[Backport 1.7.latest] change port bind and add a unittest (#10212)

* change port bind and add a unittest (#10208)

(cherry picked from commit 0c08d7a)

* fix unit tests

* remove ssh-key since schemas repo is public

* fix compare schemas diff

---------

Co-authored-by: Michelle Ark <MichelleArk@users.noreply.github.com>
Co-authored-by: Michelle Ark <michelle.ark@dbtlabs.com>

.changes/unreleased/Security-20240522-094540.yaml

@@ -0,0 +1,6 @@
+kind: Security
+body: Explicitly bind to localhost in docs serve
+time: 2024-05-22T09:45:40.748185-04:00
+custom:
+  Author: ChenyuLInx michelleark
+  Issue: "10209"

.github/workflows/schema-check.yml

@@ -51,7 +51,6 @@ jobs:
         with:
           repository: dbt-labs/schemas.getdbt.com
           ref: 'main'
-          ssh-key: ${{ secrets.SCHEMA_SSH_PRIVATE_KEY }}
           path: ${{ env.SCHEMA_REPO_DIRECTORY }}
 
       - name: Generate current schema
@@ -63,24 +62,11 @@ jobs:
           pip install -r dev-requirements.txt -r editable-requirements.txt
           python scripts/collect-artifact-schema.py --path ${{ env.LATEST_SCHEMA_PATH }}
 
-      # Copy generated schema files into the schemas.getdbt.com repo
-      # Do a git diff to find any changes
-      # Ignore any date or version changes though
       - name: Compare schemas
         run: |
           cp -r ${{ env.LATEST_SCHEMA_PATH }}/dbt ${{ env.SCHEMA_REPO_DIRECTORY }}
           cd ${{ env.SCHEMA_REPO_DIRECTORY }}
-          diff_results=$(git diff -I='*[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[1-2][0-9]|3[0-1])T' \
-          -I='*[0-9]{1}.[0-9]{2}.[0-9]{1}(rc[0-9]|b[0-9]| )' --compact-summary)
-          if [[ $(echo diff_results) ]]; then
-            echo $diff_results
-            echo "Schema changes detected!"
-            git diff -I='*[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[1-2][0-9]|3[0-1])T' \
-              -I='*[0-9]{1}.[0-9]{2}.[0-9]{1}(rc[0-9]|b[0-9]| )' > ${{ env.SCHEMA_DIFF_ARTIFACT }}
-            exit 1
-          else
-            echo "No schema changes detected"
-          fi
+          git diff -I='*[0-9]{4}-[0-9]{2}-[0-9]{2}' -I='*[0-9]+\.[0-9]+\.[0-9]+' --exit-code > ${{ env.SCHEMA_DIFF_ARTIFACT }}
 
       - name: Upload schema diff
         uses: actions/upload-artifact@v4

core/dbt/task/serve.py

@@ -20,7 +20,7 @@ def run(self):
         if self.args.browser:
             webbrowser.open_new_tab(f"http://localhost:{port}")
 
-        with socketserver.TCPServer(("", port), SimpleHTTPRequestHandler) as httpd:
+        with socketserver.TCPServer(("127.0.0.1", port), SimpleHTTPRequestHandler) as httpd:
             click.echo(f"Serving docs at {port}")
             click.echo(f"To access from your browser, navigate to: http://localhost:{port}")
             click.echo("\n\n")

tests/unit/task/docs/test_serve.py

@@ -0,0 +1,23 @@
+from http.server import SimpleHTTPRequestHandler
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+from dbt.task.serve import ServeTask
+
+
+@pytest.fixture
+def serve_task():
+    # Set up
+    task = ServeTask(config=MagicMock(), args=MagicMock())
+    task.config.project_target_path = "."
+    task.args.port = 8000
+    return task
+
+
+def test_serve_bind_to_127(serve_task):
+    serve_task.args.browser = False
+    with patch("dbt.task.serve.socketserver.TCPServer") as patched_TCPServer:
+        patched_TCPServer.return_value = MagicMock()
+        serve_task.run()
+        patched_TCPServer.assert_called_once_with(("127.0.0.1", 8000), SimpleHTTPRequestHandler)