Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ansible: promote releases to r2 via actions #3931

Closed
wants to merge 2 commits into from

Conversation

flakey5
Copy link
Member

@flakey5 flakey5 commented Oct 10, 2024

See #3838 (comment)

Pre-reqs:

cc @ovflowd @richardlau

See nodejs#3838

Signed-off-by: flakey5 <73616808+flakey5@users.noreply.github.com>
Copy link
Member

@ovflowd ovflowd left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, did you test this works?

Signed-off-by: flakey5 <73616808+flakey5@users.noreply.github.com>
@ovflowd
Copy link
Member

ovflowd commented Oct 21, 2024

cc @targos @richardlau we wanted to aim release of this before NodeConf 🙏

@UlisesGascon
Copy link
Member

We had a Build meeting today (recording and meeting notes) and the consensus from the team seems to be avoid adding GH credentials in the server due security concerns.

Note: Relevant discussion starts on 15:00 aprox

Copy link
Member

@richardlau richardlau left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

To expand on today's Build WG meeting discussion -- I'm not keen on adding GitHub credentials onto the www server if we can avoid it (and I think this is no longer needed after #3840).

I consider the www server to be one of the top attack targets in terms of Node.js infrastructure, so I would like to minimize the access a potential attacker might gain if they were to somehow get onto the system (obviously we'll do our best that they do not!).

@flakey5 flakey5 closed this Oct 30, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants