Gate googlesource cookie setup on cookie presence#6618
Conversation
The current check (head.repo.fork == false) lets Dependabot PRs through because their branches live in-repo, but Dependabot-triggered workflows don't have access to Actions secrets. GOOGLESOURCE_COOKIE ends up empty, yet we still rewrite chromium.googlesource.com URLs to the authenticated /a/ endpoint, which then fails every Bazel dependency fetch with HTTP 400. Gate on the input being non-empty instead. This naturally covers forks (secrets not forwarded), Dependabot (no secret access), and local runs (no cookie at all), falling back to the unauthenticated endpoint which is slower / rate-limited but functional. Fixes CI on Dependabot PRs, e.g. #6418.
|
All contributors have signed the CLA ✍️ ✅ |
|
All callers pass The change is minimal, correct, and well-documented with a clear comment explaining the fallback behavior. No security, compatibility, or logic issues. LGTM |
|
I have read the CLA Document and I hereby sign the CLA |
penalosa
left a comment
penalosa
left a comment
There was a problem hiding this comment.
Approved, but can you reword the comments and description to reflect the actual problem this is solving?
4 participants
The
Configure Googlesource credentialssteps insetup-runnercurrently run whenevergithub.event.pull_request.head.repo.fork == false. Dependabot PRs satisfy that condition (their branches live in-repo), but Dependabot-triggered workflows don't have access to repository Actions secrets, soinputs.GOOGLESOURCE_COOKIEresolves to an empty string. We still rewritechromium.googlesource.comto the authenticated/a/endpoint and write an empty cookie, and Bazel then fails every dependency fetch with:This broke every Dependabot PR, e.g. #6418.
This PR switches to gate the credential setup on the cookie actually being present, instead of just whetehr it's a fork.
When the cookie is empty (forks, Dependabot, local/manual runs) we skip the rewrite and the cookie file, letting Bazel fall back to the unauthenticated
chromium.googlesource.comendpoint. That endpoint is slower and more rate-limited - which is why #6511 introduced auth - but it works without credentials and is no worse than the state prior to #6511 for these cases.