Skip to content

Commit 2a0671e

Browse files
evertlammertsevertlammerts
committed
Protect submodule in workflow
1 parent fb21deb commit 2a0671e

File tree

7 files changed

+92
-51
lines changed

7 files changed

+92
-51
lines changed

‎.github/workflows/on_pr.yml‎

Lines changed: 4 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -19,25 +19,9 @@ concurrency:
1919
cancel-in-progress: true
2020

2121
jobs:
22-
ensure_submodule_sanity:
23-
name: Make sure we're not building with a fork
24-
runs-on: ubuntu-latest
25-
steps:
26-
- name: Checkout DuckDB Python
27-
uses: actions/checkout@v4
28-
29-
- shell: bash
30-
run: |
31-
submodule_url=$(git config --file .gitmodules --get submodule.external/duckdb.url || true)
32-
expected="github.com/duckdb/duckdb"
33-
if [[ -z "$submodule_url" ]]; then
34-
echo "::error::DuckDB submodule not found in .gitmodules"
35-
exit 1
36-
fi
37-
if [[ "$submodule_url" != *"$expected"* ]]; then
38-
echo "::error::DuckDB submodule must point to $expected, found: $submodule_url"
39-
exit 1
40-
fi
22+
submodule_sanity_guard:
23+
name: Make sure submodule is in a sane state
24+
uses: .github/workflows/submodule_sanity.yml
4125

4226
packaging_test:
4327
name: Build a minimal set of packages and run all tests on them
@@ -48,7 +32,7 @@ jobs:
4832
with:
4933
minimal: true
5034
testsuite: all
51-
duckdb-git-ref: ${{ github.base_ref }}
35+
duckdb-sha: ${{ github.base_ref }}
5236

5337
coverage_test:
5438
name: Run coverage tests

‎.github/workflows/on_push_protected.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
name: Guard pushes to protected branches
2+
on:
3+
push:
4+
branches:
5+
- main
6+
- v*.*-*
7+
jobs:
8+
submodule_sanity_guard:
9+
name: Make sure submodule is in a sane state
10+
uses: .github/workflows/submodule_sanity.yml

‎.github/workflows/packaging.yml‎

Lines changed: 13 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -16,15 +16,14 @@ on:
1616
- none
1717
- fast
1818
- all
19-
git-ref:
19+
duckdb-python-sha:
2020
type: string
21-
description: Git ref of the DuckDB python package
21+
description: The commit to build against (defaults to latest commit of current ref)
2222
required: false
23-
duckdb-git-ref:
23+
duckdb-sha:
2424
type: string
25-
description: Git ref of DuckDB
26-
required: true
27-
default: refs/heads/main
25+
description: Override the DuckDB submodule commit or ref to build against
26+
required: false
2827
set-version:
2928
type: string
3029
description: Force version (vX.Y.Z-((rc|post)N))
@@ -40,13 +39,13 @@ on:
4039
description: Testsuite to run (none, fast, all)
4140
required: true
4241
default: all
43-
git-ref:
42+
duckdb-python-sha:
4443
type: string
45-
description: Git ref of the DuckDB python package
44+
description: The commit or ref to build against (defaults to latest commit of current ref)
4645
required: false
47-
duckdb-git-ref:
46+
duckdb-sha:
4847
type: string
49-
description: Git ref of DuckDB
48+
description: Override the DuckDB submodule commit or ref to build against
5049
required: false
5150
set-version:
5251
description: Force version (vX.Y.Z-((rc|post)N))
@@ -67,8 +66,8 @@ jobs:
6766
uses: ./.github/workflows/packaging_sdist.yml
6867
with:
6968
testsuite: all
70-
git-ref: ${{ github.ref }}
71-
duckdb-git-ref: ${{ inputs.duckdb-sha }}
69+
duckdb-python-sha: ${{ inputs.duckdb-python-sha != '' && inputs.duckdb-python-sha || github.sha }}
70+
duckdb-sha: ${{ inputs.duckdb-sha }}
7271
set-version: ${{ inputs.stable-version }}
7372

7473
build_wheels:
@@ -77,6 +76,6 @@ jobs:
7776
with:
7877
minimal: false
7978
testsuite: all
80-
git-ref: ${{ github.ref }}
81-
duckdb-git-ref: ${{ inputs.duckdb-sha }}
79+
duckdb-python-sha: ${{ inputs.duckdb-python-sha != '' && inputs.duckdb-python-sha || github.sha }}
80+
duckdb-sha: ${{ inputs.duckdb-sha }}
8281
set-version: ${{ inputs.stable-version }}

‎.github/workflows/packaging_sdist.yml‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7,13 +7,13 @@ on:
77
description: Testsuite to run (none, fast, all)
88
required: true
99
default: all
10-
git-ref:
10+
duckdb-python-sha:
1111
type: string
12-
description: Git ref of the DuckDB python package
12+
description: The commit or ref to build against (defaults to current ref)
1313
required: false
14-
duckdb-git-ref:
14+
duckdb-sha:
1515
type: string
16-
description: Git ref of DuckDB
16+
description: Override the DuckDB submodule commit or ref to build against
1717
required: false
1818
set-version:
1919
description: Force version (vX.Y.Z-((rc|post)N))
@@ -39,16 +39,17 @@ jobs:
3939
- name: Checkout DuckDB Python
4040
uses: actions/checkout@v4
4141
with:
42-
ref: ${{ inputs.git-ref }}
42+
ref: ${{ inputs.duckdb-python-sha }}
4343
fetch-depth: 0
4444
submodules: true
4545

4646
- name: Checkout DuckDB
4747
shell: bash
48+
if: ${{ inputs.duckdb-sha }}
4849
run: |
4950
cd external/duckdb
5051
git fetch origin
51-
git checkout ${{ inputs.duckdb-git-ref }}
52+
git checkout ${{ inputs.duckdb-sha }}
5253
5354
- name: Set OVERRIDE_GIT_DESCRIBE
5455
if: ${{ inputs.set-version != '' }}

‎.github/workflows/packaging_wheels.yml‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -11,13 +11,13 @@ on:
1111
description: Testsuite to run (none, fast, all)
1212
required: true
1313
default: all
14-
git-ref:
14+
duckdb-python-sha:
1515
type: string
16-
description: Git ref of the DuckDB python package
16+
description: The commit or ref to build against (defaults to latest commit of current ref)
1717
required: false
18-
duckdb-git-ref:
18+
duckdb-sha:
1919
type: string
20-
description: Git ref of DuckDB
20+
description: Override the DuckDB submodule commit or ref to build against
2121
required: false
2222
set-version:
2323
description: Force version (vX.Y.Z-((rc|post)N))
@@ -59,16 +59,17 @@ jobs:
5959
- name: Checkout DuckDB Python
6060
uses: actions/checkout@v4
6161
with:
62-
ref: ${{ inputs.git-ref }}
62+
ref: ${{ inputs.duckdb-python-sha }}
6363
fetch-depth: 0
6464
submodules: true
6565

6666
- name: Checkout DuckDB
6767
shell: bash
68+
if: ${{ inputs.duckdb-python-sha }}
6869
run: |
6970
cd external/duckdb
7071
git fetch origin
71-
git checkout ${{ inputs.duckdb-git-ref }}
72+
git checkout ${{ inputs.duckdb-python-sha }}
7273
7374
# Make sure that OVERRIDE_GIT_DESCRIBE is propagated to cibuildwhel's env, also when it's running linux builds
7475
- name: Set OVERRIDE_GIT_DESCRIBE

‎.github/workflows/release.yml‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,13 @@ name: Release
33
on:
44
workflow_dispatch:
55
inputs:
6+
duckdb-python-sha:
7+
type: string
8+
description: The commit to build against (defaults to latest commit of current ref)
9+
required: false
610
duckdb-sha:
711
type: string
8-
description: The DuckDB submodule commit to build against
12+
description: The DuckDB submodule commit or ref to build against
913
required: true
1014
stable-version:
1115
type: string
@@ -33,8 +37,8 @@ jobs:
3337
uses: ./.github/workflows/packaging_sdist.yml
3438
with:
3539
testsuite: all
36-
git-ref: ${{ github.ref }}
37-
duckdb-git-ref: ${{ inputs.duckdb-sha }}
40+
duckdb-python-sha: ${{ inputs.duckdb-python-sha != '' && inputs.duckdb-python-sha || github.sha }}
41+
duckdb-sha: ${{ inputs.duckdb-sha }}
3842
set-version: ${{ inputs.stable-version }}
3943

4044
workflow_state:
@@ -111,8 +115,8 @@ jobs:
111115
with:
112116
minimal: false
113117
testsuite: all
114-
git-ref: ${{ github.ref }}
115-
duckdb-git-ref: ${{ inputs.duckdb-sha }}
118+
duckdb-python-sha: ${{ inputs.duckdb-python-sha != '' && inputs.duckdb-python-sha || github.sha }}
119+
duckdb-sha: ${{ inputs.duckdb-sha }}
116120
set-version: ${{ inputs.stable-version }}
117121

118122
upload_s3:

‎.github/workflows/submodule.yml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
name: Check DuckDB submodule sanity
2+
on:
3+
workflow_call:
4+
workflow_dispatch:
5+
jobs:
6+
submodule_sanity:
7+
name: Make sure submodule is in a sane state
8+
runs-on: ubuntu-latest
9+
steps:
10+
- name: Checkout DuckDB Python
11+
uses: actions/checkout@v4
12+
with:
13+
fetch-depth: 0
14+
15+
- name: Verify submodule origin
16+
shell: bash
17+
run: |
18+
set -eux
19+
git submodule update --init
20+
cd external/duckdb
21+
remote_count=$(git remote | wc -l)
22+
if [[ $remote_count -gt 1 ]]; then
23+
echo "::error::Multiple remotes found - only origin allowed"
24+
git remote -v
25+
fi
26+
origin_url=$(git remote get-url origin)
27+
if [[ "$origin_url" != "https://github.com/duckdb/duckdb"* ]]; then
28+
echo "::error::Submodule origin has been tampered with: $origin_url"
29+
exit 1
30+
fi
31+
32+
- name: Disallow changes to .gitmodules in PRs and pushes
33+
if: ${{ github.event_name == 'pull_request' || github.event_name == 'push' }}
34+
shell: bash
35+
run: |
36+
set -eux
37+
before=${{ github.event_name == 'push' && github.event.before || format('origin/{0}', github.base_ref) }}
38+
after=${{ github.event_name == 'push' && github.event.after || github.head_ref }}
39+
if git diff --name-only $before...$after | grep -q "^\.gitmodules$"; then
40+
echo "::error::.gitmodules may not be modified. If you see a reason to update, please discuss with the maintainers."
41+
exit 1
42+
fi

0 commit comments

Comments
 (0)