Skip to content

Commit 8056186

Browse files
authored
Remove validate-quick-start-module workflow and the create-issue step (#2081)
## Summary Two cleanups to the quick start GitHub Actions workflows: 1. **Delete `validate-quick-start-module.yml`** — this validation workflow is no longer needed here. Validation is done here: https://github.com/pytorch/test-infra/blob/main/.github/workflows/validate-binaries.yml after every RC, before and after the Release 3. **Remove the "Create Issue if failed" step** from `update-quick-start-module.yml`. ### Why remove the create-issue step The step used `dacbd/create-issue-action@main` and passed it `secrets.PYTORCHBOT_TOKEN`: ```yaml - name: Create Issue if failed uses: dacbd/create-issue-action@main if: ${{ failure() }} with: token: ${{secrets.PYTORCHBOT_TOKEN}} ``` This is a supply-chain exposure: - The action is pinned to a **mutable `@main` ref**, so any future (or compromised) commit runs in our job. - It receives a **long-lived broad PAT** (`PYTORCHBOT_TOKEN`), far more privileged than opening an issue requires. A malicious version could exfiltrate it; the `pytorchbot-env` environment gates *release* of the secret but does not stop the third-party action from reading it once the job runs. Since the failure is already visible from the scheduled run's status, the step isn't needed — removing it is the simplest fix and eliminates the exposure. The `Create Pull Request` step is unchanged (it legitimately needs a PAT so the PR triggers CI). This PR was authored with the assistance of an AI coding assistant.
1 parent 5598012 commit 8056186

2 files changed

Lines changed: 0 additions & 40 deletions

File tree

.github/workflows/update-quick-start-module.yml

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -104,15 +104,6 @@ jobs:
104104
printf '%s\n' "$MACOS_RELEASE_MATRIX" > macos_release_matrix.json
105105
python3 ./scripts/gen_quick_start_module.py --autogenerate > assets/quick-start-module.js
106106
rm *_matrix.json
107-
- name: Create Issue if failed
108-
uses: dacbd/create-issue-action@main
109-
if: ${{ failure() }} # only run when this job is failed.
110-
with:
111-
title: Updating quick start module failed
112-
token: ${{secrets.PYTORCHBOT_TOKEN}}
113-
assignees: ${{github.actor}}
114-
labels: bug
115-
body: Updating quick start module failed, please fix update quick start module
116107
- name: Create Pull Request
117108
uses: peter-evans/create-pull-request@v3
118109
with:

.github/workflows/validate-quick-start-module.yml

Lines changed: 0 additions & 31 deletions
This file was deleted.

0 commit comments

Comments
 (0)