[PR] [improve][ci] Configure SSH access action default and update Upterm [pulsar]

["lhotari (via GitHub)" <gi...@apache.org>]

lhotari opened a new pull request, #26575:
URL: https://github.com/apache/pulsar/pull/26575

   ### Motivation
   
   The SSH access action helps debug GitHub Actions issues in forks by allowing an SSH connection directly to the runner VM. SSH access is disabled for `apache/pulsar` by the existing workflow conditions and disabled by default for private repositories. It is enabled by default for public repositories outside `apache/pulsar` when the calling workflow's conditions are met.
   
   Set `CI_ENABLE_SSH=true` to explicitly enable the action or `CI_ENABLE_SSH=false` to disable it, including in public forks. This override controls the action when invoked; it does not bypass the workflow conditions that exclude `apache/pulsar`. Existing authorized-user SSH key restrictions remain in place.
   
   This change makes these defaults configurable, upgrades Linux Upterm to 0.27.0, and supports noninteractive Homebrew installation on macOS runners.
   
   ### Modifications
   
   - Default the shared SSH action to enabled for public workflow repositories and disabled for private, internal, or unknown visibility.
   - Allow `CI_ENABLE_SSH=true` or `false` as a repository variable or workflow/job/step environment variable. The calling workflows pass repository variables into the action environment; job/step environment settings take precedence. Both start and wait honor the setting; invalid values fail before starting SSH.
   - Upgrade the Linux download to Upterm 0.27.0 and print the installed version.
   - Set `HOMEBREW_NO_ASK=1` for the fully qualified Upterm cask and tmux installations. Fully qualified installation trusts the individual cask, without trusting the entire tap or disabling tap-trust checks.
   
   ### Verifying this change
   
   - [ ] Make sure that the change passes the CI checks.
   - 48 default/override expression cases and 96 start/wait shell guard cases passed.
   - Shell syntax validation passed; actionlint reports the same six pre-existing workflow diagnostics and no new findings.
   - `./gradlew spotlessCheck checkstyleMain checkstyleTest` passed across all modules.
   - Homebrew 6.0.22 noninteractive cask dry run succeeded and trusted only `owenthereal/upterm/upterm`; a full macOS runtime session has not been tested.
   - Linux CI verified that explicit `false` skips both start and wait without creating a session; the default public setting then starts Upterm and waits for a connection after a deliberately failed test step. The temporary verification steps and extended timeout have been removed.
   - Local review found no remaining issues.
   
   
   ### Does this pull request potentially affect one of the following parts:
   
   - [x] Dependencies (add or upgrade a dependency)
   - [ ] The public API
   - [ ] The schema
   - [x] The default values of configurations
   - [ ] The threading model
   - [ ] The binary protocol
   - [ ] The REST endpoints
   - [ ] The admin CLI options
   - [ ] The metrics
   - [ ] Anything that affects deployment
   
   Only CI tooling and the shared action's default behavior change.
   
   
   
   
   
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] [improve][ci] Configure SSH access action default and update Upterm [pulsar]

["nodece (via GitHub)" <gi...@apache.org>]

nodece merged PR #26575:
URL: https://github.com/apache/pulsar/pull/26575


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org