-
Notifications
You must be signed in to change notification settings - Fork 112
[CLIENT-3467] CI/CD: Publish artifacts to JFrog using release bundles #826
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: dev
Are you sure you want to change the base?
Conversation
…frog-release-bundles
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## dev #826 +/- ##
==========================================
- Coverage 82.03% 81.91% -0.12%
==========================================
Files 99 99
Lines 14724 14024 -700
==========================================
- Hits 12079 11488 -591
+ Misses 2645 2536 -109 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
needs: rebuild-artifacts-with-new-dev-num | ||
name: Get Jfrog project to store artifacts | ||
runs-on: ubuntu-24.04 | ||
outputs: | ||
jfrog-project: ${{ steps.get-jfrog-project.outputs.jfrog_project }} | ||
|
||
steps: | ||
- id: get-jfrog-project | ||
run: echo jfrog_project=${{ env.JFROG_PYTHON_CLIENT_PROJECT }} >> $GITHUB_OUTPUT | ||
|
||
upload-github-artifacts-to-jfrog: |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 1 month ago
To fix the problem, add a permissions
key to the root level of the workflow file (.github/workflows/dev-workflow-p2.yml
). This key should set the least necessary privileges required for the workflow to function. At a minimum, set contents: read
, and add more granular permissions only if a job requires them (such as pull-requests: write
if you manage PRs, or issues: write
if you open/modify issues). Since most jobs reuse other workflows and interact mostly with artifacts, no write permissions are obviously required for contents
, so start with just contents: read
. If upon workflow usage additional permissions errors arise, add the minimum necessary permissions for each required type.
Edit .github/workflows/dev-workflow-p2.yml
and insert a permissions
block at the top level, directly after the name:
field and before on:
. For now, only set contents: read
.
-
Copy modified lines R2-R3
@@ -1,4 +1,6 @@ | ||
name: Dev workflow (part 2) | ||
permissions: | ||
contents: read | ||
|
||
on: | ||
pull_request_target: |
needs: [ | ||
bump-dev-number, | ||
get-jfrog-project-to-store-artifacts, | ||
upload-github-artifacts-to-jfrog | ||
] | ||
uses: aerospike/shared-workflows/.github/workflows/reusable_create-release-bundle.yaml@34ffd4613504a792f3cd5530c69fb9a3115ad9c1 | ||
with: | ||
project: ${{ needs.get-jfrog-project-to-store-artifacts.outputs.jfrog-project }} | ||
build-names: "${{ needs.get-jfrog-project-to-store-artifacts.outputs.jfrog-build-name }}:${{ needs.bump-dev-number.outputs.new_version }}" | ||
bundle-name: asdf | ||
version: ${{ needs.bump-dev-number.outputs.new_version }} | ||
|
||
# upload-to-jfrog: | ||
# name: Upload artifacts to JFrog | ||
# needs: [ | ||
# bump-dev-number, | ||
# rebuild-artifacts-with-new-dev-num | ||
# ] | ||
# uses: ./.github/workflows/upload-to-jfrog.yml | ||
# with: | ||
# version: ${{ needs.bump-dev-number.outputs.new_version }} | ||
# secrets: inherit | ||
|
||
# We don't want the artifacts in JFrog to also exist in Github | ||
delete-artifacts: | ||
needs: upload-to-jfrog | ||
uses: ./.github/workflows/delete-artifacts.yml | ||
# delete-artifacts: | ||
# needs: upload-to-jfrog | ||
# uses: ./.github/workflows/delete-artifacts.yml |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 1 month ago
The best fix is to add an explicit permissions
block as early as possible in the workflow YAML file, typically just below the name:
and before the on:
key (which will apply to all jobs that do not specify their own permissions block). The permissions
block should specify only those privileges required by the workflow (preferably contents: read
unless the jobs require additional write privileges, such as contents: write
or issues: write
). Since the workflow is handling artifact uploads, version bumps, and possibly PR-related changes, it's safe to start with contents: read
and grant more if needed after a functional test. As required and as a minimal baseline, the recommended block is:
permissions:
contents: read
You can later strengthen or refine this if the workflow needs more (such as pull-requests: write
).
What to do:
- In
.github/workflows/dev-workflow-p2.yml
, insert apermissions:
block after thename:
field, before theon:
block (after line 1). - Use the recommended minimal setting:
contents: read
.
No imports or new methods are required for this change, as it is a configuration edit.
-
Copy modified lines R2-R3
@@ -1,4 +1,6 @@ | ||
name: Dev workflow (part 2) | ||
permissions: | ||
contents: read | ||
|
||
on: | ||
pull_request_target: |
No description provided.