS_USER }}`
GitHub documents empty-string falsiness in its [expression
reference](https://docs.github.com/en/actions/reference/workflows-and-actions/expressions#literals).
This is an expression error in the proposed repair, not evidence of an
observed credential leak.
**Action:** Remove this fallback pattern and verify dry-run behavior with
nonempty dummy credentials. Neither publishing credential should reach a
dry-run build.
### P2 — Proposal scope — Require a credential-free build and publication
outside its lifecycle
The [original
review](https://github.com/apache/datafusion-comet/pull/7311#issuecomment-6499777678)
requested both credential-free dry runs and separation of real builds from
publishing credentials. Calling the separate jobs a stronger alternative allows
a dry-run-only fix while Maven and its build plugins still receive the
publisher credentials during real runs.
The proposed second job must not invoke the project's `mvn deploy`
lifecycle. Maven [runs the preceding lifecycle phases
too](https://maven.apache.org/guides/introduction/introduction-to-the-lifecycle.html#usual-command-line-calls),
so moving that command would execute build plugins with the credentials again.
The current dry-run upload also contains [only binary
JARs](https://github.com/apache/datafusion-comet/blob/7f73d86fb841f5662f1343cf52b6e6b31eb17dfb/.github/workflows/publish_snapshot.yml#L270-L298),
whereas publication includes the POM and source attachments.
**Evidence**
> A stronger form builds and verifies the jars in one job with no secrets
**Action:** Make the job split required. Build and verify without publishing
credentials in every mode. Have the fresh restricted publisher upload the
checked binary, flattened POM and existing source attachments for all five
current variants, without rerunning the Comet lifecycle or importing executable
build state. Skip that publisher for dry runs. Validate both routing modes with
dummy credentials and verify the complete artifact set and unchanged binary
checksums against a local repository, without Nexus access.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
