Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
ti-chi-bot
Bot
added
missing-translation-status
|
Companion website PR: pingcap/website-docs#736 That PR adds Product > TiDB Cloud Filesystem after TiDB Cloud Lake, plus the Please merge this content and let it propagate to |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdds a TiDB Cloud Filesystem documentation area with quick-start, authorization, sharing, mounting, layers, automation, CLI, and troubleshooting guides. Updates existing AI and CLI documentation links, titles, prerequisites, and legacy aliases. ChangesTiDB Cloud Filesystem documentation
Priority: ➖ Normal Estimated code review effort: 3 (Moderate) | ~25 minutes Change: Other Merge Risk: 🔵 Low · up to Users following the new guides may encounter authorization failures or misunderstand read-only protection, while older Filesystem bookmarks may lead to a 404. The issues are localized documentation and routing fixes, so the change remains low merge risk. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 411618d2-681d-4647-9206-a1ec4fdfed88
📒 Files selected for processing (11)
TOC-tidb-cloud-filesystem.mdai/_index.mdtidb-cloud-filesystem/_index.mdtidb-cloud-filesystem/filesystem-authorization.mdtidb-cloud-filesystem/filesystem-branches-checkpoints.mdtidb-cloud-filesystem/filesystem-mount-docker.mdtidb-cloud-filesystem/filesystem-mount-linux.mdtidb-cloud-filesystem/filesystem-mount-macos.mdtidb-cloud-filesystem/filesystem-mount.mdtidb-cloud-filesystem/filesystem-quick-start.mdtidb-cloud-filesystem/filesystem-sharing.md
Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.
| ls "$HOME/workspace" | ||
| ``` | ||
|
|
||
| For a token restricted to a subtree, add the matching `--remote-path`, for example `/workspace`. Add `--read-only` for a read-only token. Keep the application and mount under the same OS user. If your application image uses a non-root user, install dependencies while building the image and mount as the application user at runtime. |
There was a problem hiding this comment.
🔒 Security & Privacy | 🛡️ Analyzed with Security Review | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- target context ---'
sed -n '85,115p' tidb-cloud-filesystem/filesystem-mount-docker.md
printf '%s\n' '--- relevant definitions and references ---'
rg -n -C 3 --glob '!node_modules' --glob '!dist' --glob '!build' -- '--read-only|remote-path|read.only|token' .Repository: pingcap/docs
Length of output: 50371
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- target ---'
sed -n '96,110p' tidb-cloud-filesystem/filesystem-mount-docker.md
printf '%s\n' '--- mount reference ---'
sed -n '1,125p' ai/ti/reference/ti-fs-mount-file-system.md
printf '%s\n' '--- scoped-token reference ---'
sed -n '1,110p' ai/ti/reference/ti-fs-generate-file-system-scoped-token.mdRepository: pingcap/docs
Length of output: 11087
Security Misconfiguration
Reachability: External
Exploitability: Moderate
CWE: CWE-732 — Incorrect Permission Assignment for Critical Resource
Keep token permissions separate from --read-only.
--read-only only makes the local mount read-only. It does not make the token read-only or replace the token's server-enforced permissions.
Committable replacement
- For a token restricted to a subtree, add the matching `--remote-path`, for example `/workspace`. Add `--read-only` for a read-only token. Keep the application and mount under the same OS user. If your application image uses a non-root user, install dependencies while building the image and mount as the application user at runtime.
+ For a token restricted to a subtree, add the matching `--remote-path`, for example `/workspace`. Add `--read-only` to prevent local write attempts; it does not replace the token's server-enforced permissions. Keep the application and mount under the same OS user. If your application image uses a non-root user, install dependencies while building the image and mount as the application user at runtime.📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| For a token restricted to a subtree, add the matching `--remote-path`, for example `/workspace`. Add `--read-only` for a read-only token. Keep the application and mount under the same OS user. If your application image uses a non-root user, install dependencies while building the image and mount as the application user at runtime. | |
| For a token restricted to a subtree, add the matching `--remote-path`, for example `/workspace`. Add `--read-only` to prevent local write attempts; it does not replace the token's server-enforced permissions. Keep the application and mount under the same OS user. If your application image uses a non-root user, install dependencies while building the image and mount as the application user at runtime. |
| - [Introduction](/tidb-cloud-filesystem/_index.md) | ||
| - [Quick Start](/tidb-cloud-filesystem/filesystem-quick-start.md) | ||
| - Mounting Locally | ||
| - [Overview](/tidb-cloud-filesystem/filesystem-mount.md) | ||
| - [Linux](/tidb-cloud-filesystem/filesystem-mount-linux.md) | ||
| - [macOS](/tidb-cloud-filesystem/filesystem-mount-macos.md) | ||
| - [Docker and Docker Compose](/tidb-cloud-filesystem/filesystem-mount-docker.md) |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Fix the Filesystem TOC links or add the published route mapping. The link checker sends /tidb-cloud-filesystem/... directly to https://docs.pingcap.com/tidb-cloud-filesystem/..., and the tested entry points return 404. The proposed /tidbcloudfs/ path also currently returns 404, so use the actual deployed route or add a redirect before changing these links.
There was a problem hiding this comment.
Actionable comments posted: 2
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Advanced
Run ID: ab0232fb-b46d-4568-903c-c012a20583d3
📒 Files selected for processing (29)
TOC-ai.mdTOC-tidb-cloud-filesystem.mdai/_index.mdai/ti/guides/manage-filesystems-via-cli.mdai/ti/guides/ti-agent-sandbox-example.mdai/ti/guides/ti-ci-artifact-handoff-example.mdai/ti/reference/ti-filesystem-git.mdai/ti/reference/ti-filesystem-journal.mdai/ti/reference/ti-filesystem-vault.mdai/ti/reference/ti-filesystem.mdai/ti/reference/ti-install-configure-update.mdai/ti/reference/ti-migrate-from-tdc.mdai/ti/reference/ti-troubleshooting.mdai/ti/ti-overview.mdai/ti/ti-quick-start.mdtidb-cloud-filesystem/configure-filesystem-ai-providers.mdtidb-cloud-filesystem/filesystem-authorization.mdtidb-cloud-filesystem/filesystem-branches-checkpoints.mdtidb-cloud-filesystem/filesystem-mount-linux.mdtidb-cloud-filesystem/filesystem-mount.mdtidb-cloud-filesystem/manage-filesystem-layers.mdtidb-cloud-filesystem/manage-filesystem-resources.mdtidb-cloud-filesystem/manage-filesystem-tokens.mdtidb-cloud-filesystem/manage-filesystem-vault-secrets.mdtidb-cloud-filesystem/manage-git-workspaces.mdtidb-cloud-filesystem/mount-filesystem.mdtidb-cloud-filesystem/use-filesystem-for-automation-and-ai-agents.mdtidb-cloud-filesystem/use-filesystem-journals.mdtidb-cloud-filesystem/work-with-filesystem-data.md
Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to GitHub limitations.
🟡 Minor · Document the owner-token requirement for fork-layer. · manage-filesystem-layers.md:16
tidb-cloud-filesystem/manage-filesystem-layers.md:16
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winDocument the owner-token requirement for
fork-layer.The scoped-token contract excludes
fork, so a scoped token withwritepermission cannot run the documentedfork-layercommand. Commands can also require multiple operations, so the proposedread/listversuswritemapping is not complete.Suggested replacement
- For the commands below, set `TI_FS_FILE_SYSTEM_ID` to the Filesystem ID and use its locally stored FS token. Alternatively, set `TI_FS_TOKEN` and `TI_REGION_CODE` for token-only access; the token identifies the Filesystem. To select a Filesystem per command instead, add `--file-system-id "<file-system-id>"` to each command. Use a token with the required read or write permission. See [Authorization](/tidb-cloud-filesystem/filesystem-authorization.md#understand-local-selection) for selection details. + For the commands below, set `TI_FS_FILE_SYSTEM_ID` to the Filesystem ID and use its locally stored FS token. Alternatively, set `TI_FS_TOKEN` and `TI_REGION_CODE` for token-only access; the token identifies the Filesystem. To select a Filesystem per command instead, add `--file-system-id "<file-system-id>"` to each command. Use an owner FS token for `fork-layer`. For other commands, an owner FS token has the required access; a scoped token must include every operation required by the command. Some commands require multiple operations, such as `read` on a remote copy source and `write` on its destination. See [Authorization](/tidb-cloud-filesystem/filesystem-authorization.md#understand-local-selection) for selection details.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 4fca0261-5363-45ab-a44e-aa7909e1c88e
📒 Files selected for processing (24)
TOC-ai.mdTOC-tidb-cloud-filesystem.mdai/_index.mdai/ti/guides/manage-filesystems-via-cli.mdai/ti/guides/ti-agent-sandbox-example.mdai/ti/reference/ti-filesystem.mdai/ti/reference/ti-install-configure-update.mdai/ti/reference/ti-troubleshooting.mdai/ti/ti-overview.mdtidb-cloud-filesystem/_index.mdtidb-cloud-filesystem/configure-filesystem-ai-providers.mdtidb-cloud-filesystem/filesystem-authorization.mdtidb-cloud-filesystem/filesystem-branches-checkpoints.mdtidb-cloud-filesystem/filesystem-mount-linux.mdtidb-cloud-filesystem/filesystem-mount-macos.mdtidb-cloud-filesystem/filesystem-mount.mdtidb-cloud-filesystem/filesystem-quick-start.mdtidb-cloud-filesystem/filesystem-sharing.mdtidb-cloud-filesystem/manage-filesystem-layers.mdtidb-cloud-filesystem/manage-filesystem-resources.mdtidb-cloud-filesystem/manage-filesystem-tokens.mdtidb-cloud-filesystem/manage-git-workspaces.mdtidb-cloud-filesystem/use-filesystem-for-automation-and-ai-agents.mdtidb-cloud-filesystem/work-with-filesystem-data.md
Included review availability: Your plan provides up to 4 included reviews per hour; 2 remain after this review.
| - Select the mounted Filesystem by passing `--file-system-id`, setting `TI_FS_FILE_SYSTEM_ID`, or supplying an FS token that identifies it. Provide an FS token with Git workspace permissions. | ||
| - [Install TiDB Cloud CLI](/tidb-cloud-filesystem/filesystem-quick-start.md#step-1-install-the-cli). | ||
| - [Mount a TiDB Cloud Filesystem](/tidb-cloud-filesystem/filesystem-mount.md) through FUSE. | ||
| - For the commands below, set `TI_FS_FILE_SYSTEM_ID` to the mounted Filesystem ID and use its locally stored FS token. Alternatively, set `TI_FS_TOKEN` and `TI_REGION_CODE` for token-only access; the token identifies the Filesystem. To select a Filesystem per command instead, add `--file-system-id "<file-system-id>"` to each command. Use a token with Git workspace permissions. See [Authorization](/tidb-cloud-filesystem/filesystem-authorization.md#understand-local-selection) for selection details. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🔎 Supported by static analysis
🏁 Script executed:
set -eu
printf '%s\n' '--- candidate files ---'
fd -i 'filesystem-authorization|manage-git-workspaces' .
printf '%s\n' '--- references to ti fs-git and Git workspace permissions ---'
rg -n -C 3 'ti fs-git|Git workspace permissions|file-system-id|TI_FS_TOKEN|TI_REGION_CODE|operation.*read|operation.*list|operation.*search|operation.*write|operation.*delete' --glob '*.md' --glob '*.mdx' --glob '*.go' --glob '*.ts' --glob '*.js' --glob '*.yaml' --glob '*.yml' .Repository: pingcap/docs
Length of output: 50371
🤖 get_repo_knowledge executed:
get_repo_knowledge pingcap/docs /tmp/coderabbit-repo-knowledge/pingcap-docs-9c73f70c/conventions /tmp/coderabbit-repo-knowledge/pingcap-docs-9c73f70c/learnings
Length of output: 4452
🏁 Script executed:
set -eu
printf '%s\n' '--- manage-git-workspaces.md ---'
sed -n '1,35p' tidb-cloud-filesystem/manage-git-workspaces.md
printf '%s\n' '--- filesystem-authorization.md ---'
sed -n '1,260p' tidb-cloud-filesystem/filesystem-authorization.md
printf '%s\n' '--- bound ti fs-git reference ---'
sed -n '1,120p' ai/ti/reference/ti-fs-git-clone-git-workspace.md
printf '%s\n' '--- scoped terms in relevant docs ---'
rg -n -i -C 3 'read|list|search|write|delete|permission|scope|token' tidb-cloud-filesystem ai/ti/reference/ti-fs-git*.mdRepository: pingcap/docs
Length of output: 50371
🏁 Script executed:
set -eu
printf '%s\n' '--- remaining manage-git-workspaces.md ---'
sed -n '35,220p' tidb-cloud-filesystem/manage-git-workspaces.md
printf '%s\n' '--- Git workspace command reference and scope-related matches ---'
sed -n '1,240p' ai/ti/reference/ti-filesystem-git.md
rg -n -i -C 4 'scoped|scope|permission|requires|read|list|search|write|delete|token' \
ai/ti/reference/ti-fs-git-*.md \
ai/ti/reference/ti-filesystem-git.md \
ai/ti/guides \
tidb-cloud-filesystem \
--glob '*.md' | grep -i -E 'git|workspace|scope|permission|requires|read|list|search|write|delete|token' | head -n 400Repository: pingcap/docs
Length of output: 50370
🏁 Script executed:
set -eu
printf '%s\n' '--- tracked implementation candidates ---'
git ls-files | rg -i '(^|/)(ti|cli|filesystem|fs-git|authorization|permissions?)(/|[-_.])|fs-git|filesystem' | rg -v '(^|/)(docs?|tidb-cloud-filesystem|ai/ti/|resources/)' | head -n 300
printf '%s\n' '--- exact Git workspace permission references outside the already inspected docs ---'
rg -n -i -C 3 'Git workspace permissions|fs-git.*(read|list|search|write|delete)|((read|list|search|write|delete).*)fs-git|scoped token.*Git|Git.*scoped token' . \
--glob '!tidb-cloud-filesystem/filesystem-authorization.md' \
--glob '!tidb-cloud-filesystem/manage-git-workspaces.md' \
--glob '!ai/ti/reference/ti-fs-git-*.md' \
--glob '!ai/ti/reference/ti-filesystem-git.md' \
--glob '!**/node_modules/**' | head -n 300Repository: pingcap/docs
Length of output: 2705
🏁 Script executed:
set -eu
printf '%s\n' '--- scoped-token reference ---'
sed -n '1,90p' ai/ti/reference/ti-fs-generate-file-system-scoped-token.md
printf '%s\n' '--- Git workspace guide prerequisites ---'
sed -n '1,55p' ai/ti/guides/ti-git-workspace-for-agents-example.mdRepository: pingcap/docs
Length of output: 7077
Require an owner FS token for Git workspace commands.
Scoped tokens support read, list, search, write, and delete, but the CLI reference states that Git workspace APIs are not available to scoped tokens. Document the required owner-token credential instead.
| - For the commands below, set `TI_FS_FILE_SYSTEM_ID` to the mounted Filesystem ID and use its locally stored FS token. Alternatively, set `TI_FS_TOKEN` and `TI_REGION_CODE` for token-only access; the token identifies the Filesystem. To select a Filesystem per command instead, add `--file-system-id "<file-system-id>"` to each command. Use a token with Git workspace permissions. See [Authorization](/tidb-cloud-filesystem/filesystem-authorization.md#understand-local-selection) for selection details. | |
| - For the commands below, set `TI_FS_FILE_SYSTEM_ID` to the mounted Filesystem ID and use its locally stored FS token. Alternatively, set `TI_FS_TOKEN` and `TI_REGION_CODE` for token-only access; the token identifies the Filesystem. To select a Filesystem per command instead, add `--file-system-id "<file-system-id>"` to each command. Use an owner FS token for these commands. See [Authorization](/tidb-cloud-filesystem/filesystem-authorization.md#owner-fs-tokens) for credential details. |
Source: Path instructions
c8f747f to
ccdb675
Compare
2 participants
What is changed, added or deleted? (Required)
Add dedicated English documentation for TiDB Cloud Filesystem in public preview, using the TiDB Cloud CLI (
ti) throughout.TOC-tidb-cloud-filesystem.mdand link the product introduction from the AI overview. Reuse existing CLI reference, regions, and troubleshooting pages.Validation: Markdown lint passed for all changed pages and the TOC. Local validation covered internal links, shell example syntax, CLI flags, and the sidebar structure. An isolated Gatsby production preview containing the Filesystem and AI pages built successfully.
Publishing: the companion website change adds Product > TiDB Cloud Filesystem after TiDB Cloud Lake and publishes these pages under
/tidbcloud-filesystem/. Merge these docs and propagate them todocs-stagingbefore deploying that navigation.Which TiDB version(s) do your changes apply to? (Required)
Tips for choosing the affected version(s):
By default, CHOOSE MASTER ONLY so your changes will be applied to the next TiDB major or minor releases. If your PR involves a product feature behavior change or a compatibility change, CHOOSE THE AFFECTED RELEASE BRANCH(ES) AND MASTER.
For details, see tips for choosing the affected versions.
What is the related PR or file link(s)?
/tidbcloud-filesystem/routing); https://github.com/tidbcloud/ti-cliAI agent involvement
Do your changes match any of the following descriptions?
Summary by CodeRabbit
New Features
Documentation