mirror of
https://github.com/scylladb/scylladb.git
synced 2026-05-22 15:52:13 +00:00
85a531819b
Potential fix for https://github.com/scylladb/scylladb/security/code-scanning/169. In general, the fix is to add an explicit `permissions:` block to the workflow (at the root level or per job) so that the `GITHUB_TOKEN` has only the minimal scopes needed. Since this job only reads event data and uses secrets to talk to Jenkins, we can restrict `GITHUB_TOKEN` to read‑only repository contents. The single best fix here is to add a top‑level `permissions:` block right under the `name:` (and before `on:`) in `.github/workflows/trigger-scylla-ci.yaml`, setting `contents: read`. This applies to all jobs in the workflow, including `trigger-jenkins`, and does not alter any existing steps or logic. No additional imports or methods are needed, as this is purely a YAML configuration change for GitHub Actions. Concretely, edit `.github/workflows/trigger-scylla-ci.yaml` to insert: ```yaml permissions: contents: read ``` after line 1. No other lines in the file need to change. Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Closes scylladb/scylladb#27812
67 lines
2.6 KiB
YAML
67 lines
2.6 KiB
YAML
name: Trigger Scylla CI Route
|
|
permissions:
|
|
contents: read
|
|
|
|
on:
|
|
issue_comment:
|
|
types: [created]
|
|
pull_request_target:
|
|
types:
|
|
- unlabeled
|
|
|
|
jobs:
|
|
trigger-jenkins:
|
|
if: (github.event_name == 'issue_comment' && github.event.comment.user.login != 'scylladbbot') || github.event.label.name == 'conflicts'
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Verify Org Membership
|
|
id: verify_author
|
|
env:
|
|
EVENT_NAME: ${{ github.event_name }}
|
|
PR_AUTHOR: ${{ github.event.pull_request.user.login }}
|
|
PR_ASSOCIATION: ${{ github.event.pull_request.author_association }}
|
|
COMMENT_AUTHOR: ${{ github.event.comment.user.login }}
|
|
COMMENT_ASSOCIATION: ${{ github.event.comment.author_association }}
|
|
shell: bash
|
|
run: |
|
|
if [[ "$EVENT_NAME" == "pull_request_target" ]]; then
|
|
AUTHOR="$PR_AUTHOR"
|
|
ASSOCIATION="$PR_ASSOCIATION"
|
|
else
|
|
AUTHOR="$COMMENT_AUTHOR"
|
|
ASSOCIATION="$COMMENT_ASSOCIATION"
|
|
fi
|
|
if [[ "$ASSOCIATION" == "MEMBER" || "$ASSOCIATION" == "OWNER" ]]; then
|
|
echo "member=true" >> $GITHUB_OUTPUT
|
|
else
|
|
echo "::warning::${AUTHOR} is not a member of scylladb (association: ${ASSOCIATION}); skipping CI trigger."
|
|
echo "member=false" >> $GITHUB_OUTPUT
|
|
fi
|
|
|
|
- name: Validate Comment Trigger
|
|
if: github.event_name == 'issue_comment'
|
|
id: verify_comment
|
|
env:
|
|
COMMENT_BODY: ${{ github.event.comment.body }}
|
|
shell: bash
|
|
run: |
|
|
CLEAN_BODY=$(echo "$COMMENT_BODY" | grep -v '^[[:space:]]*>')
|
|
|
|
if echo "$CLEAN_BODY" | grep -qi '@scylladbbot' && echo "$CLEAN_BODY" | grep -qi 'trigger-ci'; then
|
|
echo "trigger=true" >> $GITHUB_OUTPUT
|
|
else
|
|
echo "trigger=false" >> $GITHUB_OUTPUT
|
|
fi
|
|
|
|
- name: Trigger Scylla-CI-Route Jenkins Job
|
|
if: steps.verify_author.outputs.member == 'true' && (github.event_name == 'pull_request_target' || steps.verify_comment.outputs.trigger == 'true')
|
|
env:
|
|
JENKINS_USER: ${{ secrets.JENKINS_USERNAME }}
|
|
JENKINS_API_TOKEN: ${{ secrets.JENKINS_TOKEN }}
|
|
JENKINS_URL: "https://jenkins.scylladb.com"
|
|
PR_NUMBER: "${{ github.event.issue.number || github.event.pull_request.number }}"
|
|
PR_REPO_NAME: "${{ github.event.repository.full_name }}"
|
|
run: |
|
|
curl -X POST "$JENKINS_URL/job/releng/job/Scylla-CI-Route/buildWithParameters?PR_NUMBER=$PR_NUMBER&PR_REPO_NAME=$PR_REPO_NAME" \
|
|
--user "$JENKINS_USER:$JENKINS_API_TOKEN" --fail
|