Skip to content

ci(crdify): change enforcement to warn for description modifications#1472

Merged
osmman merged 1 commit into
mainfrom
tturek/crdify-config
Jan 8, 2026
Merged

ci(crdify): change enforcement to warn for description modifications#1472
osmman merged 1 commit into
mainfrom
tturek/crdify-config

Conversation

@osmman
Copy link
Copy Markdown
Collaborator

@osmman osmman commented Nov 25, 2025

PR Type

Enhancement


Description

  • Upgrade crdify tool from v0.4.0 to v0.5.0

  • Add crdify configuration file with warning enforcement

  • Apply configuration to all CRD comparison commands

  • Change description validation from error to warning level


Diagram Walkthrough

flowchart LR
  A["crdify v0.4.0"] -- "upgrade to" --> B["crdify v0.5.0"]
  B -- "uses" --> C["crdify.yaml config"]
  C -- "sets enforcement" --> D["description: Warn"]
  E["All CRD comparisons"] -- "apply config" --> D
Loading

File Walkthrough

Relevant files
Configuration changes
linter.yml
Update crdify version and add config flag                               

.github/workflows/linter.yml

  • Upgrade crdify installation from v0.4.0 to v0.5.0
  • Add --config=crdify.yaml flag to all eight CRD comparison commands
  • Affected CRDs: CTlog, Fulcio, Rekor, TSA, Trillian, TUF, Securesign
+8/-8     
crdify.yaml
Add crdify configuration with warning enforcement               

crdify.yaml

  • Create new crdify configuration file
  • Define validation rule for description field
  • Set enforcement level to Warn instead of error
+3/-0     

@sourcery-ai
Copy link
Copy Markdown

sourcery-ai Bot commented Nov 25, 2025

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Updates the CI linter workflow to use crdify v0.5.0 with a shared configuration that relaxes description validation to warnings when comparing CRDs between base and head commits.

Flow diagram for updated crdify usage in linter workflow

flowchart TD
  Start[["PR opened or updated"]] --> Checkout["Checkout repository"]
  Checkout --> SetupGo["Set up Go from go.mod"]
  SetupGo --> InstallCrdify["go install sigs.k8s.io/crdify@v0.5.0"]
  InstallCrdify --> LoadConfig["Load crdify.yaml (description enforcement Warn)"]

  LoadConfig --> CompareCTlog["crdify --config=crdify.yaml compare CTlog CRD (base vs head)"]
  CompareCTlog --> CompareFulcio["crdify --config=crdify.yaml compare Fulcio CRD (base vs head)"]
  CompareFulcio --> CompareRekor["crdify --config=crdify.yaml compare Rekor CRD (base vs head)"]
  CompareRekor --> CompareTSA["crdify --config=crdify.yaml compare TSA CRD (base vs head)"]
  CompareTSA --> CompareTrillian["crdify --config=crdify.yaml compare Trillian CRD (base vs head)"]
  CompareTrillian --> CompareTUF["crdify --config=crdify.yaml compare TUF CRD (base vs head)"]
  CompareTUF --> CompareSecuresign["crdify --config=crdify.yaml compare Securesign CRD (base vs head)"]

  CompareSecuresign --> Results["crdify reports diffs; description-only changes produce warnings"]
  Results --> CIOutcome["Linter job outcome (fails on strict violations, passes with description warnings)"]
  CIOutcome --> End[["PR CI status updated"]]
Loading

File-Level Changes

Change Details Files
Upgrade crdify usage in the linter workflow to use a centralized configuration that downgrades description validation to warnings.
  • Bump crdify Go install version from v0.4.0 to v0.5.0 in the linter GitHub Actions workflow
  • Pass a shared crdify.yaml config file to all CRD comparison steps in the workflow via the --config flag
  • Introduce crdify.yaml to configure the description validation rule with enforcement set to Warn
.github/workflows/linter.yml
crdify.yaml

Tips and commands

Interacting with Sourcery

  • Trigger a new review: Comment @sourcery-ai review on the pull request.
  • Continue discussions: Reply directly to Sourcery's review comments.
  • Generate a GitHub issue from a review comment: Ask Sourcery to create an
    issue from a review comment by replying to it. You can also reply to a
    review comment with @sourcery-ai issue to create an issue from it.
  • Generate a pull request title: Write @sourcery-ai anywhere in the pull
    request title to generate a title at any time. You can also comment
    @sourcery-ai title on the pull request to (re-)generate the title at any time.
  • Generate a pull request summary: Write @sourcery-ai summary anywhere in
    the pull request body to generate a PR summary at any time exactly where you
    want it. You can also comment @sourcery-ai summary on the pull request to
    (re-)generate the summary at any time.
  • Generate reviewer's guide: Comment @sourcery-ai guide on the pull
    request to (re-)generate the reviewer's guide at any time.
  • Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
    pull request to resolve all Sourcery comments. Useful if you've already
    addressed all the comments and don't want to see them anymore.
  • Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
    request to dismiss all existing Sourcery reviews. Especially useful if you
    want to start fresh with a new review - don't forget to comment
    @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

  • Enable or disable review features such as the Sourcery-generated pull request
    summary, the reviewer's guide, and others.
  • Change the review language.
  • Add, remove or edit custom review instructions.
  • Adjust other review settings.

Getting Help

@qodo-code-review
Copy link
Copy Markdown

qodo-code-review Bot commented Nov 25, 2025

PR Compliance Guide 🔍

Below is a summary of compliance checks for this PR:

Security Compliance
🟢
No security concerns identified No security vulnerabilities detected by AI analysis. Human verification advised for critical code.
Ticket Compliance
🎫 No ticket provided
  • Create ticket/issue
Codebase Duplication Compliance
Codebase context is not defined

Follow the guide to enable codebase context checks.

Custom Compliance
🟢
Generic: Meaningful Naming and Self-Documenting Code

Objective: Ensure all identifiers clearly express their purpose and intent, making code
self-documenting

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Secure Error Handling

Objective: To prevent the leakage of sensitive system information through error messages while
providing sufficient detail for internal debugging.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Secure Logging Practices

Objective: To ensure logs are useful for debugging and auditing without exposing sensitive
information like PII, PHI, or cardholder data.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Security-First Input Validation and Data Handling

Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent
vulnerabilities

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Comprehensive Audit Trails

Objective: To create a detailed and reliable record of critical system actions for security analysis
and compliance.

Status:
No audit logs: The added CI steps upgrading and running crdify do not introduce or modify any logging of
critical actions, which may be acceptable for CI but cannot be verified from this diff
alone.

Referred Code
    go install sigs.k8s.io/crdify@v0.5.0
- name: Compare CTlog CRD
  run: |
    crdify --config=crdify.yaml "git://${{ github.event.pull_request.base.sha }}?path=config/crd/bases/rhtas.redhat.com_ctlogs.yaml" "git://${{ github.event.pull_request.head.sha }}?path=config/crd/bases/rhtas.redhat.com_ctlogs.yaml"
- name: Compare Fulcio CRD
  run: |
    crdify --config=crdify.yaml "git://${{ github.event.pull_request.base.sha }}?path=config/crd/bases/rhtas.redhat.com_fulcios.yaml" "git://${{ github.event.pull_request.head.sha }}?path=config/crd/bases/rhtas.redhat.com_fulcios.yaml"
- name: Compare Rekor CRD
  run: |
    crdify --config=crdify.yaml "git://${{ github.event.pull_request.base.sha }}?path=config/crd/bases/rhtas.redhat.com_rekors.yaml" "git://${{ github.event.pull_request.head.sha }}?path=config/crd/bases/rhtas.redhat.com_rekors.yaml"
- name: Compare TSA CRD
  run: |
    crdify --config=crdify.yaml "git://${{ github.event.pull_request.base.sha }}?path=config/crd/bases/rhtas.redhat.com_timestampauthorities.yaml" "git://${{ github.event.pull_request.head.sha }}?path=config/crd/bases/rhtas.redhat.com_timestampauthorities.yaml"
- name: Compare Trillian CRD
  run: |
    crdify --config=crdify.yaml "git://${{ github.event.pull_request.base.sha }}?path=config/crd/bases/rhtas.redhat.com_trillians.yaml" "git://${{ github.event.pull_request.head.sha }}?path=config/crd/bases/rhtas.redhat.com_trillians.yaml"
- name: Compare TUF CRD
  run: |
    crdify --config=crdify.yaml "git://${{ github.event.pull_request.base.sha }}?path=config/crd/bases/rhtas.redhat.com_tufs.yaml" "git://${{ github.event.pull_request.head.sha }}?path=config/crd/bases/rhtas.redhat.com_tufs.yaml"
- name: Compare Securesign CRD
  run: |


 ... (clipped 1 lines)

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Robust Error Handling and Edge Case Management

Objective: Ensure comprehensive error handling that provides meaningful context and graceful
degradation

Status:
Missing failure handling: The workflow steps run crdify commands without explicit error handling or conditional
checks, and it is unclear whether warnings vs errors affect job failure behavior.

Referred Code
  run: |
    crdify --config=crdify.yaml "git://${{ github.event.pull_request.base.sha }}?path=config/crd/bases/rhtas.redhat.com_ctlogs.yaml" "git://${{ github.event.pull_request.head.sha }}?path=config/crd/bases/rhtas.redhat.com_ctlogs.yaml"
- name: Compare Fulcio CRD
  run: |
    crdify --config=crdify.yaml "git://${{ github.event.pull_request.base.sha }}?path=config/crd/bases/rhtas.redhat.com_fulcios.yaml" "git://${{ github.event.pull_request.head.sha }}?path=config/crd/bases/rhtas.redhat.com_fulcios.yaml"
- name: Compare Rekor CRD
  run: |
    crdify --config=crdify.yaml "git://${{ github.event.pull_request.base.sha }}?path=config/crd/bases/rhtas.redhat.com_rekors.yaml" "git://${{ github.event.pull_request.head.sha }}?path=config/crd/bases/rhtas.redhat.com_rekors.yaml"
- name: Compare TSA CRD
  run: |
    crdify --config=crdify.yaml "git://${{ github.event.pull_request.base.sha }}?path=config/crd/bases/rhtas.redhat.com_timestampauthorities.yaml" "git://${{ github.event.pull_request.head.sha }}?path=config/crd/bases/rhtas.redhat.com_timestampauthorities.yaml"
- name: Compare Trillian CRD
  run: |
    crdify --config=crdify.yaml "git://${{ github.event.pull_request.base.sha }}?path=config/crd/bases/rhtas.redhat.com_trillians.yaml" "git://${{ github.event.pull_request.head.sha }}?path=config/crd/bases/rhtas.redhat.com_trillians.yaml"
- name: Compare TUF CRD
  run: |
    crdify --config=crdify.yaml "git://${{ github.event.pull_request.base.sha }}?path=config/crd/bases/rhtas.redhat.com_tufs.yaml" "git://${{ github.event.pull_request.head.sha }}?path=config/crd/bases/rhtas.redhat.com_tufs.yaml"
- name: Compare Securesign CRD
  run: |
    crdify --config=crdify.yaml "git://${{ github.event.pull_request.base.sha }}?path=config/crd/bases/rhtas.redhat.com_securesigns.yaml" "git://${{ github.event.pull_request.head.sha }}?path=config/crd/bases/rhtas.redhat.com_securesigns.yaml"

Learn more about managing compliance generic rules or creating your own custom rules

  • Update
Compliance status legend 🟢 - Fully Compliant
🟡 - Partial Compliant
🔴 - Not Compliant
⚪ - Requires Further Human Verification
🏷️ - Compliance label

Copy link
Copy Markdown

@sourcery-ai sourcery-ai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey there - I've reviewed your changes - here's some feedback:

  • The workflow repeats nearly identical crdify steps for each CRD; consider using a job matrix or a shell loop to reduce duplication and make it easier to add or remove CRDs in the future.
  • Since crdify is now configured via crdify.yaml, you might want to add a brief inline comment in the workflow pointing to the config file so future updates to validations are easier to discover from the CI definition.
Prompt for AI Agents
Please address the comments from this code review:

## Overall Comments
- The workflow repeats nearly identical crdify steps for each CRD; consider using a job matrix or a shell loop to reduce duplication and make it easier to add or remove CRDs in the future.
- Since crdify is now configured via crdify.yaml, you might want to add a brief inline comment in the workflow pointing to the config file so future updates to validations are easier to discover from the CI definition.

Sourcery is free for open source - if you like our reviews please consider sharing them ✨
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.

@qodo-code-review
Copy link
Copy Markdown

qodo-code-review Bot commented Nov 25, 2025

PR Code Suggestions ✨

Explore these optional code suggestions:

CategorySuggestion                                                                                                                                    Impact
General
Use a matrix to avoid duplication

Refactor the repetitive CRD comparison steps in the workflow by using a GitHub
Actions matrix strategy. This will reduce code duplication and improve
maintainability.

.github/workflows/linter.yml [35-55]

-- name: Compare CTlog CRD
+- name: Compare CRDs
+  uses: actions/glob@v1
+  id: crds
+  with:
+    files: config/crd/bases/*.yaml
+- name: Compare CRD ${{ matrix.crd }}
   run: |
-    crdify --config=crdify.yaml "git://${{ github.event.pull_request.base.sha }}?path=config/crd/bases/rhtas.redhat.com_ctlogs.yaml" "git://${{ github.event.pull_request.head.sha }}?path=config/crd/bases/rhtas.redhat.com_ctlogs.yaml"
-- name: Compare Fulcio CRD
-  run: |
-    crdify --config=crdify.yaml "git://${{ github.event.pull_request.base.sha }}?path=config/crd/bases/rhtas.redhat.com_fulcios.yaml" "git://${{ github.event.pull_request.head.sha }}?path=config/crd/bases/rhtas.redhat.com_fulcios.yaml"
-- name: Compare Rekor CRD
-  run: |
-    crdify --config=crdify.yaml "git://${{ github.event.pull_request.base.sha }}?path=config/crd/bases/rhtas.redhat.com_rekors.yaml" "git://${{ github.event.pull_request.head.sha }}?path=config/crd/bases/rhtas.redhat.com_rekors.yaml"
-- name: Compare TSA CRD
-  run: |
-    crdify --config=crdify.yaml "git://${{ github.event.pull_request.base.sha }}?path=config/crd/bases/rhtas.redhat.com_timestampauthorities.yaml" "git://${{ github.event.pull_request.head.sha }}?path=config/crd/bases/rhtas.redhat.com_timestampauthorities.yaml"
-- name: Compare Trillian CRD
-  run: |
-    crdify --config=crdify.yaml "git://${{ github.event.pull_request.base.sha }}?path=config/crd/bases/rhtas.redhat.com_trillians.yaml" "git://${{ github.event.pull_request.head.sha }}?path=config/crd/bases/rhtas.redhat.com_trillians.yaml"
-- name: Compare TUF CRD
-  run: |
-    crdify --config=crdify.yaml "git://${{ github.event.pull_request.base.sha }}?path=config/crd/bases/rhtas.redhat.com_tufs.yaml" "git://${{ github.event.pull_request.head.sha }}?path=config/crd/bases/rhtas.redhat.com_tufs.yaml"
-- name: Compare Securesign CRD
-  run: |
-    crdify --config=crdify.yaml "git://${{ github.event.pull_request.base.sha }}?path=config/crd/bases/rhtas.redhat.com_securesigns.yaml" "git://${{ github.event.pull_request.head.sha }}?path=config/crd/bases/rhtas.redhat.com_securesigns.yaml"
+    crdify --config=crdify.yaml "git://${{ github.event.pull_request.base.sha }}?path=${{ matrix.crd }}" "git://${{ github.event.pull_request.head.sha }}?path=${{ matrix.crd }}"
+  strategy:
+    matrix:
+      crd: ${{ fromJson(steps.crds.outputs.files) }}
  • Apply / Chat
Suggestion importance[1-10]: 7

__

Why: The suggestion correctly identifies significant code duplication and proposes an idiomatic refactoring using a matrix strategy, which greatly improves the workflow's maintainability and readability.

Medium
  • Update

@osmman osmman requested review from bouskaJ and knrc November 25, 2025 13:41
@knrc
Copy link
Copy Markdown
Contributor

knrc commented Nov 25, 2025

@osmman I don't understand the reason for this PR, you've just submitted a PR for the changes I had already made within #1427. If you want them submitted separately then you should say so on that PR and I can do it.

Signed-off-by: Tomas Turek <tturek@redhat.com>
@osmman osmman force-pushed the tturek/crdify-config branch from 2bfcd12 to a7187f0 Compare January 8, 2026 10:39
@osmman osmman added the test label Jan 8, 2026
@osmman osmman merged commit 761e55e into main Jan 8, 2026
14 checks passed
@osmman osmman deleted the tturek/crdify-config branch January 8, 2026 13:08
@knrc
Copy link
Copy Markdown
Contributor

knrc commented Jan 8, 2026

Not impressed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants