fix: Removed usage of pull_request_target as much as possible to prevent security concerns #17610
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: pr-integration-tests | |
| on: | |
| pull_request: | |
| types: | |
| - opened | |
| - synchronize | |
| - labeled | |
| # concurrency is currently broken, see details https://github.com/actions/runner/issues/1532 | |
| #concurrency: | |
| # group: pr-integration-tests-${{ github.event.pull_request.number }} | |
| # cancel-in-progress: true | |
| jobs: | |
| integration-test-python: | |
| # when using pull_request, all jobs MUST have this if check for 'ok-to-test' or 'approved' for security purposes. | |
| # if: | |
| # ((github.event.action == 'labeled' && (github.event.label.name == 'approved' || github.event.label.name == 'lgtm' || github.event.label.name == 'ok-to-test')) || | |
| # (github.event.action != 'labeled' && (contains(github.event.pull_request.labels.*.name, 'ok-to-test') || contains(github.event.pull_request.labels.*.name, 'approved') || contains(github.event.pull_request.labels.*.name, 'lgtm')))) && | |
| # github.repository == 'feast-dev/feast' | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| python-version: [ "3.11" ] | |
| os: [ ubuntu-latest ] | |
| env: | |
| OS: ${{ matrix.os }} | |
| PYTHON: ${{ matrix.python-version }} | |
| services: | |
| redis: | |
| image: redis | |
| ports: | |
| - 6379:6379 | |
| options: >- | |
| --health-cmd "redis-cli ping" | |
| --health-interval 10s | |
| --health-timeout 5s | |
| --health-retries 5 | |
| steps: | |
| - name: Print target repository | |
| - run: echo "${{ github.event.pull_request.base.repo.full_name }}" | |
| - name: Print target branch | |
| - run: echo "${{ github.event.pull_request.base.ref }}" | |
| - uses: actions/checkout@v4 | |
| with: | |
| repository: ${{ github.event.repository.full_name }} # Uses the full repository name | |
| ref: ${{ github.ref }} # Uses the ref from the event | |
| token: ${{ secrets.GITHUB_TOKEN }} # Automatically provided token | |
| submodules: recursive | |
| - name: Setup Python | |
| uses: actions/setup-python@v5 | |
| id: setup-python | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| architecture: x64 | |
| - name: Authenticate to Google Cloud | |
| uses: 'google-github-actions/auth@v1' | |
| with: | |
| credentials_json: '${{ secrets.GCP_SA_KEY }}' | |
| - name: Set up gcloud SDK | |
| uses: google-github-actions/setup-gcloud@v1 | |
| with: | |
| project_id: ${{ secrets.GCP_PROJECT_ID }} | |
| - name: Use gcloud CLI | |
| run: gcloud info | |
| - name: Set up AWS SDK | |
| uses: aws-actions/configure-aws-credentials@v1 | |
| with: | |
| aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} | |
| aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} | |
| aws-region: us-west-2 | |
| - name: Use AWS CLI | |
| run: aws sts get-caller-identity | |
| - name: Install uv | |
| run: curl -LsSf https://astral.sh/uv/install.sh | sh | |
| - name: Get uv cache dir | |
| id: uv-cache | |
| run: | | |
| echo "::set-output name=dir::$(uv cache dir)" | |
| - name: uv cache | |
| uses: actions/cache@v4 | |
| with: | |
| path: ${{ steps.uv-cache.outputs.dir }} | |
| key: ${{ runner.os }}-${{ steps.setup-python.outputs.python-version }}-uv-${{ hashFiles(format('**/py{0}-ci-requirements.txt', env.PYTHON)) }} | |
| - name: Install dependencies | |
| run: make install-python-ci-dependencies-uv | |
| - name: Setup Redis Cluster | |
| run: | | |
| docker pull vishnunair/docker-redis-cluster:latest | |
| docker run -d -p 6001:6379 -p 6002:6380 -p 6003:6381 -p 6004:6382 -p 6005:6383 -p 6006:6384 --name redis-cluster vishnunair/docker-redis-cluster | |
| - name: Test python | |
| if: ${{ always() }} # this will guarantee that step won't be canceled and resources won't leak | |
| env: | |
| FEAST_SERVER_DOCKER_IMAGE_TAG: ${{ needs.build-docker-image.outputs.DOCKER_IMAGE_TAG }} | |
| SNOWFLAKE_CI_DEPLOYMENT: ${{ secrets.SNOWFLAKE_CI_DEPLOYMENT }} | |
| SNOWFLAKE_CI_USER: ${{ secrets.SNOWFLAKE_CI_USER }} | |
| SNOWFLAKE_CI_PASSWORD: ${{ secrets.SNOWFLAKE_CI_PASSWORD }} | |
| SNOWFLAKE_CI_ROLE: ${{ secrets.SNOWFLAKE_CI_ROLE }} | |
| SNOWFLAKE_CI_WAREHOUSE: ${{ secrets.SNOWFLAKE_CI_WAREHOUSE }} | |
| run: make test-python-integration |