fix(ci): provide PD auth secret to the compose precheck

[bitflicker64]

Problem

The scheduled latest publish has failed on master two nights running, at Start compose stack with local images:

error while interpolating services.pd.environment.HG_PD_AUTH_SECRET_KEY: required variable HG_PD_AUTH_SECRET_KEY is missing a value: set HG_PD_AUTH_SECRET_KEY in .env; see docker/README.md

Stop compose stack fails right after with the same message, because docker compose down interpolates the same files. That one is a follow-on failure: the stack never started.

apache/hugegraph#3189 (60c8803, merged 2026-09-09 14:09 UTC) put the PD REST API behind HTTP Basic auth and changed docker/docker-compose-hstore.yml in two ways that matter here:

1. pd and server read ${HG_PD_AUTH_SECRET_KEY:?...}, so compose refuses to render the file without it.
2. hubble now bind-mounts conf/hubble/hstore.local.properties with create_host_path: false. That file is gitignored. docker/set-hubble-pd-password.sh generates it and writes the secret in as operations.pd.password.

The precheck does neither. Setting only the variable is not enough. Against 60c8803, with the secret exported and no generated file, creating the Hubble container fails:

Error response from daemon: invalid mount config for type "bind": bind source path does not exist: .../docker/conf/hubble/hstore.local.properties

Fix

Both changes are in Start compose stack with local images:

• Generate a hex secret next to the admin password, mask it, and write it to GITHUB_ENV. The log dump and teardown steps run their own compose commands, so they need it as well. Hex also meets the printable ASCII requirement in set-hubble-pd-password.sh.
• After the compose file is chosen, run docker/set-hubble-pd-password.sh hstore when the HStore topology is in use and the source ships the script.

Source revisions from before apache/hugegraph#3189 ignore the extra variable and have no script, so release builds of older tags take the same path as before.

Impact

Scheduled latest publish on master since the upstream change:

• 2026-09-10 00:57 UTC, run 34423470171, failure
• 2026-09-11 00:54 UTC, run 34548480674, failure

The last green scheduled run on master was 2026-09-09 01:09 UTC (run 34298003705), about 13 hours before apache/hugegraph#3189 merged. Neither failed run pushed images.

Verification

• actionlint 1.7.12, with its bundled shellcheck, passes on the changed workflow.
• Local run on Docker 29.4.0 and Compose v5.1.2 against the docker/ directory of apache/hugegraph@60c8803. I extracted the Start and Stop run: blocks from this branch and ran them with bash --noprofile --norc -eo pipefail. Building the images was out of scope, so the final up -d --wait was narrowed to up --no-deps --no-start hubble.
  • Start exited 0, wrote HG_PD_AUTH_SECRET_KEY to GITHUB_ENV, and generated hstore.local.properties with a matching operations.pd.password. The Hubble container was created with that file mounted.
  • Stop, with its environment loaded only from GITHUB_ENV, exited 0 and left no containers, networks or volumes behind.
• Still unexercised: the full stack on images built from 60c8803, which is where PD checks the secret sent by the Server's wait-storage.sh and by Hubble. A workflow_dispatch run of this change with publish off, like the cx-pr-30-e2e run for fix(ci): base compose stack on hstore topology #30, would cover it.

Summary by CodeRabbit

• 改进
  • 多架构发布流程现在会自动生成并安全处理认证密钥。
  • 启动 HStore 拓扑前会预先配置所需的 PD 密钥，提升部署流程的可靠性。

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 9a1e79d3-b0d2-4b75-a21a-69b5afcdda62

📥 Commits

Reviewing files that changed from the base of the PR and between 81bf2ec and 1d41a9c.

📒 Files selected for processing (1)

• .github/workflows/_publish_pd_store_server_reusable.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

工作流现在为 HStore 拓扑生成并导出 PD 密钥，并在 compose up 前创建带有该密钥的密码属性文件。

Changes

HStore 发布流程

Layer / File(s)	Summary
生成并导出 PD 密钥 .github/workflows/_publish_pd_store_server_reusable.yml	工作流使用 openssl rand -hex 24 生成 HG_PD_AUTH_SECRET_KEY，对密钥进行掩码，并写入 $GITHUB_ENV。
准备 HStore 密码文件 .github/workflows/_publish_pd_store_server_reusable.yml	当使用 HStore Compose 文件且密码脚本存在时，工作流在 compose up 前执行 bash docker/set-hubble-pd-password.sh hstore。

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Suggested reviewers: imbajin

Merge Risk: ⚪ Minimal · up to 1d41a

The CI precheck now prepares the PD authentication secret and HStore password file before Compose starts, while retaining compatibility with source revisions that lack the helper.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	标题准确概括了主要变更：为 compose precheck 提供 PD 认证密钥。标题简洁、明确，并与 CI 修复内容相关。
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{小兔挥爪造密钥，
随机字符闪闪亮。
HStore 启动先备妥，
密码文件藏稳当。
Compose 顺利向前跑。}

_{Comment @coderabbitai help to get the list of available commands.}