You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@gluten.apache.org by ch...@apache.org on 2026/04/26 15:30:24 UTC
(gluten) 02/04: [GLUTEN-10134][VL] Fix marker pollution, multi-line run_id, and comment spoofing in analyze-only mode
This is an automated email from the ASF dual-hosted git repository.
baibaichen pushed a commit to branch ansi-test-trigger
in repository https://gitbox.apache.org/repos/asf/gluten.git
commit 397f1674e0bf3d166fdb2f113de32f71007d5120
Author: Chang chen <ch...@apache.org>
AuthorDate: Sun Apr 26 23:06:35 2026 +0800
[GLUTEN-10134][VL] Fix marker pollution, multi-line run_id, and comment spoofing in analyze-only mode
- Fix workflow_dispatch analyze-only being misidentified as full mode
- Fix paginated jq producing multiple run_id lines (use tail -1)
- Restrict marker search to github-actions[bot] comments only
- Validate --run input as numeric, take only first match
- Add explicit permissions to check-comment job
Co-Authored-By: Claude Opus 4 <no...@anthropic.com>
---
.github/workflows/velox_backend_ansi.yml | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/.github/workflows/velox_backend_ansi.yml b/.github/workflows/velox_backend_ansi.yml
index 87345cb3b2..7bd4cdc990 100644
--- a/.github/workflows/velox_backend_ansi.yml
+++ b/.github/workflows/velox_backend_ansi.yml
@@ -58,6 +58,9 @@ jobs:
(contains(github.event.comment.body, '/ansi-test') ||
contains(github.event.comment.body, '/ansi-analyze')))
runs-on: ubuntu-22.04
+ permissions:
+ contents: read
+ pull-requests: write
outputs:
pr_number: ${{ steps.pr-info.outputs.pr_number }}
pr_sha: ${{ steps.pr-info.outputs.pr_sha }}
@@ -73,10 +76,15 @@ jobs:
run: |
AI_MODEL=$(echo "$COMMENT" | grep -oP '(?<=--model\s)\S+' || echo "")
echo "ai_model=${AI_MODEL}" >> $GITHUB_OUTPUT
- RUN_ID=$(echo "$COMMENT" | grep -oP '(?<=--run\s)\d+' || echo "${{ inputs.run_id }}")
+ RUN_ID=$(echo "$COMMENT" | grep -oPm1 '(?<=--run\s)\d+' || echo "${{ inputs.run_id }}")
+ if [[ -n "$RUN_ID" ]] && ! [[ "$RUN_ID" =~ ^[0-9]+$ ]]; then
+ echo "::error::Invalid run_id: ${RUN_ID}"; exit 1
+ fi
echo "run_id=${RUN_ID}" >> $GITHUB_OUTPUT
if echo "$COMMENT" | grep -q '/ansi-analyze'; then
echo "mode=analyze-only" >> $GITHUB_OUTPUT
+ elif [[ "${{ inputs.mode }}" == "analyze-only" ]]; then
+ echo "mode=analyze-only" >> $GITHUB_OUTPUT
else
echo "mode=full" >> $GITHUB_OUTPUT
fi
@@ -561,9 +569,9 @@ jobs:
RUN_ID="$EXPLICIT_RUN_ID"
else
echo "Searching PR #${PR_NUM} comments for latest full-mode run..."
- RUN_ID=$(gh api "repos/${REPO}/issues/${PR_NUM}/comments?per_page=100&direction=desc" --paginate \
- --jq '[.[] | select(.body | test("ansi-mode:full ansi-run:[0-9]+"))] | first | .body // empty' \
- | grep -oP 'ansi-run:\K[0-9]+' || echo "")
+ RUN_ID=$(gh api "repos/${REPO}/issues/${PR_NUM}/comments?per_page=100" --paginate \
+ --jq '.[] | select(.user.login == "github-actions[bot]") | select(.body | test("ansi-mode:full ansi-run:[0-9]+")) | .body' \
+ | grep -oP 'ansi-run:\K[0-9]+' | tail -1 || echo "")
if [[ -n "$RUN_ID" ]]; then
echo "Found run_id=${RUN_ID} from PR comment"
fi
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@gluten.apache.org
For additional commands, e-mail: commits-help@gluten.apache.org