You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by GitBox <gi...@apache.org> on 2020/09/30 20:36:40 UTC
[GitHub] [airflow] turbaszek opened a new pull request #11211: Add Github Code Scanning
turbaszek opened a new pull request #11211:
URL: https://github.com/apache/airflow/pull/11211
Github just released Github Code Scanning:
https://github.blog/2020-09-30-code-scanning-is-now-available/
<!--
Thank you for contributing! Please make sure that your code changes
are covered with tests. And in case of new features or big changes
remember to adjust the documentation.
Feel free to ping committers for the review!
In case of existing issue, reference it using one of the following:
closes: #ISSUE
related: #ISSUE
How to write a good git commit message:
http://chris.beams.io/posts/git-commit/
-->
---
**^ Add meaningful description above**
Read the **[Pull Request Guidelines](https://github.com/apache/airflow/blob/master/CONTRIBUTING.rst#pull-request-guidelines)** for more information.
In case of fundamental code change, Airflow Improvement Proposal ([AIP](https://cwiki.apache.org/confluence/display/AIRFLOW/Airflow+Improvements+Proposals)) is needed.
In case of a new dependency, check compliance with the [ASF 3rd Party License Policy](https://www.apache.org/legal/resolved.html#category-x).
In case of backwards incompatible changes please leave a note in [UPDATING.md](https://github.com/apache/airflow/blob/master/UPDATING.md).
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] kaxil commented on pull request #11211: Add Github Code Scanning
Posted by GitBox <gi...@apache.org>.
kaxil commented on pull request #11211:
URL: https://github.com/apache/airflow/pull/11211#issuecomment-703089834
> https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning
Just read that, yes that now makes sense, let's keep the `schedule`
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] potiuk commented on a change in pull request #11211: Add Github Code Scanning
Posted by GitBox <gi...@apache.org>.
potiuk commented on a change in pull request #11211:
URL: https://github.com/apache/airflow/pull/11211#discussion_r498191250
##########
File path: .github/workflows/codeql-analysis.yml
##########
@@ -0,0 +1,66 @@
+name: "CodeQL"
+
+on:
+ push:
+ branches: [master]
+ pull_request:
+ # The branches below must be a subset of the branches above
+ branches: [master]
+ schedule:
+ - cron: '0 17 * * 3'
Review comment:
I think it will just be overwhelming and counter-productive to get those reports for all commits, but Let's see :)
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] potiuk edited a comment on pull request #11211: Add Github Code Scanning
Posted by GitBox <gi...@apache.org>.
potiuk edited a comment on pull request #11211:
URL: https://github.com/apache/airflow/pull/11211#issuecomment-703166483
Should we also make it part of the regular code scans for v1-10* branches ? I think for now it is more important than the master one. There is a bit of problem with that one though even if we cherry-pick that one.
The push/pull will work if we cherry-pick but the full scanning on schedule works only in the master branch.
We could do two things:
1) cherry-pick that one to start push/pr scans
2) add another schedule-only step to check out the v1-10-test/v1-10-stable branch and run full scan for those branches (or maybe v1-10-test will be enough).
WDYT @turbaszek @kaxil @ashb?
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] potiuk commented on a change in pull request #11211: Add Github Code Scanning
Posted by GitBox <gi...@apache.org>.
potiuk commented on a change in pull request #11211:
URL: https://github.com/apache/airflow/pull/11211#discussion_r498184364
##########
File path: .github/workflows/codeql-analysis.yml
##########
@@ -0,0 +1,66 @@
+name: "CodeQL"
+
+on:
+ push:
+ branches: [master]
+ pull_request:
+ # The branches below must be a subset of the branches above
+ branches: [master]
+ schedule:
+ - cron: '0 17 * * 3'
Review comment:
But I think this was deliberate. It's better to check in on schedule rather than per-commit because the vulnerabilities are really appearing by someone adding new stuff but they are triggered by CVE being reported. I think weekly schedule for those is pretty good cadence.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] turbaszek merged pull request #11211: Add Github Code Scanning
Posted by GitBox <gi...@apache.org>.
turbaszek merged pull request #11211:
URL: https://github.com/apache/airflow/pull/11211
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] potiuk commented on pull request #11211: Add Github Code Scanning
Posted by GitBox <gi...@apache.org>.
potiuk commented on pull request #11211:
URL: https://github.com/apache/airflow/pull/11211#issuecomment-703166483
Should we also make it part of the regular code scans for v1-10* branches ? I think for now it is more important than the master one. There is a bit of problem with that one though even if we cherry-pick that one.
The push/pull will work if we cherry-pick but the schedule scanning on schedule works only in the master branch.
We could do two things:
1) cherry-pick that one to start push/pr scans
2) add another schedule-only step to check out the v1-10-test/v1-10-stable branch and run full scan for those branches (or maybe v1-10-test will be enough).
WDYT @turbaszek @kaxil @ashb?
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] potiuk commented on pull request #11211: Add Github Code Scanning
Posted by GitBox <gi...@apache.org>.
potiuk commented on pull request #11211:
URL: https://github.com/apache/airflow/pull/11211#issuecomment-703085177
One thing to check - I just realised why the schedule one is still needed alongside push @kaxil @turbaszek
You can read more About it here https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning
The push/pr only scans the changed code(for new vulnerabilities), not the whole of it. The scheduled builds scans all of the code for any new vulnerabilities that were reported since the last full sscheduled scan. So we have to keep both.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] potiuk commented on a change in pull request #11211: Add Github Code Scanning
Posted by GitBox <gi...@apache.org>.
potiuk commented on a change in pull request #11211:
URL: https://github.com/apache/airflow/pull/11211#discussion_r498223576
##########
File path: .github/workflows/codeql-analysis.yml
##########
@@ -0,0 +1,66 @@
+name: "CodeQL"
+
+on:
+ push:
+ branches: [master]
+ pull_request:
+ # The branches below must be a subset of the branches above
+ branches: [master]
+ schedule:
+ - cron: '0 17 * * 3'
Review comment:
Yeah. I missed that when commenting on the comment. No strong opinion either, We need to see how the report looks like etc. I am ok with experimenting :)
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] kaxil commented on a change in pull request #11211: Add Github Code Scanning
Posted by GitBox <gi...@apache.org>.
kaxil commented on a change in pull request #11211:
URL: https://github.com/apache/airflow/pull/11211#discussion_r498188318
##########
File path: .github/workflows/codeql-analysis.yml
##########
@@ -0,0 +1,66 @@
+name: "CodeQL"
+
+on:
+ push:
+ branches: [master]
+ pull_request:
+ # The branches below must be a subset of the branches above
+ branches: [master]
+ schedule:
+ - cron: '0 17 * * 3'
Review comment:
We will already have a higher cadence of commit though, so if anything we would catch it before that schedule
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] kaxil edited a comment on pull request #11211: Add Github Code Scanning
Posted by GitBox <gi...@apache.org>.
kaxil edited a comment on pull request #11211:
URL: https://github.com/apache/airflow/pull/11211#issuecomment-703089834
> https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning
Just read that, yes that now makes sense, let's keep the `schedule`, sorry @turbaszek
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] kaxil commented on a change in pull request #11211: Add Github Code Scanning
Posted by GitBox <gi...@apache.org>.
kaxil commented on a change in pull request #11211:
URL: https://github.com/apache/airflow/pull/11211#discussion_r498168087
##########
File path: .github/workflows/codeql-analysis.yml
##########
@@ -0,0 +1,66 @@
+name: "CodeQL"
+
+on:
+ push:
+ branches: [master]
+ pull_request:
+ # The branches below must be a subset of the branches above
+ branches: [master]
+ schedule:
+ - cron: '0 17 * * 3'
Review comment:
```suggestion
```
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] potiuk edited a comment on pull request #11211: Add Github Code Scanning
Posted by GitBox <gi...@apache.org>.
potiuk edited a comment on pull request #11211:
URL: https://github.com/apache/airflow/pull/11211#issuecomment-703166483
Should we also make it part of the regular code scans for v1-10* branches ? I think for now it is more important than the master one. There is a bit of problem with that one though even if we cherry-pick that one.
The push/pull will work if we cherry-pick but the full scanning on schedule works only in the master branch.
We could do two things:
1) cherry-pick that one to start push/pr scans
2) add another schedule-only step to check out the v1-10-test/v1-10-stable branch and run full scan for those branches (or maybe v1-10-test will be enough). - we would have to add it in master to make it works.
WDYT @turbaszek @kaxil @ashb?
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] turbaszek commented on pull request #11211: Add Github Code Scanning
Posted by GitBox <gi...@apache.org>.
turbaszek commented on pull request #11211:
URL: https://github.com/apache/airflow/pull/11211#issuecomment-702833979
I will update it over the weekend
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] potiuk commented on a change in pull request #11211: Add Github Code Scanning
Posted by GitBox <gi...@apache.org>.
potiuk commented on a change in pull request #11211:
URL: https://github.com/apache/airflow/pull/11211#discussion_r498184364
##########
File path: .github/workflows/codeql-analysis.yml
##########
@@ -0,0 +1,66 @@
+name: "CodeQL"
+
+on:
+ push:
+ branches: [master]
+ pull_request:
+ # The branches below must be a subset of the branches above
+ branches: [master]
+ schedule:
+ - cron: '0 17 * * 3'
Review comment:
But I think this was deliberate. It's better to check in on schedule rather than per-commit because the vulnerabilities are rarely appearing by someone adding new stuff but they are triggered by CVE being reported. I think weekly schedule for those is pretty good cadence.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] potiuk edited a comment on pull request #11211: Add Github Code Scanning
Posted by GitBox <gi...@apache.org>.
potiuk edited a comment on pull request #11211:
URL: https://github.com/apache/airflow/pull/11211#issuecomment-703085177
One thing to check - I just realised why the schedule one is still needed alongside push @kaxil @turbaszek
You can read more About it here https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning
The push/pr only scans the changed code(for new vulnerabilities introduced), not the whole of it. The scheduled builds scans all of the code for any new vulnerabilities that were reported since the last full sscheduled scan. So we have to keep both.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] kaxil commented on a change in pull request #11211: Add Github Code Scanning
Posted by GitBox <gi...@apache.org>.
kaxil commented on a change in pull request #11211:
URL: https://github.com/apache/airflow/pull/11211#discussion_r498167461
##########
File path: .github/workflows/codeql-analysis.yml
##########
@@ -0,0 +1,66 @@
+name: "CodeQL"
+
+on:
+ push:
+ branches: [master]
+ pull_request:
+ # The branches below must be a subset of the branches above
+ branches: [master]
+ schedule:
+ - cron: '0 17 * * 3'
Review comment:
I don't think we need to run it on a Schedule
##########
File path: .github/workflows/codeql-analysis.yml
##########
@@ -0,0 +1,66 @@
+name: "CodeQL"
+
+on:
+ push:
+ branches: [master]
+ pull_request:
+ # The branches below must be a subset of the branches above
+ branches: [master]
+ schedule:
+ - cron: '0 17 * * 3'
Review comment:
Running it on PRs and Master would suffice
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] kaxil commented on a change in pull request #11211: Add Github Code Scanning
Posted by GitBox <gi...@apache.org>.
kaxil commented on a change in pull request #11211:
URL: https://github.com/apache/airflow/pull/11211#discussion_r498206410
##########
File path: .github/workflows/codeql-analysis.yml
##########
@@ -0,0 +1,66 @@
+name: "CodeQL"
+
+on:
+ push:
+ branches: [master]
+ pull_request:
+ # The branches below must be a subset of the branches above
+ branches: [master]
+ schedule:
+ - cron: '0 17 * * 3'
Review comment:
I mean yeah I don't have a strong opinion on that one tbh. We can keep it too.
> I think it will just be overwhelming and counter-productive to get those reports for all commits, but Let's see :)
Wouldn't we get that if we keep "schedule" too, i.e. based on what we have in PR: we will currently have it when a PR is pushed, a commit is pushed and "on schedule" too, correct me if I am wrong though
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] turbaszek commented on a change in pull request #11211: Add Github Code Scanning
Posted by GitBox <gi...@apache.org>.
turbaszek commented on a change in pull request #11211:
URL: https://github.com/apache/airflow/pull/11211#discussion_r498160604
##########
File path: .github/workflows/codeql-analysis.yml
##########
@@ -0,0 +1,66 @@
+name: "CodeQL"
+
+on:
+ push:
+ branches: [master]
+ pull_request:
+ # The branches below must be a subset of the branches above
+ branches: [master]
+ schedule:
+ - cron: '0 17 * * 3'
Review comment:
Do you think we should run this on schedule?
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org