if err != nil && !os.IsNotExist(err) {
				return nil, err
			}
			if os.IsNotExist(err) {
				// Relative path where "/run/secrets" is the default docker path for secrets
				b, err = os.ReadFile(filepath.Join("/run/secrets", env.Get(EnvKMSSecretKeyFile, "")))
			}
			if err != nil {
				return nil, err
			}
			s = string(b)
		} else {
			s = env.Get(EnvKMSSecretKey, "")
		}

    steps:
      - uses: docker://agilepathway/pull-request-label-checker:latest
        with:
          one_of: breaking,security,feature,bug,refactor,upgrade,docs,lang-all,internal

          echo "EOF" >> $GITHUB_ENV
      - name: Comment on PR if check failed
        if: ${{ failure() }}
        uses: actions/github-script@v8
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const output = `
            Some bad merge is found:
            \`\`\`
            ${{ env.OUTPUT }}
            \`\`\`
            `;

        shell: bash

        committer: TensorFlow Release Automation <******@****.***>
        token: ${{ secrets.JENKINS_TOKEN }}
        base: ${{ github.event.inputs.release_branch }}
        branch: ${{ github.event.inputs.release_branch }}-${{ steps.cherrypick.outputs.SHORTSHA }}
        reviewers: learning-to-play
        body: |

      env:
        # Set the DEVELOCITY_ACCESS_KEY so that a Build Scan is generated
        DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
        # Potential stop-gap solution for ReadTimeout issues with the Gradle Build Cache
        # https://gradle.slack.com/archives/CHDLT99C6/p1636477584059200
        GRADLE_OPTS: -Dhttp.keepAlive=false

import logging
import secrets
import subprocess
import time
from collections import Counter
from collections.abc import Container
from datetime import datetime, timedelta, timezone
from pathlib import Path
from typing import Any, Union

import httpx
import yaml
from github import Github
from pydantic import BaseModel, SecretStr
from pydantic_settings import BaseSettings

github_graphql_url = "https://api.github.com/graphql"

## Notes

Lorsque vous renvoyez une `Response` directement, ses données ne sont pas validées, converties (sérialisées), ni documentées automatiquement.

Mais vous pouvez toujours les documenter comme décrit dans [Additional Responses in OpenAPI](additional-responses.md){.internal-link target=_blank}.

provide the password via:

```
export MINIO_KMS_KES_KEY_PASSWORD=<your-password>
```

Note that MinIO only supports encrypted private keys - not encrypted certificates.
Certificates are no secrets and sent in plaintext as part of the TLS handshake.

## Explore Further

- [Use `mc` with MinIO Server](https://docs.min.io/community/minio-object-store/reference/minio-mc.html)

  cancel-in-progress: false

env:
  # Set the DEVELOCITY_ACCESS_KEY so that a Build Scan is generated
  DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
  # Enable debug for the `gradle-build-action` cache operations
  GRADLE_BUILD_ACTION_CACHE_DEBUG_ENABLED: true

permissions: {}

jobs:
  build:
    name: "Compile All"