Track changes from upstream #5
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| name: Test | ||
| runs-on: ubuntu-24.04 | ||
| timeout-minutes: 15 | ||
|
|
||
| # Do not run this job in parallel for any PR change or branch push. | ||
| concurrency: | ||
| group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }} | ||
| cancel-in-progress: true | ||
|
|
||
| if: github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'not ready') | ||
|
|
||
| steps: | ||
| # TODO https://github.com/FerretDB/github-actions/issues/211 | ||
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Setup Go | ||
| uses: FerretDB/github-actions/setup-go@main | ||
|
|
||
| - name: Run tests | ||
| run: | | ||
| cd ferretdb_packaging | ||
| go mod tidy | ||
| go mod verify | ||
| go test ./... | ||
|
|
||
| - name: Check dirty | ||
| if: always() | ||
| run: | | ||
| git status --untracked-files --ignored | ||
| git status | ||
| git diff --exit-code |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 3 months ago
To fix the problem, explicitly set the permissions key to restrict the GITHUB_TOKEN to the least privilege required. Since the workflow appears to only check out code, set up Go, and run tests (all read-only operations), the minimal required permission is contents: read. This can be set at the workflow level (applies to all jobs) or at the job level (applies only to the test job). The best practice is to set it at the workflow level unless a job requires different permissions. To implement the fix, add the following block near the top of the workflow file, after the name and before on or after on (either is valid YAML):
permissions:
contents: readNo additional methods, imports, or definitions are needed.
| @@ -2,2 +2,4 @@ | ||
| name: Go | ||
| permissions: | ||
| contents: read | ||
| on: |
AlekSi
added
the
not ready
|
@AlekSi this pull request has merge conflicts. |
# Conflicts: # CHANGELOG.md
# Conflicts: # .github/workflows/codeql.yml
That solves a problem with builds of older tags when new commits with the same prefix are added: ``` 0.104.0 gitref: HEAD sha:2045d0e buildId:0 0.104.0 gitref: HEAD sha:2045d0e0 buildId:0 ```
| - name: Build ${{ steps.version.outputs.package_version }} | ||
| if: steps.version.outputs.package_version != '' | ||
| run: ./packaging/build_packages.sh --os ${{ matrix.os }} --pg ${{ matrix.pg }} --version ${{ steps.version.outputs.package_version }} --test-clean-install | ||
|
|
||
| - name: Upload packages |
Check failure
Code scanning / CodeQL
Cache Poisoning via execution of untrusted code High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 2 months ago
To fix the problem, the workflow should not run untrusted code in the context of the default branch. The best way to do this is to change the workflow trigger from pull_request_target to pull_request for jobs that build or execute code from PRs. The pull_request event runs in the context of the PR branch, not the default branch, and does not have access to privileged secrets or caches from the default branch. This change should be made in the workflow file .github/workflows/ferretdb_packages.yml by replacing the pull_request_target event with pull_request in the on: section. Additionally, update any logic that checks for github.event_name == 'pull_request_target' to use github.event_name == 'pull_request' instead. This ensures that untrusted code is only run in a safe context and prevents cache poisoning.
| @@ -23,7 +23,7 @@ | ||
|
|
||
| name: Packages | ||
| on: | ||
| pull_request_target: | ||
| pull_request: | ||
| types: | ||
| - unlabeled # if GitHub Actions stuck, add and remove "not ready" label to force rebuild | ||
| - opened | ||
| @@ -93,14 +93,14 @@ | ||
| steps: | ||
| # TODO https://github.com/FerretDB/github-actions/issues/211 | ||
| - name: Checkout code | ||
| if: github.event_name != 'pull_request_target' | ||
| if: github.event_name != 'pull_request' | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 # for `generate_extension_version.sh` to work | ||
|
|
||
| # TODO https://github.com/FerretDB/github-actions/issues/211 | ||
| - name: Checkout pull request code | ||
| if: github.event_name == 'pull_request_target' | ||
| if: github.event_name == 'pull_request' | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 # for `generate_extension_version.sh` to work | ||
| @@ -112,7 +106,7 @@ | ||
| git status | ||
|
|
||
| - name: Name branch | ||
| if: github.event_name == 'pull_request_target' | ||
| if: github.event_name == 'pull_request' | ||
| env: | ||
| BRANCH: ${{ github.head_ref }} # see https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable | ||
| run: git checkout -b $BRANCH |
Closes FerretDB/FerretDB#5379. Co-authored-by: Chi Fujii <chi.fujii@ferretdb.io>
* Merged PR 1743705: Enabling Plain Auth with Entra tokens ### Does this PR have any customer impact? ### Type (Feature, Refactoring, Bugfix, DevOps, Testing, Perf, etc) ### Does it involve schema level changes? (Table, Column, Index, UDF, etc level changes) ### Are you introducing any new config? If yes, do you have tests with and without them being set? ### ChangeLog (Refer [Template](../oss/CHANGELOG.md)) ### Description ---- #### AI description (iteration 1) #### PR Classification This pull request introduces a new authentication feature for enabling plain authentication using Entra tokens. #### PR Summary The change adds support for Entra plain authentication by implementing a dedicated token validation flow and updating related configuration and state management. This enhancement improves authentication flexibility in the Postgres gateway. - `Tests.Postgres.CSharp/Integration/Entra/EntraPlainAuthTests.cs`: Introduces new integration tests for various Entra token scenarios (app token, managed identity, invalid claims, expired tokens, missing user). - `AuthSaslScramHandlerBase.cs`: Adds a new method `HandleSaslPlainEntraStartRequestAsync` and refactors token validation logic to support Entra plain auth. - `MongoPostgresAuthStateMachine.cs`: Updates the state machine to check Entra config flags and route PLAIN auth requests through the Entra-specific handler. - `PostgresTenantConfiguration.cs` and `pgmongo.c`: Introduce and configure the `isEntraPlainAuthEnabled` flag with its default set to false. - `AuthenticationType.cs`: Extends the enum by adding the new `EntraPlain` type for authentication. <!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot --> * Merged PR 1751683: [User-Experience] Enhancing error message experience for output stages ### Does this PR have any customer impact? ### Type (Feature, Refactoring, Bugfix, DevOps, Testing, Perf, etc) ### Does it involve schema level changes? (Table, Column, Index, UDF, etc level changes) ### Are you introducing any new config? If yes, do you have tests with and without them being set? ### ChangeLog (Refer [Template](../oss/CHANGELOG.md)) ### Description [User-Experience] Enhancing Merge error message experience for unsupported cases ---- #### AI description (iteration 1) #### PR Classification This pull request addresses a bug fix by enhancing the user experience for unsupported $merge stage scenarios with clearer error messages. #### PR Summary The changes introduce more specific error reporting when the $merge aggregation stage is used with mutable functions and unsupported stages, and update related test outputs accordingly. - `oss/pg_documentdb/src/aggregation/bson_aggregation_output_pipeline.c`: Added checks for specific function IDs (e.g., system_rows, random, and empty data table functions) and updated error messages for unsupported $merge with $sample and missing collections, as well as changing the return type of `ValidatePreOutputStages` from bool to void. - Test files under `oss/internal/pg_documentdb_distributed` and `pgmongo/src/test/docdb_compat`: Updated expected outputs to align with the revised error messages for unsupported aggregation scenarios. <!-- GitOpsUserAgent=GitOps.Apps.Server.pullrequestcopilot --> --------- Co-authored-by: Deepak Pemmaraju <deepakpe@microsoft.com> Co-authored-by: Parag Jain <paragjain@microsoft.com>
|
@AlekSi this pull request has merge conflicts. |
# Conflicts: # CHANGELOG.md # packaging/debian_files/changelog # packaging/rpm_files/documentdb.spec
|
@AlekSi this pull request has merge conflicts. |
3 participants
No description provided.