From 1d41a9c3e653b5abd44a1f55ba713904e657ec6f Mon Sep 17 00:00:00 2001 From: Himanshu Verma Date: Fri, 11 Sep 2026 13:30:09 +0530 Subject: [PATCH] fix(ci): provide PD auth secret to the compose precheck apache/hugegraph#3189 made docker-compose-hstore.yml require HG_PD_AUTH_SECRET_KEY during interpolation, and Hubble in that topology now bind-mounts a generated, gitignored conf/hubble/hstore.local.properties with create_host_path: false. The strict-mode precheck set neither, so compose up failed at interpolation and so did the always() compose down. Generate a masked hex secret next to the admin password, export it through GITHUB_ENV so the log dump and teardown steps interpolate too, and run the upstream set-hubble-pd-password.sh when the source ships it. Older source revisions are unaffected. --- .../_publish_pd_store_server_reusable.yml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/.github/workflows/_publish_pd_store_server_reusable.yml b/.github/workflows/_publish_pd_store_server_reusable.yml index 9b53ca4..466b1b3 100644 --- a/.github/workflows/_publish_pd_store_server_reusable.yml +++ b/.github/workflows/_publish_pd_store_server_reusable.yml @@ -610,6 +610,14 @@ jobs: echo "HUGEGRAPH_ADMIN_PASSWORD=$HUGEGRAPH_ADMIN_PASSWORD" >> "$GITHUB_ENV" export HUGEGRAPH_ADMIN_PASSWORD + # The HStore topology requires the PD REST secret during interpolation, + # so every later compose command (logs, down) needs it too. Older source + # revisions ignore it. Hex keeps it printable ASCII, as Hubble requires. + HG_PD_AUTH_SECRET_KEY="$(openssl rand -hex 24)" + echo "::add-mask::$HG_PD_AUTH_SECRET_KEY" + echo "HG_PD_AUTH_SECRET_KEY=$HG_PD_AUTH_SECRET_KEY" >> "$GITHUB_ENV" + export HG_PD_AUTH_SECRET_KEY + if [ -f "docker/docker-compose-hstore.yml" ] \ && [ -f "docker/docker-compose.dev.yml" ]; then # The current HugeGraph dev file is a thin HStore override. Keep the @@ -634,6 +642,14 @@ jobs: echo "COMPOSE_FILE=$compose_file" >> "$GITHUB_ENV" echo "COMPOSE_DEV_FILE=$compose_dev_file" >> "$GITHUB_ENV" + # Hubble in the HStore topology mounts a gitignored properties file that + # carries the PD secret, with create_host_path: false, so it must exist + # before compose up. Older source revisions mount a tracked file instead. + if [ "$compose_file" = "docker/docker-compose-hstore.yml" ] \ + && [ -f "docker/set-hubble-pd-password.sh" ]; then + bash docker/set-hubble-pd-password.sh hstore + fi + cat > /tmp/hg-ci-patch-server-config.sh <<'PATCH_SERVER' #!/usr/bin/env bash set -euo pipefail