HYPERFLEET-525 - ci: add CI validation targets and OWNERS for pre submit #19
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,16 @@ | ||
| FROM src | ||
| WORKDIR /go/src/github.com/openshift-hyperfleet/hyperfleet-infra | ||
| USER root | ||
| RUN yum -y install --setopt=skip_missing_names_on_install=False \ | ||
| shellcheck \ | ||
| jq \ | ||
| unzip \ | ||
| && yum clean all | ||
| RUN curl -fsSL -o /tmp/get_helm.sh https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 \ | ||
|
Contributor
There was a problem hiding this comment. Priority: Security Terraform is pinned at 1.9.8 on line 11 — nice. But helm (line 9) and kubectl (line 14) aren't For helm, the get-helm-3 script supports a DESIRED_VERSION env var: RUN HELM_VERSION=v3.17.3 \
&& curl -fsSL -o /tmp/get_helm.sh
https://raw.githubusercontent.com/helm/helm/v${HELM_VERSION}/scripts/get-helm-3 \
&& chmod +x /tmp/get_helm.sh && DESIRED_VERSION=${HELM_VERSION} /tmp/get_helm.sh && rm
/tmp/get_helm.sh(Note: also pinning the script download to the tag instead of main.) For kubectl, pin similarly: RUN KUBECTL_VERSION=v1.32.3 \
&& curl -LO "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl" \
&& chmod 755 kubectl && mv kubectl /usr/local/bin/ |
||
| && chmod +x /tmp/get_helm.sh && /tmp/get_helm.sh && rm /tmp/get_helm.sh | ||
| RUN TERRAFORM_VERSION=1.9.8 \ | ||
| && curl -fsSL -o /tmp/terraform.zip "https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_amd64.zip" \ | ||
| && unzip -o /tmp/terraform.zip -d /usr/local/bin/ && rm /tmp/terraform.zip | ||
| RUN curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" \ | ||
| && chmod 755 kubectl && mv kubectl /usr/local/bin/ | ||
| RUN helm plugin install https://github.com/aslafy-z/helm-git | ||
|
Comment on lines
+9
to
+16
There was a problem hiding this comment. 🧩 Analysis chain🏁 Script executed: # Locate and examine the Dockerfile.ci file
find . -name "Dockerfile.ci" -type fRepository: openshift-hyperfleet/hyperfleet-infra Length of output: 96 🏁 Script executed: # Read the Dockerfile.ci to examine lines 9-16
cat -n ./Dockerfile.ci | head -20Repository: openshift-hyperfleet/hyperfleet-infra Length of output: 1062 🏁 Script executed: # Check if the file references are as described - verify the mutable nature of the URLs
# Test if stable.txt resolves dynamically
curl -s -L https://dl.k8s.io/release/stable.txt | head -1
# Check if get.helm.sh is available
curl -s -I https://get.helm.sh/helm-v3.17.3-linux-amd64.tar.gz | head -5Repository: openshift-hyperfleet/hyperfleet-infra Length of output: 234 🏁 Script executed: # Verify the get-helm-3 script is mutable (from main branch)
curl -s -I https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | head -5
# Check if helm-git accepts version flags
curl -s https://api.github.com/repos/aslafy-z/helm-git/releases/latest | grep -o '"tag_name": "[^"]*"'
# Verify if the suggested versions are reasonable by checking terraform releases
curl -s https://api.hashicorp.com/v1/releases/terraform?limit=5 | head -20Repository: openshift-hyperfleet/hyperfleet-infra Length of output: 338 🏁 Script executed: # Check the specific versions suggested in the diff
# Verify helm release history for v3.17.3
curl -s https://api.github.com/repos/helm/helm/releases | grep '"tag_name"' | head -10
# Verify kubectl versions
curl -s https://api.github.com/repos/kubernetes/kubernetes/releases | grep '"tag_name"' | head -10 | grep -E "v1\.31|v1\.32|v1\.33|v1\.35"Repository: openshift-hyperfleet/hyperfleet-infra Length of output: 518 Pin and verify downloaded toolchain artifacts. Lines 9-16 pull mutable upstream content without integrity checks, creating a supply-chain and reproducibility risk for CI:
Replace with explicit version pins and SHA256 verification: Suggested hardening pattern+ARG HELM_VERSION=v3.20.1
+ARG TERRAFORM_VERSION=1.9.8
+ARG KUBECTL_VERSION=v1.35.2
+ARG HELM_GIT_VERSION=v1.5.2
+# Add SHA256 args for each binary
-RUN curl -fsSL -o /tmp/get_helm.sh https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 \
- && chmod +x /tmp/get_helm.sh && /tmp/get_helm.sh && rm /tmp/get_helm.sh
+RUN curl -fsSLo /tmp/helm.tgz "https://get.helm.sh/helm-${HELM_VERSION}-linux-amd64.tar.gz" \
+ && echo "${HELM_SHA256} /tmp/helm.tgz" | sha256sum -c - \
+ && tar -xzf /tmp/helm.tgz -C /tmp && mv /tmp/linux-amd64/helm /usr/local/bin/helm \
+ && rm -rf /tmp/helm.tgz /tmp/linux-amd64
-RUN curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" \
- && chmod 755 kubectl && mv kubectl /usr/local/bin/
+RUN curl -fsSLo /tmp/kubectl "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl" \
+ && echo "${KUBECTL_SHA256} /tmp/kubectl" | sha256sum -c - \
+ && chmod 755 /tmp/kubectl && mv /tmp/kubectl /usr/local/bin/kubectl
-RUN helm plugin install https://github.com/aslafy-z/helm-git
+RUN helm plugin install https://github.com/aslafy-z/helm-git --version ${HELM_GIT_VERSION}Use current release versions and generate SHA256 checksums from official release artifacts. 🤖 Prompt for AI Agents |
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,35 @@ | ||
| approvers: | ||
| - "86254860" | ||
|
Contributor
There was a problem hiding this comment. This looks like a numeric GitHub ID rather than a username — Prow OWNERS files expect usernames so this entry will likely get ignored. Do you know which user this maps to?
Author
There was a problem hiding this comment. I've seen the discussion in Slack about this. We can update it once Dandan changes the username. |
||
| - aredenba-rh | ||
| - ciaranRoche | ||
| - crizzo71 | ||
| - jsell-rh | ||
| - mbrudnoy | ||
| - Mischulee | ||
| - pnguyen44 | ||
| - rafabene | ||
| - rh-amarin | ||
| - tirthct | ||
| - tzhou5 | ||
| - vkareh | ||
| - xueli181114 | ||
| - yasun1 | ||
| - yingzhanredhat | ||
|
|
||
| reviewers: | ||
| - "86254860" | ||
| - aredenba-rh | ||
| - ciaranRoche | ||
| - crizzo71 | ||
| - jsell-rh | ||
| - mbrudnoy | ||
| - Mischulee | ||
| - pnguyen44 | ||
| - rafabene | ||
| - rh-amarin | ||
| - tirthct | ||
| - tzhou5 | ||
| - vkareh | ||
| - xueli181114 | ||
| - yasun1 | ||
| - yingzhanredhat | ||
|
Comment on lines
+1
to
+35
There was a problem hiding this comment. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
# Description: Verify the numeric ID corresponds to a valid GitHub user
# Check if the numeric ID resolves to a GitHub user
gh api users/86254860 --jq '.login' 2>/dev/null || echo "Could not resolve numeric ID to username"Repository: openshift-hyperfleet/hyperfleet-infra Length of output: 233 🏁 Script executed: # Search for OWNERS file documentation and CI configuration
fd -type f -name "*.md" -o -name "*.yaml" -o -name "*.yml" | head -20Repository: openshift-hyperfleet/hyperfleet-infra Length of output: 251 🏁 Script executed: # Check if "86254860" appears elsewhere in the repository with context
rg "86254860" -B 2 -A 2Repository: openshift-hyperfleet/hyperfleet-infra Length of output: 251 🏁 Script executed: # Look for Prow or CI configuration files
fd -type f \( -name ".prow.yaml" -o -name "prow*" -o -name "*prow*" -o -name "OWNERS" \) | head -20Repository: openshift-hyperfleet/hyperfleet-infra Length of output: 251 🏁 Script executed: # Check the git history of the OWNERS file to see if there's context about the numeric ID
git log --oneline OWNERS 2>/dev/null | head -10Repository: openshift-hyperfleet/hyperfleet-infra Length of output: 161 🏁 Script executed: # Look at the specific commit that added the OWNERS file for context
git show 0c924fc --statRepository: openshift-hyperfleet/hyperfleet-infra Length of output: 3495 🏁 Script executed: # Search for any README or documentation about CI/OWNERS setup
find . -name "README*" -o -name "*.md" | xargs grep -l "OWNERS\|CI\|Prow" 2>/dev/null | head -5Repository: openshift-hyperfleet/hyperfleet-infra Length of output: 131 🏁 Script executed: # Check if there are any GitHub workflow files or references to Prow
find . -name "*.yaml" -o -name "*.yml" | xargs grep -l "prow\|OWNERS" 2>/dev/null | head -10Repository: openshift-hyperfleet/hyperfleet-infra Length of output: 63 🏁 Script executed: # Check the README.md for CI/OWNERS documentation
head -100 README.mdRepository: openshift-hyperfleet/hyperfleet-infra Length of output: 3405 🏁 Script executed: # Check the Makefile for CI targets and OWNERS usage
grep -i "owner\|prow\|ci" Makefile | head -20Repository: openshift-hyperfleet/hyperfleet-infra Length of output: 627 🏁 Script executed: # Look for any configuration that might explain the numeric ID format
find . -name ".prow.yaml" -o -name "prow.yaml" -o -name "*prow*" 2>/dev/nullRepository: openshift-hyperfleet/hyperfleet-infra Length of output: 157 🏁 Script executed: # Check the Prow terraform configuration files
cat terraform/envs/gke/dev-prow.tfvarsRepository: openshift-hyperfleet/hyperfleet-infra Length of output: 2766 🏁 Script executed: # Look for any .prow.yaml or prow configuration in the repo
find . -type f -name "*prow*" | xargs cat 2>/dev/nullRepository: openshift-hyperfleet/hyperfleet-infra Length of output: 3133 🏁 Script executed: # Check if there's documentation about the OWNERS file format in git history or comments
git log --all --grep="OWNERS\|86254860" --onelineRepository: openshift-hyperfleet/hyperfleet-infra Length of output: 279 🏁 Script executed: # Search for GitHub documentation or OpenShift docs references about OWNERS file format
rg "OWNERS.*format|numeric.*id|user.*id" -iRepository: openshift-hyperfleet/hyperfleet-infra Length of output: 63 🏁 Script executed: # Check if "86254860" is a real GitHub user by looking at the PR history
git log --all --oneline | grep "86254860"Repository: openshift-hyperfleet/hyperfleet-infra Length of output: 198 🏁 Script executed: # Search for Prow configuration or OWNERS file documentation
rg "Prow\|OWNERS" -i README.md | head -20Repository: openshift-hyperfleet/hyperfleet-infra Length of output: 63 🏁 Script executed: # Check if there are any comments or documentation in the OWNERS file itself
cat OWNERSRepository: openshift-hyperfleet/hyperfleet-infra Length of output: 481 🏁 Script executed: # Look for any Prow-specific configuration or plugin files
find . -name "plugins.yaml" -o -name "config.yaml" -o -name "*prow*" -type f 2>/dev/null | xargs cat 2>/dev/null | head -50Repository: openshift-hyperfleet/hyperfleet-infra Length of output: 2391 🌐 Web query:
💡 Result: Prow’s If you put a number there, Prow will treat it as a login string (and it won’t map to a GitHub account unless a user literally has that as their login, which GitHub doesn’t). [2], [3] Sources: Prow “Reviewers and Approvers” doc (OWNERS entries are GitHub usernames or aliases) [1]; Kubernetes OWNERS spec (GitHub usernames or aliases) [2]; Prow 🌐 Web query:
💡 Result: In Prow’s Replace the numeric GitHub user ID with a username. The entry Note: The 🤖 Prompt for AI Agents |
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Run CI jobs as non-root after provisioning steps.
Line 3 keeps the final image user as
root, which increases impact if a presubmit script/dependency is compromised. Install as root, then switch to a non-root runtime user before the final layer.🧰 Tools
🪛 Trivy (0.69.3)
[error] 3-3: Image user should not be 'root'
Last USER command in Dockerfile should not be 'root'
Rule: DS-0002
Learn more
(IaC/Dockerfile)
🤖 Prompt for AI Agents