Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
ti-chi-bot
Bot
added
missing-translation-status
|
Companion website PR: pingcap/website-docs#736 That PR adds Product > TiDB Cloud Filesystem after TiDB Cloud Lake, plus the Please merge this content and let it propagate to |
📝 WalkthroughWalkthroughAdds a complete TiDB Cloud Filesystem documentation set. It covers setup, direct CLI access, local and container mounts, authorization, sharing, and layer/checkpoint workflows. It also adds navigation links from the AI documentation. ChangesTiDB Cloud Filesystem documentation
Priority: ⬇️ Low Estimated code review effort: 2 (Simple) | ~15 minutes Change: Other Merge Risk: 🔵 Low · up to Filesystem documentation entry points need a valid deployed route, and the Docker instructions should clarify that read-only mounts do not replace token permissions. These are localized documentation corrections before publication. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 411618d2-681d-4647-9206-a1ec4fdfed88
📒 Files selected for processing (11)
TOC-tidb-cloud-filesystem.mdai/_index.mdtidb-cloud-filesystem/_index.mdtidb-cloud-filesystem/filesystem-authorization.mdtidb-cloud-filesystem/filesystem-branches-checkpoints.mdtidb-cloud-filesystem/filesystem-mount-docker.mdtidb-cloud-filesystem/filesystem-mount-linux.mdtidb-cloud-filesystem/filesystem-mount-macos.mdtidb-cloud-filesystem/filesystem-mount.mdtidb-cloud-filesystem/filesystem-quick-start.mdtidb-cloud-filesystem/filesystem-sharing.md
Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.
| ls "$HOME/workspace" | ||
| ``` | ||
|
|
||
| For a token restricted to a subtree, add the matching `--remote-path`, for example `/workspace`. Add `--read-only` for a read-only token. Keep the application and mount under the same OS user. If your application image uses a non-root user, install dependencies while building the image and mount as the application user at runtime. |
There was a problem hiding this comment.
🔒 Security & Privacy | 🛡️ Analyzed with Security Review | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- target context ---'
sed -n '85,115p' tidb-cloud-filesystem/filesystem-mount-docker.md
printf '%s\n' '--- relevant definitions and references ---'
rg -n -C 3 --glob '!node_modules' --glob '!dist' --glob '!build' -- '--read-only|remote-path|read.only|token' .Repository: pingcap/docs
Length of output: 50371
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- target ---'
sed -n '96,110p' tidb-cloud-filesystem/filesystem-mount-docker.md
printf '%s\n' '--- mount reference ---'
sed -n '1,125p' ai/ti/reference/ti-fs-mount-file-system.md
printf '%s\n' '--- scoped-token reference ---'
sed -n '1,110p' ai/ti/reference/ti-fs-generate-file-system-scoped-token.mdRepository: pingcap/docs
Length of output: 11087
Security Misconfiguration
Reachability: External
Exploitability: Moderate
CWE: CWE-732 — Incorrect Permission Assignment for Critical Resource
Keep token permissions separate from --read-only.
--read-only only makes the local mount read-only. It does not make the token read-only or replace the token's server-enforced permissions.
Committable replacement
- For a token restricted to a subtree, add the matching `--remote-path`, for example `/workspace`. Add `--read-only` for a read-only token. Keep the application and mount under the same OS user. If your application image uses a non-root user, install dependencies while building the image and mount as the application user at runtime.
+ For a token restricted to a subtree, add the matching `--remote-path`, for example `/workspace`. Add `--read-only` to prevent local write attempts; it does not replace the token's server-enforced permissions. Keep the application and mount under the same OS user. If your application image uses a non-root user, install dependencies while building the image and mount as the application user at runtime.📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| For a token restricted to a subtree, add the matching `--remote-path`, for example `/workspace`. Add `--read-only` for a read-only token. Keep the application and mount under the same OS user. If your application image uses a non-root user, install dependencies while building the image and mount as the application user at runtime. | |
| For a token restricted to a subtree, add the matching `--remote-path`, for example `/workspace`. Add `--read-only` to prevent local write attempts; it does not replace the token's server-enforced permissions. Keep the application and mount under the same OS user. If your application image uses a non-root user, install dependencies while building the image and mount as the application user at runtime. |
| - [Introduction](/tidb-cloud-filesystem/_index.md) | ||
| - [Quick Start](/tidb-cloud-filesystem/filesystem-quick-start.md) | ||
| - Mounting Locally | ||
| - [Overview](/tidb-cloud-filesystem/filesystem-mount.md) | ||
| - [Linux](/tidb-cloud-filesystem/filesystem-mount-linux.md) | ||
| - [macOS](/tidb-cloud-filesystem/filesystem-mount-macos.md) | ||
| - [Docker and Docker Compose](/tidb-cloud-filesystem/filesystem-mount-docker.md) |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Fix the Filesystem TOC links or add the published route mapping. The link checker sends /tidb-cloud-filesystem/... directly to https://docs.pingcap.com/tidb-cloud-filesystem/..., and the tested entry points return 404. The proposed /tidbcloudfs/ path also currently returns 404, so use the actual deployed route or add a redirect before changing these links.
1 participant
What is changed, added or deleted? (Required)
Add dedicated English documentation for TiDB Cloud Filesystem in public preview, using the TiDB Cloud CLI (
ti) throughout.TOC-tidb-cloud-filesystem.mdand link the product introduction from the AI overview. Reuse existing CLI reference, regions, and troubleshooting pages.Validation: Markdown lint passed for all changed pages and the TOC. Local validation covered internal links, shell example syntax, CLI flags, and the sidebar structure. An isolated Gatsby production preview containing the Filesystem and AI pages built successfully.
Publishing: the companion website change adds Product > TiDB Cloud Filesystem after TiDB Cloud Lake and publishes these pages under
/tidbcloud-filesystem/. Merge these docs and propagate them todocs-stagingbefore deploying that navigation.Which TiDB version(s) do your changes apply to? (Required)
Tips for choosing the affected version(s):
By default, CHOOSE MASTER ONLY so your changes will be applied to the next TiDB major or minor releases. If your PR involves a product feature behavior change or a compatibility change, CHOOSE THE AFFECTED RELEASE BRANCH(ES) AND MASTER.
For details, see tips for choosing the affected versions.
What is the related PR or file link(s)?
/tidbcloud-filesystem/routing); https://github.com/tidbcloud/ti-cliAI agent involvement
Do your changes match any of the following descriptions?
Summary by CodeRabbit