[DNM] Add dummy task, pipeline, and ITS for EC-2011 POC - #3476
[DNM] Add dummy task, pipeline, and ITS for EC-2011 POC#3476simonbaird wants to merge 11 commits into
Conversation
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Enterprise Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdds a configurable scenario creation script, a snapshot-processing Tekton Pipeline, and a ChangesDummy integration test flow
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant create_dummy_its.sh
participant IntegrationTestScenario
participant reqd_task_poc_ec2011
participant dummy_check
participant AttestationAction
create_dummy_its.sh->>IntegrationTestScenario: Apply scenario with Git resolver parameters
IntegrationTestScenario->>reqd_task_poc_ec2011: Start with SNAPSHOT and RESULT
reqd_task_poc_ec2011->>reqd_task_poc_ec2011: Extract containerImage URL and digest
reqd_task_poc_ec2011->>dummy_check: Pass RESULT and image metadata
dummy_check->>AttestationAction: Pass image metadata and TEST_OUTPUT
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
PR Summary by QodoAdd dummy integration test pipeline/task and ITS bootstrap script (EC-2011 POC)
AI Description
Diagram
High-Level Assessment
Files changed (3)
|
|
🤖 Review · Commit: |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@hack/create-dummy-its.sh`:
- Around line 25-26: In the reqd-task-poc-ec2011 required-task scenario, remove
the test.appstudio.openshift.io/optional label so the scenario is treated as
mandatory. Leave the remaining scenario configuration unchanged.
In `@pipelines/dummy-integration-test/0.1/dummy-integration-test.yaml`:
- Around line 51-64: Update the SNAPSHOT handling around the IMAGE extraction to
parse it as JSON, validate every component’s containerImage and required digest
separator, and reject malformed or missing values. Preserve the
image-url/image-digest contract only if SNAPSHOT is explicitly constrained to
one component; otherwise process and emit all validated components rather than
silently selecting the first one.
In `@tasks/dummy-check/0.1/dummy-check.yaml`:
- Line 66: Replace the mutable ubi-minimal:latest image reference in
tasks/dummy-check/0.1/dummy-check.yaml at lines 66-66 with an approved immutable
digest, and make the same replacement in
pipelines/dummy-integration-test/0.1/dummy-integration-test.yaml at lines 43-43.
Use the identical digest in both files.
- Around line 141-144: Pin every Git resolver revision to an approved immutable
full commit SHA: update the revision default in
tasks/dummy-check/0.1/dummy-check.yaml:141-144,
pipelines/dummy-integration-test/0.1/dummy-integration-test.yaml:81-86, and
hack/create-dummy-its.sh:8-10, replacing branch references such as main and
reqd-task-its-poc. If hack/create-dummy-its.sh enforces GIT_REVISION, validate
that the supplied value is a full commit SHA.
- Around line 122-130: Update the TEST_OUTPUT construction to use a JSON encoder
for RESULT, TIMESTAMP, NOTE, and other string fields so quotes, backslashes, and
newlines are escaped correctly. Validate SUCCESSES, FAILURES, and WARNINGS as
integers before applying %d, terminating the step for invalid values while still
accepting negative integers.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: 2155f7f0-eebb-4e9f-8e6d-45839f9106bf
📒 Files selected for processing (3)
hack/create-dummy-its.shpipelines/dummy-integration-test/0.1/dummy-integration-test.yamltasks/dummy-check/0.1/dummy-check.yaml
| labels: | ||
| test.appstudio.openshift.io/optional: "true" |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- script ---'
cat -n hack/create-dummy-its.sh
printf '%s\n' '--- related references ---'
rg -n -i --glob '!vendor/**' --glob '!node_modules/**' \
'reqd-task-poc-ec2011|test\.appstudio\.openshift\.io/optional|optional.*IntegrationTestScenario|IntegrationTestScenario|required task|required-task' .Repository: conforma/cli
Length of output: 2721
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- dummy integration-test pipeline ---'
cat -n pipelines/dummy-integration-test/0.1/dummy-integration-test.yaml
printf '%s\n' '--- enterprise-contract guidance ---'
sed -n '70,110p' pipelines/enterprise-contract/0.1/enterprise-contract.yaml
printf '%s\n' '--- all optional-label and informative references ---'
rg -n -i 'test\.appstudio\.openshift\.io/optional|informative|required.*task|task.*required|IntegrationTestScenario' \
README.md docs hack pipelines internal config .github 2>/dev/null || trueRepository: conforma/cli
Length of output: 7294
🌐 Web query:
Konflux IntegrationTestScenario test.appstudio.openshift.io/optional label required task semantics
💡 Result:
The label test.appstudio.openshift.io/optional in Konflux is used to control whether an IntegrationTestScenario is mandatory for the release process [1][2]. Its semantics are as follows: - Purpose: It specifies whether the result of a PipelineRun created by the IntegrationTestScenario must be successful for an application snapshot to be considered valid [1][3]. - Values: - "true": The integration test is marked as optional. If the test fails, it does not block the release or promotion of the application snapshot [1][4][3]. - "false": The integration test is mandatory (required). If the test fails, the application snapshot is marked as failed, which prevents its release [1][4][3]. - Default Behavior: If the label is not explicitly defined in an IntegrationTestScenario custom resource, the Konflux Integration Service defaults its value to "false", meaning all integration tests are mandatory by default [1][5][3]. - Propagation: When a test runs, this label is copied from the IntegrationTestScenario resource to the resulting PipelineRun [1][2]. By marking a test as optional, users can allow specific, non-critical tests to fail without hindering the overall automated release process [4][3].
Citations:
- 1: https://konflux-ci.dev/architecture/core/integration-service/
- 2: https://konflux-ci.dev/docs/testing/integration/creating/
- 3: https://konflux-ci.dev/docs/testing/integration/adding/
- 4: https://konflux-ci.dev/docs/testing/integration/editing/
- 5: https://pkg.go.dev/github.com/konflux-ci/integration-service/e2e-tests/pkg/constants
Remove the optional label from the required-task scenario.
The reqd-task-poc-ec2011 scenario must be mandatory to enforce required-task behavior. Remove test.appstudio.openshift.io/optional: "true".
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@hack/create-dummy-its.sh` around lines 25 - 26, In the reqd-task-poc-ec2011
required-task scenario, remove the test.appstudio.openshift.io/optional label so
the scenario is treated as mandatory. Leave the remaining scenario configuration
unchanged.
| IMAGE=$(echo "${SNAPSHOT}" | grep -oP '"containerImage"\s*:\s*"\K[^"]+' | head -1) | ||
| if [[ -z "${IMAGE}" ]]; then | ||
| echo "ERROR: No containerImage found in SNAPSHOT" >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| IMAGE_URL="${IMAGE%%@*}" | ||
| IMAGE_DIGEST="${IMAGE##*@}" | ||
|
|
||
| echo "Parsed image-url: ${IMAGE_URL}" | ||
| echo "Parsed image-digest: ${IMAGE_DIGEST}" | ||
|
|
||
| echo -n "${IMAGE_URL}" > "$(results.image-url.path)" | ||
| echo -n "${IMAGE_DIGEST}" > "$(results.image-digest.path)" |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- candidate files ---'
git ls-files | grep -E '(^|/)(pipelines/dummy-integration-test/0\.1/dummy-integration-test\.yaml|hack/create-dummy-its\.sh)$' || true
printf '%s\n' '--- YAML structure ---'
ast-grep outline pipelines/dummy-integration-test/0.1/dummy-integration-test.yaml --lang yaml || true
printf '%s\n' '--- YAML lines 1-90 ---'
cat -n pipelines/dummy-integration-test/0.1/dummy-integration-test.yaml | sed -n '1,90p'
printf '%s\n' '--- generator script ---'
if test -f hack/create-dummy-its.sh; then cat -n hack/create-dummy-its.sh | sed -n '1,180p'; fi
printf '%s\n' '--- related references ---'
rg -n -C 3 'containerImage|image-url|image-digest|dummy-integration-test|create-dummy-its|SNAPSHOT' pipelines hack README.md 2>/dev/null | sed -n '1,260p'Repository: conforma/cli
Length of output: 24835
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- dummy-check task ---'
fd -i 'dummy-check' . --type f | sort
for f in $(fd -i 'dummy-check' . --type f | sort); do
echo "--- $f ---"
wc -l "$f"
cat -n "$f" | sed -n '1,180p'
done
printf '%s\n' '--- pipeline and task result consumers ---'
rg -n -C 5 'image-digest|image-url|dummy-check|components.*containerImage|containerImage' pipelines tasks .github 2>/dev/null | sed -n '1,320p'
printf '%s\n' '--- deterministic parser probe ---'
python3 - <<'PY'
import json, re, subprocess
script = r'''set -euo pipefail
SNAPSHOT="$1"
IMAGE=$(echo "${SNAPSHOT}" | grep -oP '"containerImage"\s*:\s*"\K[^"]+' | head -1)
if [[ -z "${IMAGE}" ]]; then exit 1; fi
IMAGE_URL="${IMAGE%%@*}"
IMAGE_DIGEST="${IMAGE##*@}"
printf 'url=%s\ndigest=%s\n' "$IMAGE_URL" "$IMAGE_DIGEST"
'''
cases = {
"two components": {"components": [
{"containerImage": "quay.io/a@sha256:aaa"},
{"containerImage": "quay.io/b@sha256:bbb"},
]},
"tag only": {"components": [{"containerImage": "quay.io/a:latest"}]},
"invalid JSON with matching text": 'prefix "containerImage": "quay.io/a@sha256:aaa" suffix',
"escaped quote value": {"components": [{"containerImage": "quay.io/a@sha256:aa\\\"bb"}]},
"missing component image": {"components": [{"name": "a"}]},
}
for name, value in cases.items():
text = value if isinstance(value, str) else json.dumps(value)
p = subprocess.run(["bash", "-c", script, "parser", text], text=True,
capture_output=True)
print(f"[{name}] exit={p.returncode}")
print((p.stdout + p.stderr).strip() or "<no output>")
PYRepository: conforma/cli
Length of output: 24091
Parse and validate every Snapshot component.
Line 51 accepts non-JSON text and processes only the first containerImage. The task forwards one scalar image-url and image-digest pair, despite the contract requiring validation of every component.
If an image has no @, ${IMAGE##*@} writes the complete image reference as image-digest. Parse SNAPSHOT as JSON, validate every component, and either process all components or change the contract to require one component.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pipelines/dummy-integration-test/0.1/dummy-integration-test.yaml` around
lines 51 - 64, Update the SNAPSHOT handling around the IMAGE extraction to parse
it as JSON, validate every component’s containerImage and required digest
separator, and reject malformed or missing values. Preserve the
image-url/image-digest contract only if SNAPSHOT is explicitly constrained to
one component; otherwise process and emit all validated components rather than
silently selecting the first one.
| results: | ||
| - name: TEST_OUTPUT | ||
| description: JSON test results for consumption by subsequent steps. | ||
| image: registry.access.redhat.com/ubi9/ubi-minimal:latest |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Pin executable container images by digest.
Both steps use the mutable latest tag. A later image update can change task behavior without a repository change.
tasks/dummy-check/0.1/dummy-check.yaml#L66-L66: replaceubi-minimal:latestwith an approved immutable digest.pipelines/dummy-integration-test/0.1/dummy-integration-test.yaml#L43-L43: replaceubi-minimal:latestwith the same approved immutable digest.
📍 Affects 2 files
tasks/dummy-check/0.1/dummy-check.yaml#L66-L66(this comment)pipelines/dummy-integration-test/0.1/dummy-integration-test.yaml#L43-L43
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@tasks/dummy-check/0.1/dummy-check.yaml` at line 66, Replace the mutable
ubi-minimal:latest image reference in tasks/dummy-check/0.1/dummy-check.yaml at
lines 66-66 with an approved immutable digest, and make the same replacement in
pipelines/dummy-integration-test/0.1/dummy-integration-test.yaml at lines 43-43.
Use the identical digest in both files.
| TEST_OUTPUT=$(printf '{ | ||
| "result": "%s", | ||
| "timestamp": "%s", | ||
| "note": "%s", | ||
| "namespace": "default", | ||
| "successes": %d, | ||
| "failures": %d, | ||
| "warnings": %d | ||
| }' "${RESULT}" "${TIMESTAMP}" "${NOTE}" "${SUCCESSES}" "${FAILURES}" "${WARNINGS}") |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
file="tasks/dummy-check/0.1/dummy-check.yaml"
printf '%s\n' '--- file outline ---'
if command -v ast-grep >/dev/null 2>&1; then
ast-grep outline "$file" || true
fi
printf '%s\n' '--- relevant task sections ---'
sed -n '1,170p' "$file"
printf '%s\n' '--- TEST_OUTPUT and attestation references ---'
rg -n -C 5 'TEST_OUTPUT|attest|NOTE|SUCCESSES|FAILURES|WARNINGS' tasks/dummy-check/0.1 "$file" tasks 2>/dev/null | head -n 300Repository: conforma/cli
Length of output: 29153
🏁 Script executed:
#!/bin/bash
set -eu
run_case() {
local label="$1"
local note="$2"
local successes="$3"
local failures="$4"
local warnings="$5"
output=$(
printf '{
"result": "%s",
"timestamp": "%s",
"note": "%s",
"namespace": "default",
"successes": %d,
"failures": %d,
"warnings": %d
}' "SUCCESS" "2026-08-01T00:00:00" "$note" "$successes" "$failures" "$warnings" 2>/tmp/printf-error
) || true
printf '%s\t%s\n' "$label" "$output"
if python3 -c 'import json, sys; json.load(sys.stdin)' <<<"$output" 2>/dev/null; then
printf '%s\n' 'JSON_PARSE=valid'
else
printf '%s\n' 'JSON_PARSE=invalid'
fi
if [ -s /tmp/printf-error ]; then
printf 'PRINTF_ERROR=%s\n' "$(cat /tmp/printf-error)"
fi
}
run_case 'plain-note' 'all good' '1' '0' '0'
run_case 'quote-note' 'contains "quote"' '1' '0' '0'
run_case 'newline-note' $'contains\nnewline' '1' '0' '0'
run_case 'backslash-note' 'contains \ backslash' '1' '0' '0'
run_case 'invalid-count' 'all good' 'not-a-number' '0' '0'
run_case 'negative-count' 'all good' '-1' '0' '0'Repository: conforma/cli
Length of output: 1415
🏁 Script executed:
#!/bin/bash
set -u
set +e
bash -c '
set -euo pipefail
TEST_OUTPUT=$(printf "{\n \"successes\": %d\n}\n" "not-a-number")
printf "WRITE_REACHED=%s\n" "$TEST_OUTPUT"
'
status=$?
printf 'COMMAND_STATUS=%d\n' "$status"
bash -c '
set -euo pipefail
TEST_OUTPUT=$(printf "{\n \"successes\": %d\n}\n" "-1")
printf "WRITE_REACHED=%s\n" "$TEST_OUTPUT"
'
status=$?
printf 'NEGATIVE_COMMAND_STATUS=%d\n' "$status"Repository: conforma/cli
Length of output: 280
Serialize TEST_OUTPUT with a JSON encoder. NOTE values containing ", \, or newlines produce invalid JSON for the attestation step. Encode all string fields before constructing the object. Validate SUCCESSES, FAILURES, and WARNINGS as non-negative integers before %d; invalid values terminate the step, while negative values are accepted.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@tasks/dummy-check/0.1/dummy-check.yaml` around lines 122 - 130, Update the
TEST_OUTPUT construction to use a JSON encoder for RESULT, TIMESTAMP, NOTE, and
other string fields so quotes, backslashes, and newlines are escaped correctly.
Validate SUCCESSES, FAILURES, and WARNINGS as integers before applying %d,
terminating the step for invalid values while still accepting negative integers.
| - name: revision | ||
| value: main | ||
| - name: pathInRepo | ||
| value: stepactions/attest-test-result/0.1/attest-test-result.yaml |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
git ls-remote https://github.com/conforma/step-actions main
git ls-remote https://github.com/conforma/cli main
git ls-remote https://github.com/simonbaird/conforma-cli reqd-task-its-pocRepository: conforma/cli
Length of output: 334
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- tracked files ---'
git ls-files \
tasks/dummy-check/0.1/dummy-check.yaml \
pipelines/dummy-integration-test/0.1/dummy-integration-test.yaml \
hack/create-dummy-its.sh
printf '%s\n' '--- task definition ---'
sed -n '130,150p' tasks/dummy-check/0.1/dummy-check.yaml
printf '%s\n' '--- pipeline definition ---'
sed -n '70,95p' pipelines/dummy-integration-test/0.1/dummy-integration-test.yaml
printf '%s\n' '--- generator defaults ---'
sed -n '1,25p' hack/create-dummy-its.sh
printf '%s\n' '--- related resolver inputs ---'
rg -n -C 3 'pathInRepo|GIT_REVISION|reqd-task-its-poc|attest-test-result|dummy-integration-test' \
tasks pipelines hack .github 2>/dev/null || trueRepository: conforma/cli
Length of output: 6509
Pin every Git resolver revision to an immutable commit.
main and reqd-task-its-poc are branch references. Branch updates can change the fetched pipeline or task code without changing this scenario. Replace all three defaults with approved full commit SHAs. Validate GIT_REVISION if the script must enforce immutable revisions.
📍 Affects 3 files
tasks/dummy-check/0.1/dummy-check.yaml#L141-L144(this comment)pipelines/dummy-integration-test/0.1/dummy-integration-test.yaml#L81-L86hack/create-dummy-its.sh#L8-L10
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@tasks/dummy-check/0.1/dummy-check.yaml` around lines 141 - 144, Pin every Git
resolver revision to an approved immutable full commit SHA: update the revision
default in tasks/dummy-check/0.1/dummy-check.yaml:141-144,
pipelines/dummy-integration-test/0.1/dummy-integration-test.yaml:81-86, and
hack/create-dummy-its.sh:8-10, replacing branch references such as main and
reqd-task-its-poc. If hack/create-dummy-its.sh enforces GIT_REVISION, validate
that the supplied value is a full commit SHA.
Code Review by Qodo
1.
|
![qodo-for-conforma[bot]](https://avatars.githubusercontent.com/in/3609154?s=60&v=4){kind=small}
| TEST_OUTPUT=$(printf '{ | ||
| "result": "%s", | ||
| "timestamp": "%s", | ||
| "note": "%s", |
There was a problem hiding this comment.
2. Unescaped note breaks json 🐞 Bug ≡ Correctness
dummy-check builds JSON using printf with the unescaped NOTE parameter, so a NOTE containing quotes/newlines/backslashes produces invalid JSON and can break the attest-test-result step and any downstream consumer expecting parseable JSON.
Agent Prompt
## Issue description
The task constructs JSON with `printf ... "note": "%s" ...` but does not JSON-escape `NOTE`. Any special characters in `NOTE` can invalidate the JSON output, which is then passed as `test-output` to the attestation step.
## Issue Context
The produced JSON is both:
- written to the task result `TEST_OUTPUT`
- passed into the `attest-test-result` step action
## Fix Focus Areas
- tasks/dummy-check/0.1/dummy-check.yaml[84-134]
- tasks/dummy-check/0.1/dummy-check.yaml[145-153]
## Recommended fix
Construct the JSON via a JSON-aware tool rather than `printf`, for example:
- Switch the step image to one that includes `jq` and do:
`TEST_OUTPUT=$(jq -n --arg result "$RESULT" --arg timestamp "$TIMESTAMP" --arg note "$NOTE" --arg ns "$NAMESPACE" --argjson successes "$SUCCESSES" --argjson failures "$FAILURES" --argjson warnings "$WARNINGS" '{result:$result,timestamp:$timestamp,note:$note,namespace:$ns,successes:$successes,failures:$failures,warnings:$warnings}')`
- Or, if you keep bash-only, implement proper JSON string escaping for `NOTE` before interpolation.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
| IMAGE=$(echo "${SNAPSHOT}" | grep -oP '"containerImage"\s*:\s*"\K[^"]+' | head -1) | ||
| if [[ -z "${IMAGE}" ]]; then | ||
| echo "ERROR: No containerImage found in SNAPSHOT" >&2 | ||
| exit 1 |
There was a problem hiding this comment.
3. Only first component validated 🐞 Bug ≡ Correctness
The pipeline description claims each components[].containerImage is validated, but parse-snapshot selects only the first match (head -1) and also doesn’t validate that the image reference contains an @ digest, which can pass incorrect image-url/image-digest into the attestation step.
Agent Prompt
## Issue description
`parse-snapshot` extracts only the first `containerImage` occurrence and splits it with shell substring ops, but the pipeline’s own parameter description states that each image in the `components` array is validated.
## Issue Context
- Current implementation does: `... | head -1`, so additional components are ignored.
- If `containerImage` is a tag reference (no `@sha256:...`), `IMAGE_DIGEST` becomes the whole string and `image-url`/`image-digest` become inconsistent inputs to the attestation.
## Fix Focus Areas
- pipelines/dummy-integration-test/0.1/dummy-integration-test.yaml[12-23]
- pipelines/dummy-integration-test/0.1/dummy-integration-test.yaml[51-64]
## Recommended fix
- Parse the snapshot with a real JSON parser (e.g., `jq -r '.components[].containerImage'`).
- Either:
1) loop over all component images and run `dummy-check` once per image, OR
2) update the param description to explicitly say only the first component is used.
- Add an explicit check that `containerImage` contains `@` (and ideally `@sha256:`) before producing `image-url`/`image-digest`.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Adds a dummy-check Tekton task that produces configurable pass/fail/warn results with a test-result attestation step, a pipeline that parses a Snapshot and runs the task, and a script to create the IntegrationTestScenario in the cluster. The goal is to dogfood the new method for required tasks to be run in ITS pipelines with their results visible to Conforma with a secure chain of trust. Ref: https://redhat.atlassian.net/browse/EC-2011 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
12663f2 to
4830e00
Compare
|
🤖 Finished Review · ✅ Success · Started 10:50 PM UTC · Completed 11:08 PM UTC Commit: |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/checks-codecov.yaml:
- Line 37: Replace the constant if: false conditions for the Test, Acceptance,
and Upload jobs with the same non-constant repository or workflow variable gate
that evaluates false for the POC, ensuring actionlint accepts all three
conditions. Update .github/workflows/checks-codecov.yaml at lines 37-37,
100-100, and 169-169.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: 9bfdcb78-2264-4d55-bbda-e6753493c88b
📒 Files selected for processing (4)
.github/workflows/checks-codecov.yamlhack/create-dummy-its.shpipelines/dummy-integration-test/0.1/dummy-integration-test.yamltasks/dummy-check/0.1/dummy-check.yaml
🚧 Files skipped from review as they are similar to previous changes (3)
- tasks/dummy-check/0.1/dummy-check.yaml
- hack/create-dummy-its.sh
- pipelines/dummy-integration-test/0.1/dummy-integration-test.yaml
| jobs: | ||
|
|
||
| Test: | ||
| if: false # skipped for POC branch |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Replace the constant job conditions with one lint-valid POC gate.
actionlint rejects each constant if: false condition. Use the same non-constant repository or workflow variable gate for all three jobs. Keep the gate false for the POC.
.github/workflows/checks-codecov.yaml#L37-L37: update theTestjob condition..github/workflows/checks-codecov.yaml#L100-L100: update theAcceptancejob condition..github/workflows/checks-codecov.yaml#L169-L169: update theUploadjob condition.
🧰 Tools
🪛 actionlint (1.7.12)
[error] 37-37: constant expression "false" in condition. remove the if: section
(if-cond)
📍 Affects 1 file
.github/workflows/checks-codecov.yaml#L37-L37(this comment).github/workflows/checks-codecov.yaml#L100-L100.github/workflows/checks-codecov.yaml#L169-L169
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/checks-codecov.yaml at line 37, Replace the constant if:
false conditions for the Test, Acceptance, and Upload jobs with the same
non-constant repository or workflow variable gate that evaluates false for the
POC, ensuring actionlint accepts all three conditions. Update
.github/workflows/checks-codecov.yaml at lines 37-37, 100-100, and 169-169.
Source: Linters/SAST tools
ReviewFindingsHigh
Medium
Low
Next steps:
Previous runReviewFindingsHigh
Medium
Low
Next steps:
Previous run (2)ReviewFindingsMedium
Low
Next steps:
Previous run (3)ReviewFindingsHigh
Medium
Low
Next steps:
Previous run (4)ReviewFindingsHigh
Medium
Low
Next steps:
Previous run (5)ReviewFindingsHigh
Medium
Low
Next steps:
Previous run (6)ReviewFindingsHigh
Medium
Low
Next steps:
Previous run (7)ReviewFindingsHigh
Medium
Low
Next steps:
Previous run (8)ReviewFindingsHigh
Medium
Low
Next steps:
Previous run (9)ReviewFindingsHigh
Medium
Low
Labels: PR modifies CI workflows under .github/ (protected path) and introduces supply-chain references to personal forks for security-critical attestation steps Next steps:
Previous run (10)ReviewFindingsHigh
Medium
Low
Labels: PR modifies CI workflow (.github/), adds Tekton pipeline and task, and includes test tooling Next steps:
|
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
fullsend-ai-review
Bot
added
ci
github_actions
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
simonbaird
changed the title
|
🤖 Finished Review · ✅ Success · Started 2:13 AM UTC · Completed 2:31 AM UTC Commit: |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
st3penta
left a comment
st3penta
left a comment
There was a problem hiding this comment.
nice!
i won't approve since it's DNM, just to be safe, but looks good as a POC
See comments for explanation. This might need to be revisited in future, since the idea of every ITS having access to the push secret seems in need of scrutiny. Also, there might be a cleaner way to do this already. Will sync with Integration Service team about it. Ref: https://redhat.atlassian.net/browse/EC-2011 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
🤖 Finished Review · ✅ Success · Started 3:32 PM UTC · Completed 3:51 PM UTC Commit: |
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
hack/create-dummy-its.sh (1)
24-26: 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy liftPin both Git resolver revisions to immutable commit SHAs.
GIT_REVISIONdefaults to mutablereqd-task-its-poc, and the pipeline task resolver uses the same mutable ref atpipelines/dummy-integration-test/0.1/dummy-integration-test.yaml:100. A moved ref can change the pipeline or task without changing the scenario. Use reviewed full commit SHAs for both revisions and validateGIT_REVISIONbefore applying.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@hack/create-dummy-its.sh` around lines 24 - 26, Update the defaults in the dummy integration test setup to use reviewed, immutable full commit SHAs for both the top-level GIT_REVISION and the pipeline task resolver revision in dummy-integration-test.yaml. Add validation before applying GIT_REVISION so only a full commit SHA is accepted, while preserving the existing override behavior.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@hack/create-dummy-its.sh`:
- Around line 75-80: Update the ServiceAccount check and patch around
INTEGRATION_SA to query only .secrets[].name, avoiding matches from
imagePullSecrets or metadata. Make the JSON patch initialize /secrets as an
array when absent or null, and append the PUSH_SECRET only when the secrets
array already exists.
- Around line 62-71: Update the ServiceAccount setup in hack/create-dummy-its.sh
so PUSH_SECRET is not linked to the shared konflux-integration-runner used by
all IntegrationTestScenario pipelines. Run this ITS in an isolated namespace or
configure a dedicated per-ITS ServiceAccount when supported, ensuring untrusted
ITS pipelines cannot access the push credential.
---
Outside diff comments:
In `@hack/create-dummy-its.sh`:
- Around line 24-26: Update the defaults in the dummy integration test setup to
use reviewed, immutable full commit SHAs for both the top-level GIT_REVISION and
the pipeline task resolver revision in dummy-integration-test.yaml. Add
validation before applying GIT_REVISION so only a full commit SHA is accepted,
while preserving the existing override behavior.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: 2d3208c7-bd68-442b-8547-a1be70f22d05
📒 Files selected for processing (1)
hack/create-dummy-its.sh
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
🤖 Finished Review · ✅ Success · Started 3:54 PM UTC · Completed 4:14 PM UTC Commit: |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@hack/create-dummy-its.sh`:
- Around line 88-100: Update the pull-secret presence check before the removal
block to require an exact “found” result rather than a substring match, so
“not_found” does not enter the patch path. Preserve the existing INDEX lookup
and oc patch behavior when the secret is actually present, and allow repeat runs
to complete when it is absent.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: 7f2019c3-4962-4024-9b66-5451c4125676
📒 Files selected for processing (1)
hack/create-dummy-its.sh
| print('found' if '${PULL_SECRET}' in secrets else 'not_found') | ||
| " | grep -q "found"; then | ||
| echo "Removing pull secret '${PULL_SECRET}' from SA '${INTEGRATION_SA}' to avoid credential conflict" | ||
| INDEX=$(echo "${SA_JSON}" | python3 -c " | ||
| import json, sys | ||
| sa = json.load(sys.stdin) | ||
| for i, s in enumerate(sa.get('secrets', [])): | ||
| if s['name'] == '${PULL_SECRET}': | ||
| print(i) | ||
| break | ||
| ") | ||
| oc patch sa "${INTEGRATION_SA}" -n "${NAMESPACE}" --type=json \ | ||
| -p="[{\"op\":\"remove\",\"path\":\"/secrets/${INDEX}\"}]" |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Use an exact match for the pull-secret result.
Line 89 matches both found and not_found. If the pull secret is absent, INDEX is empty and the JSON Patch fails. The script cannot complete on a repeat run after the secret was removed.
Proposed fix
- " | grep -q "found"; then
+ " | grep -Fxq "found"; then📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| print('found' if '${PULL_SECRET}' in secrets else 'not_found') | |
| " | grep -q "found"; then | |
| echo "Removing pull secret '${PULL_SECRET}' from SA '${INTEGRATION_SA}' to avoid credential conflict" | |
| INDEX=$(echo "${SA_JSON}" | python3 -c " | |
| import json, sys | |
| sa = json.load(sys.stdin) | |
| for i, s in enumerate(sa.get('secrets', [])): | |
| if s['name'] == '${PULL_SECRET}': | |
| print(i) | |
| break | |
| ") | |
| oc patch sa "${INTEGRATION_SA}" -n "${NAMESPACE}" --type=json \ | |
| -p="[{\"op\":\"remove\",\"path\":\"/secrets/${INDEX}\"}]" | |
| print('found' if '${PULL_SECRET}' in secrets else 'not_found') | |
| " | grep -Fxq "found"; then | |
| echo "Removing pull secret '${PULL_SECRET}' from SA '${INTEGRATION_SA}' to avoid credential conflict" | |
| INDEX=$(echo "${SA_JSON}" | python3 -c " | |
| import json, sys | |
| sa = json.load(sys.stdin) | |
| for i, s in enumerate(sa.get('secrets', [])): | |
| if s['name'] == '${PULL_SECRET}': | |
| print(i) | |
| break | |
| ") | |
| oc patch sa "${INTEGRATION_SA}" -n "${NAMESPACE}" --type=json \ | |
| -p="[{\"op\":\"remove\",\"path\":\"/secrets/${INDEX}\"}]" |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@hack/create-dummy-its.sh` around lines 88 - 100, Update the pull-secret
presence check before the removal block to require an exact “found” result
rather than a substring match, so “not_found” does not enter the patch path.
Preserve the existing INDEX lookup and oc patch behavior when the secret is
actually present, and allow repeat runs to complete when it is absent.
The pull-only ec-main-pull secret covers the same registry path as the push secret. When Tekton merges credentials, the pull-only one can win, causing oras attach to fail with "unauthorized". The push secret includes pull permission so removing the pull-only one loses nothing. Ref: https://redhat.atlassian.net/browse/EC-2011 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
d1f1655 to
007c778
Compare
|
🤖 Finished Review · ✅ Success · Started 5:42 PM UTC · Completed 6:01 PM UTC Commit: |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
🤖 Finished Review · ✅ Success · Started 7:08 PM UTC · Completed 7:26 PM UTC Commit: |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
/retest |
|
🤖 Review · Commit: |
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
b6aeac1 to
da8f752
Compare
|
🤖 Finished Review · ✅ Success · Started 8:14 PM UTC · Completed 8:33 PM UTC Commit: |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
🤖 Review · Commit: |
Tekton merges all SA secrets into a single docker config, and pull-only credentials can take precedence over push credentials for the same registry. Mount the push secret directly and set DOCKER_CONFIG so oras uses it instead of the merged credentials. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
0c924fc to
61db75f
Compare
|
🤖 Finished Review · ✅ Success · Started 8:57 PM UTC · Completed 9:14 PM UTC Commit: |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
Pass the mounted push secret directly to oras via --registry-config instead of trying to overwrite the merged docker config. Confirmed the push secret works when used directly. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
🤖 Finished Review · ✅ Success · Started 9:36 PM UTC · Completed 9:54 PM UTC Commit: |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
Point to new step action commit that uses quay.io/konflux-ci/oras instead of a custom runner image, eliminating a build dependency. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
🤖 Review · ❌ Terminated · Started 3:25 AM UTC · Ended 3:44 AM UTC Commit: |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
Switch back to branch name 'runner-image-fix' to test whether the git resolver cache has cleared. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
🤖 Finished Review · ✅ Success · Started 4:03 AM UTC · Completed 4:22 AM UTC Commit: |
| jobs: | ||
|
|
||
| Test: | ||
| if: false # skipped for POC branch |
There was a problem hiding this comment.
[high] CI coverage regression
Adding if: false unconditionally disables the Test, Acceptance, and Upload Coverage jobs. This workflow provides unit test, integration test, acceptance test, and code coverage gate signal on PRs and pushes to main/release-* branches. If merged, all PRs and pushes to main would land without these CI checks.
Suggested fix: Use a branch-name condition instead of if: false, or move CI-disabling to a separate workflow file on the POC branch.
|
|
||
| jobs: | ||
| analyze: | ||
| if: false # skipped for POC branch |
There was a problem hiding this comment.
[high] CI coverage regression
Adding if: false disables the CodeQL security analysis job. This workflow runs on PRs to main, pushes to main, and on a weekly schedule. If merged, it would eliminate static analysis security scanning and the weekly scheduled scan entirely.
Suggested fix: Use a branch-specific condition or keep CI modifications out of the PR entirely.
| esac | ||
|
|
||
| TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%S") | ||
|
|
There was a problem hiding this comment.
[medium] External dependency pinning / supply chain
The create-test-result-attestation step references a step action from an external personal repository (simonbaird/step-actions) on a named branch (runner-image-fix) rather than a pinned commit SHA. The step action runs with access to push credentials mounted at /etc/push-credentials.
Suggested fix: Pin the step action reference to a specific commit SHA. Move the step action to the org-owned repository.
| exit 1 | ||
| fi | ||
|
|
||
| IMAGE_URL="${IMAGE%%@*}" |
There was a problem hiding this comment.
[medium] External dependency pinning / supply chain
The dummy-check task is referenced from a personal repository (simonbaird/conforma-cli) on a named branch (reqd-task-its-poc) rather than a pinned SHA. Branch references are mutable.
Suggested fix: Pin to a specific commit SHA.
| FAILURE, WARNING, ERROR, or SKIPPED. | ||
| default: "SUCCESS" | ||
| - name: NOTE | ||
| type: string |
There was a problem hiding this comment.
[medium] Secrets exposure
Push credentials secret is mounted into all steps via stepTemplate.volumeMounts, but only the create-test-result-attestation step needs push access. The dummy-check step gets unnecessary access to registry push credentials.
Suggested fix: Move the volume mount from stepTemplate to only the create-test-result-attestation step.
|
|
||
| # Adjust counts based on RESULT if user left defaults | ||
| case "${RESULT}" in | ||
| FAILURE) |
There was a problem hiding this comment.
[low] JSON injection / malformed output
TEST_OUTPUT JSON constructed via printf with %s for NOTE field. If NOTE contains double-quotes, backslashes, or newlines, the JSON will be syntactically invalid.
Suggested fix: Use jq or Python json.dumps for proper JSON escaping.
| jobs: | ||
|
|
||
| Test: | ||
| if: false # skipped for POC branch |
There was a problem hiding this comment.
[low] scope-coherence
Disabling CI jobs with if: false is scope creep beyond the POC's stated purpose of testing Tekton pipelines and artifacts in Konflux.
Suggested fix: Remove the if: false additions or use branch-level filtering in workflow triggers.
| apiVersion: tekton.dev/v1 | ||
| kind: Task | ||
| metadata: | ||
| labels: |
There was a problem hiding this comment.
[low] metadata annotations
Missing tekton.dev/displayName annotation that exists on all other tasks in the repo.
2 participants
For review bots: You can ignore this PR, it exists to test some pipelines and artifacts in Konflux. It won't be merged in this repo.
Summary
attest-test-resultstep action)reqd-task-poc-ec2011pipeline that parses a Snapshot and runs the dummy-check taskhack/create-dummy-its.shto create the IntegrationTestScenario in the clusterContext
POC for EC-2011 — dog-fooding a required task in an ITS instead of the build pipeline.
Test plan
rhtap-contract-tenantnamespace🤖 Generated with Claude Code