MULTIARCH-5754: Add RapiDAST pipeline#188
Open
AnnaZivkovic wants to merge 3 commits into
Open
Conversation
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
openshift-ci-robot
added
the
jira/valid-reference
|
@AnnaZivkovic: This pull request references MULTIARCH-5754 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set. DetailsIn response to this: Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughAdds a new Tekton Pipeline Changes
Sequence Diagram(s)sequenceDiagram
participant Tekton as Tekton Pipeline
participant K8s as Kubernetes Cluster
participant OLM as Operator Lifecycle Manager
participant TREX as TREX Service
participant OCM as OCM API (via ocm CLI)
participant RapiDAST as RapiDAST Runner
Tekton->>K8s: provision-env (eaas-provision-space) -> kubeconfig + secretRef
Tekton->>K8s: deploy-app: write kubeconfig, copy/sanitize pull secret
Tekton->>K8s: deploy-app: download operator-sdk, run bundle image from SNAPSHOT
K8s->>OLM: create Subscription
OLM->>K8s: install CSV -> CSV status updates
Tekton->>K8s: poll Subscription.installedCSV, wait for CSV Succeeded
Tekton->>K8s: setup-test: start port-forward to svc/trex -> localhost:8000
Tekton->>OCM: setup-test: ocm login (OCM_TOKEN) and query API -> authenticated URL
Tekton->>RapiDAST: run rapidast.py with Authorization header against authenticated URL
RapiDAST-->>Tekton: produce /tmp/results/DAST-* and set task results (authenticated_url, config_path)
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes 🚥 Pre-merge checks | ✅ 11 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (11 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
@AnnaZivkovic: This pull request references MULTIARCH-5754 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🧹 Nitpick comments (1)
.tekton/rapidast-integration-pipeline.yaml (1)
21-22: Pin git-resolved task revision to an immutable ref.Using
mainfortaskRef.resolver: gitis non-reproducible and can break the pipeline on upstream changes. Replace with a commit SHA or version tag (e.g.,e06ee0aorv1.0.0) from https://github.com/konflux-ci/build-definitions.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.tekton/rapidast-integration-pipeline.yaml around lines 21 - 22, The pipeline uses a mutable ref for the git-resolved task (the revision key set to "main") which makes runs unreproducible; update the revision value under the taskRef resolver (the "revision" entry) to a fixed immutable ref—use a commit SHA or a version tag (e.g., e06ee0a or v1.0.0) from the konflux-ci/build-definitions repository URL instead of "main" so the pipeline always uses the exact task revision.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.tekton/rapidast-integration-pipeline.yaml:
- Around line 121-124: Remove the runtime cluster-admin escalation (the SA_NAME
variable and the oc adm policy add-cluster-role-to-user cluster-admin
"${SA_NAME}" call) and instead require a pre-provisioned service account with
least-privilege RBAC; update the task to use that service account (referencing
SA_NAME) and add a validation step that checks for the required specific
roles/clusterroles before proceeding, and document the exact minimal roles the
pipeline requires so operators can provision them ahead of execution.
- Around line 295-299: The check is searching the wrong path: change the
FINAL_RESULTS_DIR assignment to search the configured RESULTS_DIR variable
rather than ./results; update the line that sets FINAL_RESULTS_DIR to use find
"$RESULTS_DIR" -type d -name "DAST-*" -print -quit (preserve quoting and -print
-quit), and keep the subsequent empty-check/exit logic as-is so
FINAL_RESULTS_DIR reflects the actual /tmp/results location when present.
- Around line 131-133: CSV discovery currently relies on an unstable hard-coded
label used in the oc get subscription command (inside the for loop that sets
CSV_NAME), which causes flakiness; change the selector to reliably identify the
Subscription by its spec.package or spec.name instead of that generated label —
e.g., query all subscriptions in the namespace and use a jsonpath filter that
matches .items[?(@.spec.package=='<PACKAGE_NAME>')].status.installedCSV (or
.spec.name if you have the subscription name), so replace the label-based
selector in the CSV_NAME assignment with a jsonpath filter that matches the
known package/subscription identifier.
- Around line 115-116: SNAPSHOT parsing is brittle because OO_BUNDLE is taken
from .components[1] which can be missing; change the extraction of OO_BUNDLE to
select the first non-empty .components[].containerImage from SNAPSHOT (not a
fixed index), and add a check that OO_BUNDLE is non-empty before calling
operator-sdk run bundle so the pipeline fails fast with a clear error if no
bundle image is found. Update the code that sets OO_BUNDLE and the subsequent
validation/exit logic (references: OO_BUNDLE, SNAPSHOT, and the operator-sdk run
bundle invocation).
- Around line 105-113: The task currently writes CLI binaries to /usr/local/bin
which fails in random-UID/OpenShift containers; change the download/install
destination for jq and oc to a writable directory (e.g., $HOME/bin,
$HOME/.local/bin, or /tmp/bin) and ensure that directory is made executable and
added to PATH before use; update the curl/chmod/rm steps that reference
/usr/local/bin/jq and /usr/local/bin/oc to use the new directory and export PATH
so subsequent steps can find the jq and oc executables.
---
Nitpick comments:
In @.tekton/rapidast-integration-pipeline.yaml:
- Around line 21-22: The pipeline uses a mutable ref for the git-resolved task
(the revision key set to "main") which makes runs unreproducible; update the
revision value under the taskRef resolver (the "revision" entry) to a fixed
immutable ref—use a commit SHA or a version tag (e.g., e06ee0a or v1.0.0) from
the konflux-ci/build-definitions repository URL instead of "main" so the
pipeline always uses the exact task revision.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: ea90072b-bd53-44a8-bffa-f28e213d2aff
📒 Files selected for processing (1)
.tekton/rapidast-integration-pipeline.yaml
Author
|
/retest |
AnnaZivkovic
force-pushed
the
rapiDASt-add-config
branch
from
801a7bd to
77030b7
Compare
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (1)
.tekton/rapidast-integration-pipeline.yaml (1)
17-24: Pin the remote task to an immutable revision.Tracking
konflux-ci/build-definitionsonmainmakes this pipeline change behavior without any diff in this repo. Please pinrevisionto a commit SHA or immutable tag so failures are reproducible.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.tekton/rapidast-integration-pipeline.yaml around lines 17 - 24, The pipeline currently references the external task repo by mutable branch ("revision" value set to "main"); change the params.revision value to an immutable identifier (commit SHA or immutable tag) to pin the resolver to a fixed revision so the task at params.pathInRepo remains reproducible; update the "revision" parameter in the resolver block (where resolver: git and params include name: url, name: revision, name: pathInRepo) to the specific commit SHA or tag and commit that change.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.tekton/rapidast-integration-pipeline.yaml:
- Around line 180-181: The oc port-forward invocation currently uses
--address=0.0.0.0 which exposes the forwarded port cluster-wide; change the
command that runs oc port-forward for svc/trex 8000:8000 to bind to localhost
only (use --address=127.0.0.1 or localhost) so the forwarded port is only
accessible from the pod/container loopback interface and not the entire cluster.
- Around line 193-218: The script currently enables shell xtrace with "set -ex",
which will leak the OCM token when the /tmp/ocm login --token=${OCM_TOKEN}
command is executed; modify the script to disable xtrace just before the login
(e.g., run "set +x"), perform the /tmp/ocm login --token=${OCM_TOKEN}, and then
re-enable xtrace if needed (e.g., "set -x") afterwards, so the token expansion
is not printed to CI logs while keeping tracing for other commands.
- Around line 251-255: The curl step that writes to LOCAL_OPENAPI_PATH currently
fetches openapi.yaml from the repository's main branch which can drift; change
the URL used by the curl command to a pinned, immutable reference (for example
replace the branch segment "main" with the repository commit hash or a release
tag) or alternatively fetch the OpenAPI spec from the same snapshot/artifact
that supplies the deployed image so the spec and deployed app revision are
identical; update the curl invocation that targets ${LOCAL_OPENAPI_PATH}
accordingly and ensure the chosen commit-hash/tag is recorded in the pipeline
inputs.
- Line 125: Update the operator-sdk invocation so it matches the deployment
script: change the `operator-sdk run bundle "$OO_BUNDLE" -n "$NAMESPACE"
--timeout=5m` call to include `--security-context-config restricted` and
increase the timeout to `--timeout=10m`; locate the line invoking `operator-sdk
run bundle` (references: OO_BUNDLE, NAMESPACE, operator-sdk run bundle) and add
the `--security-context-config restricted` flag and set `--timeout=10m`.
---
Nitpick comments:
In @.tekton/rapidast-integration-pipeline.yaml:
- Around line 17-24: The pipeline currently references the external task repo by
mutable branch ("revision" value set to "main"); change the params.revision
value to an immutable identifier (commit SHA or immutable tag) to pin the
resolver to a fixed revision so the task at params.pathInRepo remains
reproducible; update the "revision" parameter in the resolver block (where
resolver: git and params include name: url, name: revision, name: pathInRepo) to
the specific commit SHA or tag and commit that change.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: f1e4a896-99cc-4ab6-85a4-5c509335c12c
📒 Files selected for processing (1)
.tekton/rapidast-integration-pipeline.yaml
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (1)
.tekton/rapidast-integration-pipeline.yaml (1)
134-139:⚠️ Potential issue | 🟠 MajorCSV selection is still nondeterministic across multiple subscriptions.
The current query grabs the first
installedCSVfrom all subscriptions in the namespace, which can resolve the wrong operator if more than one subscription exists. Filter by a known package/subscription identifier before waiting.Suggested fix
- CSV_NAME=$(oc get subscription -n "$NAMESPACE" -o jsonpath='{.items[*].status.installedCSV}' | awk '{print $1}' || true) + CSV_NAME=$(oc get subscription -n "$NAMESPACE" \ + -o jsonpath="{.items[?(@.spec.package=='multiarch-tuning-operator')].status.installedCSV}" \ + | awk '{print $1}' || true)🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.tekton/rapidast-integration-pipeline.yaml around lines 134 - 139, The CSV selection loop is nondeterministic because it grabs the first installedCSV across all subscriptions; update the oc query to target the specific package/subscription instead of all items. Replace the oc get subscription command used to set CSV_NAME with a targeted query such as using the subscription name or package identifier (e.g. oc get subscription <SUB_NAME> -n "$NAMESPACE" -o jsonpath='{.status.installedCSV}' or oc get subscription -n "$NAMESPACE" -o jsonpath='{.items[?(@.spec.name=="<PACKAGE_NAME>")].status.installedCSV}') so CSV_NAME is derived only from the intended subscription; keep the CSV_NAME variable, loop and check logic but use the targeted jsonpath or explicit subscription name in the command.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.tekton/rapidast-integration-pipeline.yaml:
- Around line 212-217: The pipeline currently reuses OCM_TOKEN as the target
application's auth credential in the RapiDAST authentication/Authorization
header; replace this by provisioning and referencing a dedicated app-scoped test
secret (e.g., APP_TEST_TOKEN) or remove/disable the auth block until the
operator exposes a real HTTP auth mechanism. Update the RapiDAST authentication
section and any Authorization header entries that reference OCM_TOKEN (including
the blocks around the current Authorization use and the blocks at the other
occurrences noted) to read from the new secret name (or omit the auth fields)
and ensure the secret is created/imported into the pipeline credentials instead
of reusing OCM_TOKEN.
- Around line 181-185: The pipeline hardcodes svc/trex (in the setup-test task's
oc port-forward call) which doesn't exist for this bundle; change the task to
accept parameters (e.g., TARGET_SERVICE, TARGET_PORT, TARGET_PATH) and use those
instead of svc/trex and hardcoded paths, and add a fail-fast check that queries
the cluster for the service (fail with a clear error if missing) before
attempting oc port-forward; update references in the same task and the other
occurrences mentioned (lines ~209-210 and ~230-236) so the flow uses
TARGET_SERVICE/TARGET_PORT/TARGET_PATH and validates existence prior to
port-forwarding or curl.
---
Duplicate comments:
In @.tekton/rapidast-integration-pipeline.yaml:
- Around line 134-139: The CSV selection loop is nondeterministic because it
grabs the first installedCSV across all subscriptions; update the oc query to
target the specific package/subscription instead of all items. Replace the oc
get subscription command used to set CSV_NAME with a targeted query such as
using the subscription name or package identifier (e.g. oc get subscription
<SUB_NAME> -n "$NAMESPACE" -o jsonpath='{.status.installedCSV}' or oc get
subscription -n "$NAMESPACE" -o
jsonpath='{.items[?(@.spec.name=="<PACKAGE_NAME>")].status.installedCSV}') so
CSV_NAME is derived only from the intended subscription; keep the CSV_NAME
variable, loop and check logic but use the targeted jsonpath or explicit
subscription name in the command.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: cad1901a-4f6b-498b-afb5-62ec087e0958
📒 Files selected for processing (1)
.tekton/rapidast-integration-pipeline.yaml
Author
|
/retest |
2 similar comments
Author
|
/retest |
Author
|
/retest |
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (2)
.tekton/rapidast-integration-pipeline.yaml (2)
135-140:⚠️ Potential issue | 🟠 MajorSelect the installed CSV by package/subscription, not by position.
Line 139 takes the first non-empty
installedCSVfrom any Subscription in the namespace. If the environment ever contains more than one Subscription,oc waitcan bind to the wrong CSV. Filter for the operator's package or the Subscription created byrun bundleinstead ofawk '{print $1}'.Possible fix
- CSV_NAME=$(oc get subscription -n "$NAMESPACE" -o jsonpath='{.items[*].status.installedCSV}' | awk '{print $1}' || true) + CSV_NAME=$(oc get subscription -n "$NAMESPACE" \ + -o jsonpath="{.items[?(@.spec.package=='multiarch-tuning-operator')].status.installedCSV}" || true)🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.tekton/rapidast-integration-pipeline.yaml around lines 135 - 140, The loop selects the first installedCSV from any Subscription (CSV_NAME) using awk, which can pick the wrong CSV when multiple Subscriptions exist; change the oc get subscription command to filter by the specific Subscription or package name (e.g., use a known SUBSCRIPTION_NAME or the operator package and a jsonpath filter like selecting .items[?(@.spec.name=="<package-or-subscription-name>")].status.installedCSV) instead of awk '{print $1}', so CSV_NAME is set to the installedCSV for the intended Subscription before running oc wait.
182-186:⚠️ Potential issue | 🔴 CriticalReplace the copied rh-trex/OCM flow before merging.
These lines are still wired to
svc/trex,/api/rh-trex/v1/dinosaurs, and anOCM_TOKEN-backedAuthorizationheader. The inline TODOs already call out that these are example values. As written, this task will either fail on the port-forward/auth probe or scan an endpoint unrelated tomultiarch-tuning-operator. Parameterize the target service/port/path, fail fast if the Service is missing, and use an app-scoped auth flow—or remove auth entirely if this operator does not expose an HTTP API.Also applies to: 213-236, 274-279
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.tekton/rapidast-integration-pipeline.yaml around lines 182 - 186, The lines that hardcode oc port-forward to svc/trex and the related probe against /api/rh-trex/v1/dinosaurs (and use of OCM_TOKEN/Authorization) must be replaced: parameterize the target service name, port and probe path (used by the oc port-forward invocation and the HTTP probe), add a pre-check that the Service exists and fail fast if not (before calling oc port-forward), and switch the auth flow to an app-scoped token or remove the Authorization header if no HTTP API is exposed; update occurrences of svc/trex, oc port-forward, /api/rh-trex/v1/dinosaurs and OCM_TOKEN/Authorization in the task steps (including the other regions noted) to use these parameters and the existence check.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.tekton/rapidast-integration-pipeline.yaml:
- Line 48: Replace mutable image tags and runtime resolution with immutable,
verifiable artifacts: update all occurrences of the image reference
quay.io/konflux-ci/konflux-test:latest (and other :latest lines at the same
file) to pinned digest form (quay.io/konflux-ci/konflux-test@sha256:...) and
similarly pin any other tool/task images referenced in the pipeline; hardcode a
specific operator-sdk release instead of using releases/latest and add a
checksum verification step (e.g., compare downloaded operator-sdk binary SHA256
against a stored value) before use to ensure reproducible, tamper-resistant
execution.
---
Duplicate comments:
In @.tekton/rapidast-integration-pipeline.yaml:
- Around line 135-140: The loop selects the first installedCSV from any
Subscription (CSV_NAME) using awk, which can pick the wrong CSV when multiple
Subscriptions exist; change the oc get subscription command to filter by the
specific Subscription or package name (e.g., use a known SUBSCRIPTION_NAME or
the operator package and a jsonpath filter like selecting
.items[?(@.spec.name=="<package-or-subscription-name>")].status.installedCSV)
instead of awk '{print $1}', so CSV_NAME is set to the installedCSV for the
intended Subscription before running oc wait.
- Around line 182-186: The lines that hardcode oc port-forward to svc/trex and
the related probe against /api/rh-trex/v1/dinosaurs (and use of
OCM_TOKEN/Authorization) must be replaced: parameterize the target service name,
port and probe path (used by the oc port-forward invocation and the HTTP probe),
add a pre-check that the Service exists and fail fast if not (before calling oc
port-forward), and switch the auth flow to an app-scoped token or remove the
Authorization header if no HTTP API is exposed; update occurrences of svc/trex,
oc port-forward, /api/rh-trex/v1/dinosaurs and OCM_TOKEN/Authorization in the
task steps (including the other regions noted) to use these parameters and the
existence check.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 56c038bf-a628-46d3-b4c3-de8031bd58d3
📒 Files selected for processing (1)
.tekton/rapidast-integration-pipeline.yaml
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (2)
.tekton/rapidast-integration-pipeline.yaml (2)
227-240:⚠️ Potential issue | 🔴 CriticalReplace the remaining rh-trex sample target and auth flow.
This task still scans the copied rh-trex example instead of this operator: it port-forwards
svc/trex, calls/api/rh-trex/v1/dinosaurs, and forwardsOCM_TOKENas the app’sAuthorizationheader. The bundle/CSV in this repo describe an operator with CRDs/webhooks and internal services, not that HTTP API, so this pipeline cannot produce a valid scan target as written.Also applies to: 255-281, 320-324
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.tekton/rapidast-integration-pipeline.yaml around lines 227 - 240, The pipeline still targets the rh-trex example: replace the hardcoded port-forward to svc/trex and the get-url step that calls /api/rh-trex/v1/dinosaurs and uses OCM_TOKEN as the app Authorization; instead identify the actual service (or remove port-forward if the operator has no external service) and update the oc port-forward invocation, the HTTP endpoint the test step calls, and the environment variable used for auth to match the operator’s real API or webhook auth mechanism (update references to svc/trex, the port-forward command, the get-url step, the /api/rh-trex/v1/dinosaurs path, and the OCM_TOKEN env usage). Ensure every duplicated block (lines noted) is changed consistently.
48-48:⚠️ Potential issue | 🟠 MajorPin the remaining task images and operator-sdk download to immutable artifacts.
The pipeline still depends on mutable
:latesttags and a runtimereleases/latestlookup foroperator-sdk. That keeps the task non-reproducible and makes failures depend on external changes instead of this PR.#!/bin/bash sed -n '1,350p' .tekton/rapidast-integration-pipeline.yaml \ | rg -n ':(latest)\b|releases/latest'Also applies to: 70-70, 93-93, 142-142, 156-158, 212-212, 234-234, 285-285
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.tekton/rapidast-integration-pipeline.yaml at line 48, Replace mutable image tags and the runtime operator-sdk "releases/latest" lookup with immutable artifacts: change occurrences of quay.io/konflux-ci/konflux-test:latest (and the other :latest images at the noted locations) to pinned image digests or specific immutable tags, and change any operator-sdk download that uses "releases/latest" to a fixed release URL or archive with a known version/sha (refer to the operator-sdk download step and any step named or referencing operator-sdk in the pipeline). Ensure each updated image reference and the operator-sdk URL use explicit version/digest identifiers so the pipeline becomes reproducible.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.tekton/rapidast-integration-pipeline.yaml:
- Around line 105-107: The script currently sets SA_NAME=$(oc whoami) but uses
${SA_NAME##*/} which doesn't strip the colon-delimited identity
(system:serviceaccount:<ns>:<name>), causing invalid --serviceaccount arguments
and silent failures; update the code that builds the RoleBinding to first parse
the service account name (e.g., extract the substring after the last ':' into
SA_NAME_SHORT or set SA_NAME=${SA_NAME##*:}) and use
--serviceaccount=${NAMESPACE}:${SA_NAME_SHORT}, and remove the trailing "|| echo
..." so the command fails fast; apply the same fix to the other identical block
that handles lines 134-138 (the RoleBinding creation logic).
- Around line 180-185: The loop that sets CSV_NAME currently grabs the first
installedCSV from any Subscription; change the oc get subscription command (the
CSV_NAME=... assignment inside the for loop) to select only the Subscription for
package "multiarch-tuning-operator" (e.g. use a jsonpath filter selecting
items[?(@.spec.name=='multiarch-tuning-operator')].status.installedCSV) so
CSV_NAME only reflects that operator's installedCSV instead of awk'ing the first
value from all subscriptions.
---
Duplicate comments:
In @.tekton/rapidast-integration-pipeline.yaml:
- Around line 227-240: The pipeline still targets the rh-trex example: replace
the hardcoded port-forward to svc/trex and the get-url step that calls
/api/rh-trex/v1/dinosaurs and uses OCM_TOKEN as the app Authorization; instead
identify the actual service (or remove port-forward if the operator has no
external service) and update the oc port-forward invocation, the HTTP endpoint
the test step calls, and the environment variable used for auth to match the
operator’s real API or webhook auth mechanism (update references to svc/trex,
the port-forward command, the get-url step, the /api/rh-trex/v1/dinosaurs path,
and the OCM_TOKEN env usage). Ensure every duplicated block (lines noted) is
changed consistently.
- Line 48: Replace mutable image tags and the runtime operator-sdk
"releases/latest" lookup with immutable artifacts: change occurrences of
quay.io/konflux-ci/konflux-test:latest (and the other :latest images at the
noted locations) to pinned image digests or specific immutable tags, and change
any operator-sdk download that uses "releases/latest" to a fixed release URL or
archive with a known version/sha (refer to the operator-sdk download step and
any step named or referencing operator-sdk in the pipeline). Ensure each updated
image reference and the operator-sdk URL use explicit version/digest identifiers
so the pipeline becomes reproducible.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 04ee6894-95d1-4d1a-991a-e35e76f47ded
📒 Files selected for processing (1)
.tekton/rapidast-integration-pipeline.yaml
AnnaZivkovic
force-pushed
the
rapiDASt-add-config
branch
3 times, most recently
from
43c3378 to
a2ce532
Compare
|
Not that we care much but there is typo in PR name, it should be - RapiDAST. |
AnnaZivkovic
changed the title
AnnaZivkovic
force-pushed
the
rapiDASt-add-config
branch
from
85405dc to
f4a5839
Compare
AnnaZivkovic
force-pushed
the
rapiDASt-add-config
branch
from
f4a5839 to
796e93d
Compare
AnnaZivkovic
changed the title
openshift-ci
Bot
removed
the
do-not-merge/work-in-progress
- Add HTML report generation alongside JSON and SARIF formats - Optimize spider configuration to reduce false 404 warnings - Reduce maxDuration from 5 to 1 second - Explicitly specify target URL to avoid trailing slash issues - Enable multiple report formats for better visibility into scan results Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
- Add HTML report generation alongside JSON and SARIF formats - Optimize spider configuration to reduce false 404 warnings - Reduce maxDuration from 5 to 1 second - Explicitly specify target URL to avoid trailing slash issues - Enable multiple report formats for better visibility into scan results Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
|
@AnnaZivkovic: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
New Features
Chores