You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@polaris.apache.org by "snazy (via GitHub)" <gi...@apache.org> on 2024/11/25 08:21:48 UTC
[PR] CI/Build: Add Gradle Build Scans [polaris]
snazy opened a new pull request, #475:
URL: https://github.com/apache/polaris/pull/475
Gradle Build Scans, free of use, collect a lot of information about a Gradle build, including the actual output of failed test. This becomes quite convenient when inspecting test failures in CI and a lot of other information about Gradle builds.
[Example build scan](https://scans.gradle.com/s/jpuykotf4hac6)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CI/Build: Add Gradle Build Scans [polaris]
Posted by "snazy (via GitHub)" <gi...@apache.org>.
snazy commented on PR #475:
URL: https://github.com/apache/polaris/pull/475#issuecomment-3303606664
Closed in favor of #2559
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CI/Build: Add Gradle Build Scans [polaris]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #475:
URL: https://github.com/apache/polaris/pull/475#issuecomment-2562071813
This PR is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CI/Build: Add Gradle Build Scans [polaris]
Posted by "snazy (via GitHub)" <gi...@apache.org>.
snazy commented on PR #475:
URL: https://github.com/apache/polaris/pull/475#issuecomment-2498159320
> * as other projects (like Apache Beam or Pekko) are using ge.apache.org, I wonder why we would be different 😄
That still requires all GH workflow runs to have access to secrets, which is a big concern IMHO.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CI/Build: Add Gradle Build Scans [polaris]
Posted by "jbonofre (via GitHub)" <gi...@apache.org>.
jbonofre commented on PR #475:
URL: https://github.com/apache/polaris/pull/475#issuecomment-2498194029
@snazy yes, that's expected. That's why I don't the security question :) If an user forks Polaris, if he's a Apache committer, he can use his Apache account, else he doesn't push.
Sorry, I failed to see the point 😄
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CI/Build: Add Gradle Build Scans [polaris]
Posted by "jbonofre (via GitHub)" <gi...@apache.org>.
jbonofre commented on PR #475:
URL: https://github.com/apache/polaris/pull/475#issuecomment-2497517062
For context: https://infra.apache.org/gradle.html
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CI/Build: Add Gradle Build Scans [polaris]
Posted by "jbonofre (via GitHub)" <gi...@apache.org>.
jbonofre commented on PR #475:
URL: https://github.com/apache/polaris/pull/475#issuecomment-2498178583
@snazy For GitHub Actions builds in the Apache GitHub organization, an access token is stored in the organizational secret `GE_ACCESS_TOKEN`. For security, GitHub Actions do not pass secrets to runners running workflows triggered from forked repositories.
I don't see the issue here as the `GE_ACCESS_TOKEN` is setup by INFRA.
For local build, users can use their Apache ID.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CI/Build: Add Gradle Build Scans [polaris]
Posted by "jbonofre (via GitHub)" <gi...@apache.org>.
jbonofre commented on PR #475:
URL: https://github.com/apache/polaris/pull/475#issuecomment-2497979919
Two comments:
- we need approval from PPMC and security team to export data in a third party instance
- as other projects (like Apache Beam or Pekko) are using ge.apache.org, I wonder why we would be different 😄
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CI/Build: Add Gradle Build Scans [polaris]
Posted by "snazy (via GitHub)" <gi...@apache.org>.
snazy commented on PR #475:
URL: https://github.com/apache/polaris/pull/475#issuecomment-2498248725
> For PRs, are you proposing to systematically publish build scans ?
Yes, that's basically the whole point - I want to inspect build scans for PRs, not just test results, but more than that.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CI/Build: Add Gradle Build Scans [polaris]
Posted by "jbonofre (via GitHub)" <gi...@apache.org>.
jbonofre commented on PR #475:
URL: https://github.com/apache/polaris/pull/475#issuecomment-2498128204
See https://cwiki.apache.org/confluence/pages/viewpage.action?spaceKey=INFRA&title=Project+Onboarding+Instructions+for+Develocity
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CI/Build: Add Gradle Build Scans [polaris]
Posted by "snazy (via GitHub)" <gi...@apache.org>.
snazy commented on PR #475:
URL: https://github.com/apache/polaris/pull/475#issuecomment-2498233304
TL;DR both scenarios, `pull_request_target` for CI _against_ `apache/polaris` and using branches _in_ the `apache/polaris` repo with `pull_request` are _both_ huge security risks - see [this post](https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CI/Build: Add Gradle Build Scans [polaris]
Posted by "snazy (via GitHub)" <gi...@apache.org>.
snazy commented on PR #475:
URL: https://github.com/apache/polaris/pull/475#issuecomment-2498202482
Yes, you failed the point. See the _warning_ box under the discussion of [`pull_request_target`](https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#pull_request_target) vs the [`pull_request`](https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#pull_request) trigger. Apache Committer or not does _not_ matter here.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CI/Build: Add Gradle Build Scans [polaris]
Posted by "snazy (via GitHub)" <gi...@apache.org>.
snazy commented on PR #475:
URL: https://github.com/apache/polaris/pull/475#issuecomment-2498182517
@jbonofre GH actions run from forks do _NOT_ have any secrets, that's how GH workflows work.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CI/Build: Add Gradle Build Scans [polaris]
Posted by "flyrain (via GitHub)" <gi...@apache.org>.
flyrain commented on PR #475:
URL: https://github.com/apache/polaris/pull/475#issuecomment-2634647471
Hi folk, do you still need this?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CI/Build: Add Gradle Build Scans [polaris]
Posted by "snazy (via GitHub)" <gi...@apache.org>.
snazy commented on PR #475:
URL: https://github.com/apache/polaris/pull/475#issuecomment-2498263020
@jbonofre that uses the insecure `pull_request_target`, right?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CI/Build: Add Gradle Build Scans [polaris]
Posted by "jbonofre (via GitHub)" <gi...@apache.org>.
jbonofre commented on PR #475:
URL: https://github.com/apache/polaris/pull/475#issuecomment-2498244195
My point about Apache Committer is for local build (not related to GH Action).
I think I understand your point about PR, but I was talking about "regular" GH Action build.
For PRs, are you proposing to systematically publish build scans ?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CI/Build: Add Gradle Build Scans [polaris]
Posted by "snazy (via GitHub)" <gi...@apache.org>.
snazy commented on PR #475:
URL: https://github.com/apache/polaris/pull/475#issuecomment-3179845414
Build scans are _very_ useful and _much_ more convenient than downloading some archive, unpacking it, finding the right files, etc.
It's worth tackling this effort.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CI/Build: Add Gradle Build Scans [polaris]
Posted by "snazy (via GitHub)" <gi...@apache.org>.
snazy closed pull request #475: CI/Build: Add Gradle Build Scans
URL: https://github.com/apache/polaris/pull/475
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CI/Build: Add Gradle Build Scans [polaris]
Posted by "jbonofre (via GitHub)" <gi...@apache.org>.
jbonofre commented on PR #475:
URL: https://github.com/apache/polaris/pull/475#issuecomment-2498257512
@snazy so like this one: https://ge.apache.org/s/7hwlge7hwhch4
It's a build on a PR (https://github.com/apache/beam/pull/32400) on Beam (action https://github.com/apache/beam/actions/runs/12012626739).
So it seems to work on Apache Beam.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CI/Build: Add Gradle Build Scans [polaris]
Posted by "jbonofre (via GitHub)" <gi...@apache.org>.
jbonofre commented on PR #475:
URL: https://github.com/apache/polaris/pull/475#issuecomment-2498272579
@snazy I'm checking this.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CI/Build: Add Gradle Build Scans [polaris]
Posted by "snazy (via GitHub)" <gi...@apache.org>.
snazy commented on PR #475:
URL: https://github.com/apache/polaris/pull/475#issuecomment-2497792648
Well, Apache's instance rejects unauthenticated build scans, which is always the case for PR CI runs (no secrets in those GH workflows). So I think it's fine to let CI runs that don't have the access-key secret publish to Gradle's infra, and those that have it publish to Apache's infra.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CI/Build: Add Gradle Build Scans [polaris]
Posted by "jbonofre (via GitHub)" <gi...@apache.org>.
jbonofre commented on PR #475:
URL: https://github.com/apache/polaris/pull/475#issuecomment-2595311773
My apologize, I have been swamped by other stuff. Let me resume work on this. Sorry for the delay 😀
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CI/Build: Add Gradle Build Scans [polaris]
Posted by "adutra (via GitHub)" <gi...@apache.org>.
adutra commented on PR #475:
URL: https://github.com/apache/polaris/pull/475#issuecomment-2497965523
> Well, Apache's instance rejects unauthenticated build scans, which is always the case for PR CI runs (no secrets in those GH workflows). So I think it's fine to let CI runs that don't have the access-key secret publish to Gradle's infra, and those that have it publish to Apache's infra.
Why can't we configure our PR CI runs to authenticate? The section named "GitHub Actions" in [in this page](https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=263426153#ProjectOnboardingInstructionsforDevelocity-GitHubActions) says:
> For GitHub Actions builds in the Apache GitHub organization, an access token is stored in the organizational secret `GE_ACCESS_TOKEN`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CI/Build: Add Gradle Build Scans [polaris]
Posted by "snazy (via GitHub)" <gi...@apache.org>.
snazy commented on PR #475:
URL: https://github.com/apache/polaris/pull/475#issuecomment-2497968405
> Why can't we configure our PR CI runs to authenticate?
Security thing - to _not_ expose secrets in such CI runs.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CI/Build: Add Gradle Build Scans [polaris]
Posted by "jbonofre (via GitHub)" <gi...@apache.org>.
jbonofre commented on PR #475:
URL: https://github.com/apache/polaris/pull/475#issuecomment-2497499074
@snazy what about using ASF Develocity ? It's hosted here: https://ge.apache.org/ and "hosted"/approve by the ASF.
I would prefer to use ASF hosted platform here.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CI/Build: Add Gradle Build Scans [polaris]
Posted by "snazy (via GitHub)" <gi...@apache.org>.
snazy commented on PR #475:
URL: https://github.com/apache/polaris/pull/475#issuecomment-2497660929
Good point, updated the PR.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CI/Build: Add Gradle Build Scans [polaris]
Posted by "snazy (via GitHub)" <gi...@apache.org>.
snazy commented on PR #475:
URL: https://github.com/apache/polaris/pull/475#issuecomment-2595308783
Any updates on this @jbonofre ?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org