Conversation
glimchb
changed the title
glimchb
changed the title
| default: 'failure' | ||
|
|
||
| jobs: | ||
| merge_outputs: |
There was a problem hiding this comment.
The job separation was intentional. The merge_outputs uses the contents of SPDK repo (./spdk/autorun_post.py) and can be modified by the patch under review. Meanwhile report uses secrets to post votes on Gerrit in completely new runner. This avoids having secrets accessible in the first job.
There was a problem hiding this comment.
Back to this because of recent issues with waiting X hours for just merge_outputs to finish...
This avoids having secrets accessible in the first job.
It's preferable to keep it as separate job, but then again... is this really an issue? We don't pass secrets context values as ENV, or using with context and they are used in a in-line script only. Doesn't look they would be accessible from any scripts checked out from spdk repository,
There was a problem hiding this comment.
After re-thinking - OK, there is some risk, even if it's kind of a stretch.
There was a problem hiding this comment.
The jobs that execute things from SPDK Gerrit patches, should not share the job (VM) with ones that interact with SPDK-CI, Gerrit or infrastructure. Otherwise the latter could be modified by patches under review.
3 participants
before
after