[PR] Publish Develocity Build Scans for the Docker image [polaris]

["donat (via GitHub)" <gi...@apache.org>]

donat opened a new pull request, #5727:
URL: https://github.com/apache/polaris/pull/5727

   Publishes a Develocity Build Scan for the image the `Polaris Docker Image Build` job builds. The Gradle builds already publish Build Scans to develocity.apache.org. With this change the image build does too, showing the duration and cache use of each Dockerfile step, the build log and the packages in the image.
   
   A new `Setup Docker` step runs the Develocity Docker build agent beside the build, using the `setup-docker` action from `gradle/develocity-actions`. The agent captures what reaches BuildKit, so the Dockerfile and the Quarkus image build stay as they are.
   
   The scans go to develocity.apache.org under the `polaris` project, with the `DEVELOCITY_ACCESS_KEY` secret the Gradle builds already use. `ci-pr.yml` passes no secrets to `ci.yml`, so pull request runs build the image as before and publish no scan.
   
   Tested on a mirror of this repository, where the job built the image and published its Build Scan.
   
   Documentation for the action: https://github.com/gradle/develocity-actions#setup-docker-action
   
   The pinned version of the action is on the ASF actions allowlist: https://github.com/apache/infrastructure-actions/pull/1364
   
   ## Checklist
   - [x] 🛡️ Don't disclose security issues! (contact security@apache.org)
   - [x] 🔗 Clearly explained why the changes are needed, or linked related issues
   - [x] 🧪 Added/updated tests with good coverage, or manually tested (and explained how)
   - [ ] 💡 Added comments for complex logic
   - [ ] 🧾 Updated `CHANGELOG.md` (if needed)
   - [ ] 📚 Updated documentation in `site/content/in-dev/unreleased` (if needed)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Publish Develocity Build Scans for the Docker image [polaris]

["dimas-b (via GitHub)" <gi...@apache.org>]

dimas-b commented on PR #5727:
URL: https://github.com/apache/polaris/pull/5727#issuecomment-6114808017

   Thanks for your contribution, @donat !
   
   Polaris uses Quarkus for building the docker image. So we do not have much control over the internals of that process. So I wonder, whether publishing those docker scans is useful for Polaris CI :thinking: 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Publish Develocity Build Scans for the Docker image [polaris]

["Copilot (via GitHub)" <gi...@apache.org>]

Copilot commented on code in PR #5727:
URL: https://github.com/apache/polaris/pull/5727#discussion_r4216614737


##########
.github/workflows/ci.yml:
##########
@@ -222,6 +222,12 @@ jobs:
         uses: ./.github/actions/setup-test-env
       - name: Prepare Gradle build cache
         uses: ./.github/actions/ci-incr-build-cache-prepare
+      - name: Setup Docker
+        uses: gradle/develocity-actions/setup-docker@f852d93dada312948b1ba533226c28e05d756866 # v2.4
+        with:
+          develocity-url: https://develocity.apache.org
+          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} # zizmor: ignore[secrets-outside-env]
+          develocity-project-id: polaris

Review Comment:
   This step will still run even when `secrets.DEVELOCITY_ACCESS_KEY` is unavailable (e.g., PR runs from forks, or workflows that intentionally don’t pass secrets). In those cases the input will resolve to an empty value and the action may fail the job, which conflicts with the PR description (“PR runs ... publish no scan”). Add an `if:` condition to skip the step when the secret isn’t present (or when the scan shouldn’t be published), so the image build continues as before.



##########
.github/workflows/ci.yml:
##########
@@ -222,6 +222,12 @@ jobs:
         uses: ./.github/actions/setup-test-env
       - name: Prepare Gradle build cache
         uses: ./.github/actions/ci-incr-build-cache-prepare
+      - name: Setup Docker
+        uses: gradle/develocity-actions/setup-docker@f852d93dada312948b1ba533226c28e05d756866 # v2.4
+        with:
+          develocity-url: https://develocity.apache.org
+          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} # zizmor: ignore[secrets-outside-env]

Review Comment:
   Passing a secret directly via `with:` and suppressing the linter can increase the chance of accidental exposure via logging/debug output or future action changes. Prefer routing the secret through the step `env:` and referencing that env var from `with:` (or using the action’s recommended secret-handling pattern, if provided) so secret-usage tooling can track it without an ignore.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org