Switch the trigger from `pull_request` to `pull_request_target` so that
the workflow definition on `main` is evaluated for PRs targeting active
release branches (main, umbrella, tentacle, squid). This allows the check
to run cleanly across release branches without requiring workflow file
backports to each branch.
Additionally:
- Update `src/script/verify-qa` to accept an optional target directory argument ($1).
- Run the trusted `verify-qa` script from `main` against the checked-out PR directory (`./pull_request`).
The concern of exfiltrating secrets is important but not relevant here:
we're not using the secrets in the definition and we explicitly
downgrade the github token to `read` permission.
Signed-off-by: Patrick Donnelly <pdonnell@ibm.com>
Switch the trigger from `pull_request` to `pull_request_target` so that
the workflow definition on `main` is evaluated for PRs targeting active
release branches (main, umbrella, tentacle, squid). This allows the check
to run cleanly across release branches without requiring workflow file
backports to each branch.
While this workflow passes `github.token`, the token permissions are
strictly restricted to read-only (`contents: read` and `pull-requests: read`).
Because no PR code is checked out or executed, using `pull_request_target`
presents zero security risk here.
Signed-off-by: Patrick Donnelly <pdonnell@ibm.com>
PRs carrying these GitHub labels were silently dropped from both the
QA tracker's PR "Labels" column and the Redmine ticket's tag_list,
since SUPPORTED_QA_TAGS is a fixed whitelist and these were never
added to it despite being real, actively-used component/category
labels (e.g. ceph/ceph#70661, #70658 for crimson).
Signed-off-by: Yuri Weinstein <yweinste@redhat.com>
Use ref instead of external link definitions for intra-docs links.
Add labels if necessary in files within the install/ directory. Use
existing labels for links outside the install/ directory but do not add
new labels outside of the install/ directory.
Signed-off-by: Ville Ojamo <git2233+ceph@ojamo.eu>
Substitutions were not enabled on a prompt directive that tried to use
the stable-release substitution so the substitution string was rendered
verbatim.
Signed-off-by: Ville Ojamo <git2233+ceph@ojamo.eu>
When editing services such as oauth2-proxy, backend fields like scope
arrive as a single string. Spreading that string into the list turned
each character into its own row. Normalize string values to one item.
Fixes: https://tracker.ceph.com/issues/78808
Signed-off-by: Pedro Gonzalez Gomez <pegonzal@ibm.com>
CherryPy's serve_file() uses Python's mimetypes module which returns
text/javascript for .js files (RFC 9239), but the gzip config only
listed application/javascript. This meant the main Angular bundle
was being served uncompressed. With Cheroot write timeouts,
the uncompressed transfer times out over slower networks, causing
ERR_CONTENT_LENGTH_MISMATCH in the browser.
Signed-off-by: Afreen Misbah <afreen@ibm.com>
crimson/osd/pg_recovery: call on_global_recover on replica-recover-deleted objects only when it's not missing on the primary too
Reviewed-by: Kefu Chai <k.chai@proxmox.com>
* refs/pull/70574/head:
.github/workflows: bump checkout action version
.github/workflows/qa-symlink: sparse checkout verify-qa
.github/workflows/qa-symlink: run only for active branches
Reviewed-by: Joseph Mundackal <jmundackal@bloomberg.net>
