ErikBPF commented on issue #7320: URL: https://github.com/apache/datafusion-comet/issues/7320#issuecomment-6505656476
This proposal preserves the boundary requested in the [original review](https://github.com/apache/datafusion-comet/pull/7311#issuecomment-6499777678). No additional scope change is needed. **Evidence** > A build job with `contents: read` and `persist-credentials: false` > > A small deploy job with `contents: write` that downloads the artifact For implementation, keep the reusable caller's permission ceiling sufficient for deployment, but explicitly narrow the build job to `contents: read`. Keep dependency installation, Maven, Sphinx and Mermaid execution in that read-only job. The fresh writer should consume the generated output without running project build commands or scripts from the artifact. **Action:** Verify the effective build-job permissions and non-persisted build checkout credentials, and verify that the deploy job performs only the static-output publication path. Include a disposable copy check preserving Git metadata, `.asf.yaml` and `.nojekyll`. The [current copy step](https://github.com/apache/datafusion-comet/blob/7f73d86fb841f5662f1343cf52b6e6b31eb17dfb/.github/workflows/docs.yaml#L104-L115) restores the latter two after `rsync --delete`, and `docs/build/html` alone does not supply root `.asf.yaml`. Keep the trigger guards and Mermaid checks. The stated caveat is important: isolating the writer does not certify the generated pages as trustworthy. This confirms the proposed scope. It does not mark the current workflow as repaired. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
