You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by GitBox <gi...@apache.org> on 2021/04/27 19:12:04 UTC

[GitHub] [airflow] zacharya19 opened a new pull request #11260: Add DAG permissions based on DAG tags

zacharya19 opened a new pull request #11260:
URL: https://github.com/apache/airflow/pull/11260


   Closes #9342, a new feature that allow to add read/write access for dags based on the tags, which will be make it easier to control "group" access.
   
   ---
   **^ Add meaningful description above**
   
   Read the **[Pull Request Guidelines](https://github.com/apache/airflow/blob/master/CONTRIBUTING.rst#pull-request-guidelines)** for more information.
   In case of fundamental code change, Airflow Improvement Proposal ([AIP](https://cwiki.apache.org/confluence/display/AIRFLOW/Airflow+Improvements+Proposals)) is needed.
   In case of a new dependency, check compliance with the [ASF 3rd Party License Policy](https://www.apache.org/legal/resolved.html#category-x).
   In case of backwards incompatible changes please leave a note in [UPDATING.md](https://github.com/apache/airflow/blob/master/UPDATING.md).
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



[GitHub] [airflow] zhaitin-quotient commented on pull request #11260: Add DAG permissions based on DAG tags

Posted by GitBox <gi...@apache.org>.
zhaitin-quotient commented on pull request #11260:
URL: https://github.com/apache/airflow/pull/11260#issuecomment-748183160


   Fixed the conflicts.
   @kaxil @jhtimmins Any thoughts?


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



[GitHub] [airflow] kaxil commented on pull request #11260: Add DAG permissions based on DAG tags

Posted by GitBox <gi...@apache.org>.
kaxil commented on pull request #11260:
URL: https://github.com/apache/airflow/pull/11260#issuecomment-739438605


   @jhtimmins Can you take a look at this please?


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



[GitHub] [airflow] zacharya19 commented on pull request #11260: Add DAG permissions based on DAG tags

Posted by GitBox <gi...@apache.org>.
zacharya19 commented on pull request #11260:
URL: https://github.com/apache/airflow/pull/11260#issuecomment-786823196


   @jhtimmins
   
   1. I get your point, but this is true even without this feature, a user can always write code inside the dag to change permission or access the DB through it.
   
   Anyway, I guess this is not an impl that you guys like, do you have another proposal?


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



[GitHub] [airflow] jhtimmins commented on pull request #11260: Add DAG permissions based on DAG tags

Posted by GitBox <gi...@apache.org>.
jhtimmins commented on pull request #11260:
URL: https://github.com/apache/airflow/pull/11260#issuecomment-773681476


   @zacharya19 Apologies for the delay.
   
   1. This will depend on your deployment setup. If your team uses automated deployments it's very possible that a user could have merge access that will allow a DAG to get added/modified without having access to the DB. Perhaps more importantly, allowing a code-level change to modify permissions is a relatively deep coupling between two separate systems, which presents additional issues. For example, allowing tags to control access means that any time someone does a code review of a DAG change, they'll need to check the associated users with access to the associated tags, then confirm with a manager/admin user that those users are permitted to access that DAG. Now admin-level app management is tied to code deployments.
   
   2. It seems like most of the issues you described can be solved with custom roles. Since users can have multiple roles, could you not create custom roles that have access to edit/read the appropriate DAGs. Then a user that works for the internal tools team, for example, could have the roles `Viewer` and `InternalTools`. Whenever the internal tools team adds a new DAG, it's relatively simple to add that new DAG to the `InternalTools` role. 
   
   @JavierLopezT I'm interested in your thoughts for #2 as well. 


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



[GitHub] [airflow] JavierLopezT commented on pull request #11260: Add DAG permissions based on DAG tags

Posted by GitBox <gi...@apache.org>.
JavierLopezT commented on pull request #11260:
URL: https://github.com/apache/airflow/pull/11260#issuecomment-773413610


   Any update on this?


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



[GitHub] [airflow] zacharya19 commented on pull request #11260: Add DAG permissions based on DAG tags

Posted by GitBox <gi...@apache.org>.
zacharya19 commented on pull request #11260:
URL: https://github.com/apache/airflow/pull/11260#issuecomment-748183400


   Fixed the conflicts.
   @kaxil @jhtimmins Any thoughts?


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



[GitHub] [airflow] Deathblade6 commented on pull request #11260: Add DAG permissions based on DAG tags

Posted by GitBox <gi...@apache.org>.
Deathblade6 commented on pull request #11260:
URL: https://github.com/apache/airflow/pull/11260#issuecomment-827540886


   @zacharya19 This is actually a great feature that I need, which i honestly thought already existed in Airflow. Just commenting so that this PR turns into a reality. 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



[GitHub] [airflow] zhaitin-quotient removed a comment on pull request #11260: Add DAG permissions based on DAG tags

Posted by GitBox <gi...@apache.org>.
zhaitin-quotient removed a comment on pull request #11260:
URL: https://github.com/apache/airflow/pull/11260#issuecomment-748183160


   Fixed the conflicts.
   @kaxil @jhtimmins Any thoughts?


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



[GitHub] [airflow] JavierLopezT edited a comment on pull request #11260: Add DAG permissions based on DAG tags

Posted by GitBox <gi...@apache.org>.
JavierLopezT edited a comment on pull request #11260:
URL: https://github.com/apache/airflow/pull/11260#issuecomment-773413610


   I could really use this feature! Any feedback on how @zacharya19 should proceed? @kaxil @ashb 


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



[GitHub] [airflow] zacharya19 commented on pull request #11260: Add DAG permissions based on DAG tags

Posted by GitBox <gi...@apache.org>.
zacharya19 commented on pull request #11260:
URL: https://github.com/apache/airflow/pull/11260#issuecomment-734890906


   > Can you please rebase your PR on latest Master since we have applied [Black](https://github.com/apache/airflow/commit/4e8f9cc8d02b29c325b8a5a76b4837671bdf5f68) and [PyUpgrade](https://github.com/apache/airflow/commit/8c42cf1b00c90f0d7f11b8a3a455381de8e003c5) on Master.
   > 
   > It will help if your squash your commits into single commit first so that there are less conflicts.
   
   Done, also refactored the code to be compatible with #11362.


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



[GitHub] [airflow] github-actions[bot] commented on pull request #11260: Add DAG permissions based on DAG tags

Posted by GitBox <gi...@apache.org>.
github-actions[bot] commented on pull request #11260:
URL: https://github.com/apache/airflow/pull/11260#issuecomment-818324106


   This pull request has been automatically marked as stale because it has not had recent activity. It will be closed in 5 days if no further activity occurs. Thank you for your contributions.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



[GitHub] [airflow] kaxil closed pull request #11260: Add DAG permissions based on DAG tags

Posted by GitBox <gi...@apache.org>.
kaxil closed pull request #11260:
URL: https://github.com/apache/airflow/pull/11260


   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



[GitHub] [airflow] JavierLopezT commented on pull request #11260: Add DAG permissions based on DAG tags

Posted by GitBox <gi...@apache.org>.
JavierLopezT commented on pull request #11260:
URL: https://github.com/apache/airflow/pull/11260#issuecomment-773413610


   Any update on this?


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



[GitHub] [airflow] ashb commented on pull request #11260: Add DAG permissions based on DAG tags

Posted by GitBox <gi...@apache.org>.
ashb commented on pull request #11260:
URL: https://github.com/apache/airflow/pull/11260#issuecomment-706220199


   cc @jhtimmins Who is working on an overhaul of the permissions modelling/names for the UI in https://github.com/apache/airflow/pull/11362
   
   @zacharya19 I think we might ask you to hold off on this until that PR is merged at least.


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



[GitHub] [airflow] zacharya19 commented on pull request #11260: Add DAG permissions based on DAG tags

Posted by GitBox <gi...@apache.org>.
zacharya19 commented on pull request #11260:
URL: https://github.com/apache/airflow/pull/11260#issuecomment-704964623


   Going to ignore the tests for now - they passed and all I did was change the commit message and they're failing on something that looks like connection error on the CI, not a real test issues.
   Once this PR is approved I'll rebase from master.


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



[GitHub] [airflow] kaxil commented on pull request #11260: Add DAG permissions based on DAG tags

Posted by GitBox <gi...@apache.org>.
kaxil commented on pull request #11260:
URL: https://github.com/apache/airflow/pull/11260#issuecomment-721446394


   Can you please rebase your PR on latest Master since we have applied [Black](https://github.com/apache/airflow/commit/4e8f9cc8d02b29c325b8a5a76b4837671bdf5f68) and [PyUpgrade](https://github.com/apache/airflow/commit/8c42cf1b00c90f0d7f11b8a3a455381de8e003c5) on Master.
   
   It will help if your squash your commits into single commit first so that there are less conflicts.
   


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



[GitHub] [airflow] kaxil commented on pull request #11260: Add DAG permissions based on DAG tags

Posted by GitBox <gi...@apache.org>.
kaxil commented on pull request #11260:
URL: https://github.com/apache/airflow/pull/11260#issuecomment-827866937


   Temporarily added it to 2.1 Milestone to revisit this at a later time.
   
   Assigning permissions to a group of DAGs is a good future -- I am not yet sure if "Tags" are the best way for it for the reason James already mentioned. Probably better would be some sort of "wildcard" on permissions -- not sure at the moment.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



[GitHub] [airflow] github-actions[bot] closed pull request #11260: Add DAG permissions based on DAG tags

Posted by GitBox <gi...@apache.org>.
github-actions[bot] closed pull request #11260:
URL: https://github.com/apache/airflow/pull/11260


   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



[GitHub] [airflow] jhtimmins edited a comment on pull request #11260: Add DAG permissions based on DAG tags

Posted by GitBox <gi...@apache.org>.
jhtimmins edited a comment on pull request #11260:
URL: https://github.com/apache/airflow/pull/11260#issuecomment-773681476


   @zacharya19 Apologies for the delay.
   
   1. This will depend on your deployment setup. If your team uses automated deployments it's very possible that a user could have merge access that will allow a DAG to get added/modified without having access to the DB. Perhaps more importantly, allowing a code-level change to modify permissions is a relatively deep coupling between two separate systems, which presents additional issues. For example, allowing tags to control access means that any time someone does a code review of a DAG change, they'll need to check the associated users with access to the associated tags, then confirm with a manager/admin user that those users are permitted to access that DAG. Now admin-level app management is tied to code deployments.
   
   2. It seems like most of the issues you described can be solved with custom roles. Since users can have multiple roles, could you not create custom roles that have access to edit/read the appropriate DAGs. Then a user that works for the internal tools team, for example, could have the roles `Viewer` and `InternalTools`. Whenever the internal tools team adds a new DAG, it's relatively simple to add that new DAG to the `InternalTools` role. 
   
   @JavierLopezT I'm interested in your thoughts for the second point as well. 


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



[GitHub] [airflow] kaxil edited a comment on pull request #11260: Add DAG permissions based on DAG tags

Posted by GitBox <gi...@apache.org>.
kaxil edited a comment on pull request #11260:
URL: https://github.com/apache/airflow/pull/11260#issuecomment-827866937


   Temporarily added it to 2.1 Milestone to revisit this at a later time.
   
   Assigning permissions to a group of DAGs is a good future -- I am not yet sure if "Tags" are the best way for it for the reason James already mentioned. Probably better would be some sort of "wildcard" on permissions -- not sure at the moment.
   
   
   Also, we should just have a single way to add/edit permissions via UI & API -- not via DAGs themselves -- I know currently we allow it but it is "anti-pattern" in my opinion and is already causing some headaches.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



[GitHub] [airflow] zacharya19 commented on pull request #11260: Add DAG permissions based on DAG tags

Posted by GitBox <gi...@apache.org>.
zacharya19 commented on pull request #11260:
URL: https://github.com/apache/airflow/pull/11260#issuecomment-706189455


   @ashb @kaxil LMK what you guys think, I would love to so it in the next version.


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



[GitHub] [airflow] JavierLopezT edited a comment on pull request #11260: Add DAG permissions based on DAG tags

Posted by GitBox <gi...@apache.org>.
JavierLopezT edited a comment on pull request #11260:
URL: https://github.com/apache/airflow/pull/11260#issuecomment-773413610


   I could really use this feature! Any feedback on how @zacharya19 should proceed? @kaxil @ashb 


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



[GitHub] [airflow] jhtimmins commented on pull request #11260: Add DAG permissions based on DAG tags

Posted by GitBox <gi...@apache.org>.
jhtimmins commented on pull request #11260:
URL: https://github.com/apache/airflow/pull/11260#issuecomment-750467565


   @zacharya19 @kaxil @ashb 
   
   At a high-level I like the idea of tying permissions to DAG tags, however this presents two issues.
   
   1. This would allow anyone with the User role to give DAG access to anyone else. Currently, you need to be an Admin user to give DAG access to someone else. But with this change, if a user is able to edit a DAG (which the User role permits), they are able to add arbitrary DAG tags. This allows them to give permissions to other users.
   
   2. Dag-level permissions were hacked into the existing permission design, which we attempted to clean up with the `DAG:` prefix. It was a step in the right direction, but was a less than ideal solution. I'm somewhat hesitant to go further down the path of creating special classes of permissions via prefix strings. Creating a more robust permission design to better handle flexible permissions such as this may not be warranted, but I think we should consider the pros/cons of adding to the hack. I'm happy to defer to Ash and Kaxil.


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



[GitHub] [airflow] kaxil commented on pull request #11260: Add DAG permissions based on DAG tags

Posted by GitBox <gi...@apache.org>.
kaxil commented on pull request #11260:
URL: https://github.com/apache/airflow/pull/11260#issuecomment-827880095


   Moving the conversation to the Issue instead of this PR


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



[GitHub] [airflow] jhtimmins edited a comment on pull request #11260: Add DAG permissions based on DAG tags

Posted by GitBox <gi...@apache.org>.
jhtimmins edited a comment on pull request #11260:
URL: https://github.com/apache/airflow/pull/11260#issuecomment-773681476


   @zacharya19 Apologies for the delay.
   
   1. This will depend on your deployment setup. If your team uses automated deployments it's very possible that a user could have merge access that will allow a DAG to get added/modified without having access to the DB. Perhaps more importantly, allowing a code-level change to modify permissions is a relatively deep coupling between two separate systems, which presents additional issues. For example, allowing tags to control access means that any time someone does a code review of a DAG change, they'll need to check the associated users with access to the associated tags, then confirm with a manager/admin user that those users are permitted to access that DAG. Now admin-level app management is tied to code deployments.
   
   2. It seems like most of the issues you described can be solved with custom roles. Since users can have multiple roles, could you not create custom roles that have access to edit/read the appropriate DAGs. Then a user that works for the internal tools team, for example, could have the roles `Viewer` and `InternalTools`. Whenever the internal tools team adds a new DAG, it's relatively simple to add that new DAG to the `InternalTools` role. 
   
   @JavierLopezT I'm interested in your thoughts for the second point as well. 


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



[GitHub] [airflow] jhtimmins commented on pull request #11260: Add DAG permissions based on DAG tags

Posted by GitBox <gi...@apache.org>.
jhtimmins commented on pull request #11260:
URL: https://github.com/apache/airflow/pull/11260#issuecomment-773681476


   @zacharya19 Apologies for the delay.
   
   1. This will depend on your deployment setup. If your team uses automated deployments it's very possible that a user could have merge access that will allow a DAG to get added/modified without having access to the DB. Perhaps more importantly, allowing a code-level change to modify permissions is a relatively deep coupling between two separate systems, which presents additional issues. For example, allowing tags to control access means that any time someone does a code review of a DAG change, they'll need to check the associated users with access to the associated tags, then confirm with a manager/admin user that those users are permitted to access that DAG. Now admin-level app management is tied to code deployments.
   
   2. It seems like most of the issues you described can be solved with custom roles. Since users can have multiple roles, could you not create custom roles that have access to edit/read the appropriate DAGs. Then a user that works for the internal tools team, for example, could have the roles `Viewer` and `InternalTools`. Whenever the internal tools team adds a new DAG, it's relatively simple to add that new DAG to the `InternalTools` role. 
   
   @JavierLopezT I'm interested in your thoughts for #2 as well. 


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



[GitHub] [airflow] Deathblade6 edited a comment on pull request #11260: Add DAG permissions based on DAG tags

Posted by GitBox <gi...@apache.org>.
Deathblade6 edited a comment on pull request #11260:
URL: https://github.com/apache/airflow/pull/11260#issuecomment-827540886


   @zacharya19 This is actually a great feature that I need desperately in a project i'm doing, which i honestly thought already existed in Airflow. Just commenting so that this PR turns into a reality. 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



[GitHub] [airflow] zacharya19 commented on pull request #11260: Add DAG permissions based on DAG tags

Posted by GitBox <gi...@apache.org>.
zacharya19 commented on pull request #11260:
URL: https://github.com/apache/airflow/pull/11260#issuecomment-751483632


   > @zacharya19 @kaxil @ashb
   > 
   > At a high-level I like the idea of tying permissions to DAG tags, however this presents two issues.
   > 
   > 1. This would allow anyone with the User role to give DAG access to anyone else. Currently, you need to be an Admin user to give DAG access to someone else. But with this change, if a user is able to edit a DAG (which the User role permits), they are able to add arbitrary DAG tags. This allows them to give permissions to other users.
   > 2. Dag-level permissions were hacked into the existing permission design, which we attempted to clean up with the `DAG:` prefix. It was a step in the right direction, but was a less than ideal solution. I'm somewhat hesitant to go further down the path of creating special classes of permissions via prefix strings. Creating a more robust permission design to better handle flexible permissions such as this may not be warranted, but I think we should consider the pros/cons of adding to the hack. I'm happy to defer to Ash and Kaxil.
   
   1. Maybe I'm missing something, but the only way to add tags to a dag is by editing the code directly which requires access to the machine itself, so even without it the user can simply extract the DB info and edit permissions if they have access to the machine.
   2. I get your point, you're probably right but I feel that tags and the ability to add permissions based on them is a must for big companies that want to use Airflow, so IMHO adding this hack and open a task to redesign the permission system would be the right thing to do, I think that doing that redesign now is a big task and can make this feature wait for a few months.
   
   @kaxil @ashb What do you guys think? I'm OK with either way, I can probably take the redesign task on myself.


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



[GitHub] [airflow] kaxil commented on pull request #11260: Add DAG permissions based on DAG tags

Posted by GitBox <gi...@apache.org>.
kaxil commented on pull request #11260:
URL: https://github.com/apache/airflow/pull/11260#issuecomment-749252544


   ping @jhtimmins 


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



[GitHub] [airflow] github-actions[bot] commented on pull request #11260: Add DAG permissions based on DAG tags

Posted by GitBox <gi...@apache.org>.
github-actions[bot] commented on pull request #11260:
URL: https://github.com/apache/airflow/pull/11260#issuecomment-734900798


   [The Workflow run](https://github.com/apache/airflow/actions/runs/387412376) is cancelling this PR. It has some failed jobs matching ^Pylint$,^Static checks,^Build docs$,^Spell check docs$,^Backport packages$,^Provider packages,^Checks: Helm tests$,^Test OpenAPI*.


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org