[DNM] Add dummy task, pipeline, and ITS for EC-2011 POC - #3476
[DNM] Add dummy task, pipeline, and ITS for EC-2011 POC#3476simonbaird wants to merge 3 commits into
Conversation
📝 WalkthroughWalkthroughAdds a configurable scenario creation script, a snapshot-processing Tekton Pipeline, and a ChangesDummy integration test flow
Checks workflow control
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant create_dummy_its.sh
participant IntegrationTestScenario
participant reqd_task_poc_ec2011
participant dummy_check
participant AttestationAction
create_dummy_its.sh->>IntegrationTestScenario: Apply scenario with Git resolver parameters
IntegrationTestScenario->>reqd_task_poc_ec2011: Start with SNAPSHOT and RESULT
reqd_task_poc_ec2011->>reqd_task_poc_ec2011: Parse containerImage URL and digest
reqd_task_poc_ec2011->>dummy_check: Pass result and image metadata
dummy_check->>AttestationAction: Submit image metadata and test output
dummy_check-->>reqd_task_poc_ec2011: Return TEST_OUTPUT
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
PR Summary by QodoAdd dummy integration test pipeline/task and ITS bootstrap script (EC-2011 POC)
AI Description
Diagram
High-Level Assessment
Files changed (3)
|
|
🤖 Review · Commit: |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@hack/create-dummy-its.sh`:
- Around line 25-26: In the reqd-task-poc-ec2011 required-task scenario, remove
the test.appstudio.openshift.io/optional label so the scenario is treated as
mandatory. Leave the remaining scenario configuration unchanged.
In `@pipelines/dummy-integration-test/0.1/dummy-integration-test.yaml`:
- Around line 51-64: Update the SNAPSHOT handling around the IMAGE extraction to
parse it as JSON, validate every component’s containerImage and required digest
separator, and reject malformed or missing values. Preserve the
image-url/image-digest contract only if SNAPSHOT is explicitly constrained to
one component; otherwise process and emit all validated components rather than
silently selecting the first one.
In `@tasks/dummy-check/0.1/dummy-check.yaml`:
- Line 66: Replace the mutable ubi-minimal:latest image reference in
tasks/dummy-check/0.1/dummy-check.yaml at lines 66-66 with an approved immutable
digest, and make the same replacement in
pipelines/dummy-integration-test/0.1/dummy-integration-test.yaml at lines 43-43.
Use the identical digest in both files.
- Around line 141-144: Pin every Git resolver revision to an approved immutable
full commit SHA: update the revision default in
tasks/dummy-check/0.1/dummy-check.yaml:141-144,
pipelines/dummy-integration-test/0.1/dummy-integration-test.yaml:81-86, and
hack/create-dummy-its.sh:8-10, replacing branch references such as main and
reqd-task-its-poc. If hack/create-dummy-its.sh enforces GIT_REVISION, validate
that the supplied value is a full commit SHA.
- Around line 122-130: Update the TEST_OUTPUT construction to use a JSON encoder
for RESULT, TIMESTAMP, NOTE, and other string fields so quotes, backslashes, and
newlines are escaped correctly. Validate SUCCESSES, FAILURES, and WARNINGS as
integers before applying %d, terminating the step for invalid values while still
accepting negative integers.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: 2155f7f0-eebb-4e9f-8e6d-45839f9106bf
📒 Files selected for processing (3)
hack/create-dummy-its.shpipelines/dummy-integration-test/0.1/dummy-integration-test.yamltasks/dummy-check/0.1/dummy-check.yaml
| labels: | ||
| test.appstudio.openshift.io/optional: "true" |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- script ---'
cat -n hack/create-dummy-its.sh
printf '%s\n' '--- related references ---'
rg -n -i --glob '!vendor/**' --glob '!node_modules/**' \
'reqd-task-poc-ec2011|test\.appstudio\.openshift\.io/optional|optional.*IntegrationTestScenario|IntegrationTestScenario|required task|required-task' .Repository: conforma/cli
Length of output: 2721
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- dummy integration-test pipeline ---'
cat -n pipelines/dummy-integration-test/0.1/dummy-integration-test.yaml
printf '%s\n' '--- enterprise-contract guidance ---'
sed -n '70,110p' pipelines/enterprise-contract/0.1/enterprise-contract.yaml
printf '%s\n' '--- all optional-label and informative references ---'
rg -n -i 'test\.appstudio\.openshift\.io/optional|informative|required.*task|task.*required|IntegrationTestScenario' \
README.md docs hack pipelines internal config .github 2>/dev/null || trueRepository: conforma/cli
Length of output: 7294
🌐 Web query:
Konflux IntegrationTestScenario test.appstudio.openshift.io/optional label required task semantics
💡 Result:
The label test.appstudio.openshift.io/optional in Konflux is used to control whether an IntegrationTestScenario is mandatory for the release process [1][2]. Its semantics are as follows: - Purpose: It specifies whether the result of a PipelineRun created by the IntegrationTestScenario must be successful for an application snapshot to be considered valid [1][3]. - Values: - "true": The integration test is marked as optional. If the test fails, it does not block the release or promotion of the application snapshot [1][4][3]. - "false": The integration test is mandatory (required). If the test fails, the application snapshot is marked as failed, which prevents its release [1][4][3]. - Default Behavior: If the label is not explicitly defined in an IntegrationTestScenario custom resource, the Konflux Integration Service defaults its value to "false", meaning all integration tests are mandatory by default [1][5][3]. - Propagation: When a test runs, this label is copied from the IntegrationTestScenario resource to the resulting PipelineRun [1][2]. By marking a test as optional, users can allow specific, non-critical tests to fail without hindering the overall automated release process [4][3].
Citations:
- 1: https://konflux-ci.dev/architecture/core/integration-service/
- 2: https://konflux-ci.dev/docs/testing/integration/creating/
- 3: https://konflux-ci.dev/docs/testing/integration/adding/
- 4: https://konflux-ci.dev/docs/testing/integration/editing/
- 5: https://pkg.go.dev/github.com/konflux-ci/integration-service/e2e-tests/pkg/constants
Remove the optional label from the required-task scenario.
The reqd-task-poc-ec2011 scenario must be mandatory to enforce required-task behavior. Remove test.appstudio.openshift.io/optional: "true".
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@hack/create-dummy-its.sh` around lines 25 - 26, In the reqd-task-poc-ec2011
required-task scenario, remove the test.appstudio.openshift.io/optional label so
the scenario is treated as mandatory. Leave the remaining scenario configuration
unchanged.
| IMAGE=$(echo "${SNAPSHOT}" | grep -oP '"containerImage"\s*:\s*"\K[^"]+' | head -1) | ||
| if [[ -z "${IMAGE}" ]]; then | ||
| echo "ERROR: No containerImage found in SNAPSHOT" >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| IMAGE_URL="${IMAGE%%@*}" | ||
| IMAGE_DIGEST="${IMAGE##*@}" | ||
|
|
||
| echo "Parsed image-url: ${IMAGE_URL}" | ||
| echo "Parsed image-digest: ${IMAGE_DIGEST}" | ||
|
|
||
| echo -n "${IMAGE_URL}" > "$(results.image-url.path)" | ||
| echo -n "${IMAGE_DIGEST}" > "$(results.image-digest.path)" |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- candidate files ---'
git ls-files | grep -E '(^|/)(pipelines/dummy-integration-test/0\.1/dummy-integration-test\.yaml|hack/create-dummy-its\.sh)$' || true
printf '%s\n' '--- YAML structure ---'
ast-grep outline pipelines/dummy-integration-test/0.1/dummy-integration-test.yaml --lang yaml || true
printf '%s\n' '--- YAML lines 1-90 ---'
cat -n pipelines/dummy-integration-test/0.1/dummy-integration-test.yaml | sed -n '1,90p'
printf '%s\n' '--- generator script ---'
if test -f hack/create-dummy-its.sh; then cat -n hack/create-dummy-its.sh | sed -n '1,180p'; fi
printf '%s\n' '--- related references ---'
rg -n -C 3 'containerImage|image-url|image-digest|dummy-integration-test|create-dummy-its|SNAPSHOT' pipelines hack README.md 2>/dev/null | sed -n '1,260p'Repository: conforma/cli
Length of output: 24835
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- dummy-check task ---'
fd -i 'dummy-check' . --type f | sort
for f in $(fd -i 'dummy-check' . --type f | sort); do
echo "--- $f ---"
wc -l "$f"
cat -n "$f" | sed -n '1,180p'
done
printf '%s\n' '--- pipeline and task result consumers ---'
rg -n -C 5 'image-digest|image-url|dummy-check|components.*containerImage|containerImage' pipelines tasks .github 2>/dev/null | sed -n '1,320p'
printf '%s\n' '--- deterministic parser probe ---'
python3 - <<'PY'
import json, re, subprocess
script = r'''set -euo pipefail
SNAPSHOT="$1"
IMAGE=$(echo "${SNAPSHOT}" | grep -oP '"containerImage"\s*:\s*"\K[^"]+' | head -1)
if [[ -z "${IMAGE}" ]]; then exit 1; fi
IMAGE_URL="${IMAGE%%@*}"
IMAGE_DIGEST="${IMAGE##*@}"
printf 'url=%s\ndigest=%s\n' "$IMAGE_URL" "$IMAGE_DIGEST"
'''
cases = {
"two components": {"components": [
{"containerImage": "quay.io/a@sha256:aaa"},
{"containerImage": "quay.io/b@sha256:bbb"},
]},
"tag only": {"components": [{"containerImage": "quay.io/a:latest"}]},
"invalid JSON with matching text": 'prefix "containerImage": "quay.io/a@sha256:aaa" suffix',
"escaped quote value": {"components": [{"containerImage": "quay.io/a@sha256:aa\\\"bb"}]},
"missing component image": {"components": [{"name": "a"}]},
}
for name, value in cases.items():
text = value if isinstance(value, str) else json.dumps(value)
p = subprocess.run(["bash", "-c", script, "parser", text], text=True,
capture_output=True)
print(f"[{name}] exit={p.returncode}")
print((p.stdout + p.stderr).strip() or "<no output>")
PYRepository: conforma/cli
Length of output: 24091
Parse and validate every Snapshot component.
Line 51 accepts non-JSON text and processes only the first containerImage. The task forwards one scalar image-url and image-digest pair, despite the contract requiring validation of every component.
If an image has no @, ${IMAGE##*@} writes the complete image reference as image-digest. Parse SNAPSHOT as JSON, validate every component, and either process all components or change the contract to require one component.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pipelines/dummy-integration-test/0.1/dummy-integration-test.yaml` around
lines 51 - 64, Update the SNAPSHOT handling around the IMAGE extraction to parse
it as JSON, validate every component’s containerImage and required digest
separator, and reject malformed or missing values. Preserve the
image-url/image-digest contract only if SNAPSHOT is explicitly constrained to
one component; otherwise process and emit all validated components rather than
silently selecting the first one.
| results: | ||
| - name: TEST_OUTPUT | ||
| description: JSON test results for consumption by subsequent steps. | ||
| image: registry.access.redhat.com/ubi9/ubi-minimal:latest |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Pin executable container images by digest.
Both steps use the mutable latest tag. A later image update can change task behavior without a repository change.
tasks/dummy-check/0.1/dummy-check.yaml#L66-L66: replaceubi-minimal:latestwith an approved immutable digest.pipelines/dummy-integration-test/0.1/dummy-integration-test.yaml#L43-L43: replaceubi-minimal:latestwith the same approved immutable digest.
📍 Affects 2 files
tasks/dummy-check/0.1/dummy-check.yaml#L66-L66(this comment)pipelines/dummy-integration-test/0.1/dummy-integration-test.yaml#L43-L43
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@tasks/dummy-check/0.1/dummy-check.yaml` at line 66, Replace the mutable
ubi-minimal:latest image reference in tasks/dummy-check/0.1/dummy-check.yaml at
lines 66-66 with an approved immutable digest, and make the same replacement in
pipelines/dummy-integration-test/0.1/dummy-integration-test.yaml at lines 43-43.
Use the identical digest in both files.
| TEST_OUTPUT=$(printf '{ | ||
| "result": "%s", | ||
| "timestamp": "%s", | ||
| "note": "%s", | ||
| "namespace": "default", | ||
| "successes": %d, | ||
| "failures": %d, | ||
| "warnings": %d | ||
| }' "${RESULT}" "${TIMESTAMP}" "${NOTE}" "${SUCCESSES}" "${FAILURES}" "${WARNINGS}") |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
file="tasks/dummy-check/0.1/dummy-check.yaml"
printf '%s\n' '--- file outline ---'
if command -v ast-grep >/dev/null 2>&1; then
ast-grep outline "$file" || true
fi
printf '%s\n' '--- relevant task sections ---'
sed -n '1,170p' "$file"
printf '%s\n' '--- TEST_OUTPUT and attestation references ---'
rg -n -C 5 'TEST_OUTPUT|attest|NOTE|SUCCESSES|FAILURES|WARNINGS' tasks/dummy-check/0.1 "$file" tasks 2>/dev/null | head -n 300Repository: conforma/cli
Length of output: 29153
🏁 Script executed:
#!/bin/bash
set -eu
run_case() {
local label="$1"
local note="$2"
local successes="$3"
local failures="$4"
local warnings="$5"
output=$(
printf '{
"result": "%s",
"timestamp": "%s",
"note": "%s",
"namespace": "default",
"successes": %d,
"failures": %d,
"warnings": %d
}' "SUCCESS" "2026-08-01T00:00:00" "$note" "$successes" "$failures" "$warnings" 2>/tmp/printf-error
) || true
printf '%s\t%s\n' "$label" "$output"
if python3 -c 'import json, sys; json.load(sys.stdin)' <<<"$output" 2>/dev/null; then
printf '%s\n' 'JSON_PARSE=valid'
else
printf '%s\n' 'JSON_PARSE=invalid'
fi
if [ -s /tmp/printf-error ]; then
printf 'PRINTF_ERROR=%s\n' "$(cat /tmp/printf-error)"
fi
}
run_case 'plain-note' 'all good' '1' '0' '0'
run_case 'quote-note' 'contains "quote"' '1' '0' '0'
run_case 'newline-note' $'contains\nnewline' '1' '0' '0'
run_case 'backslash-note' 'contains \ backslash' '1' '0' '0'
run_case 'invalid-count' 'all good' 'not-a-number' '0' '0'
run_case 'negative-count' 'all good' '-1' '0' '0'Repository: conforma/cli
Length of output: 1415
🏁 Script executed:
#!/bin/bash
set -u
set +e
bash -c '
set -euo pipefail
TEST_OUTPUT=$(printf "{\n \"successes\": %d\n}\n" "not-a-number")
printf "WRITE_REACHED=%s\n" "$TEST_OUTPUT"
'
status=$?
printf 'COMMAND_STATUS=%d\n' "$status"
bash -c '
set -euo pipefail
TEST_OUTPUT=$(printf "{\n \"successes\": %d\n}\n" "-1")
printf "WRITE_REACHED=%s\n" "$TEST_OUTPUT"
'
status=$?
printf 'NEGATIVE_COMMAND_STATUS=%d\n' "$status"Repository: conforma/cli
Length of output: 280
Serialize TEST_OUTPUT with a JSON encoder. NOTE values containing ", \, or newlines produce invalid JSON for the attestation step. Encode all string fields before constructing the object. Validate SUCCESSES, FAILURES, and WARNINGS as non-negative integers before %d; invalid values terminate the step, while negative values are accepted.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@tasks/dummy-check/0.1/dummy-check.yaml` around lines 122 - 130, Update the
TEST_OUTPUT construction to use a JSON encoder for RESULT, TIMESTAMP, NOTE, and
other string fields so quotes, backslashes, and newlines are escaped correctly.
Validate SUCCESSES, FAILURES, and WARNINGS as integers before applying %d,
terminating the step for invalid values while still accepting negative integers.
| - name: revision | ||
| value: main | ||
| - name: pathInRepo | ||
| value: stepactions/attest-test-result/0.1/attest-test-result.yaml |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
git ls-remote https://github.com/conforma/step-actions main
git ls-remote https://github.com/conforma/cli main
git ls-remote https://github.com/simonbaird/conforma-cli reqd-task-its-pocRepository: conforma/cli
Length of output: 334
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- tracked files ---'
git ls-files \
tasks/dummy-check/0.1/dummy-check.yaml \
pipelines/dummy-integration-test/0.1/dummy-integration-test.yaml \
hack/create-dummy-its.sh
printf '%s\n' '--- task definition ---'
sed -n '130,150p' tasks/dummy-check/0.1/dummy-check.yaml
printf '%s\n' '--- pipeline definition ---'
sed -n '70,95p' pipelines/dummy-integration-test/0.1/dummy-integration-test.yaml
printf '%s\n' '--- generator defaults ---'
sed -n '1,25p' hack/create-dummy-its.sh
printf '%s\n' '--- related resolver inputs ---'
rg -n -C 3 'pathInRepo|GIT_REVISION|reqd-task-its-poc|attest-test-result|dummy-integration-test' \
tasks pipelines hack .github 2>/dev/null || trueRepository: conforma/cli
Length of output: 6509
Pin every Git resolver revision to an immutable commit.
main and reqd-task-its-poc are branch references. Branch updates can change the fetched pipeline or task code without changing this scenario. Replace all three defaults with approved full commit SHAs. Validate GIT_REVISION if the script must enforce immutable revisions.
📍 Affects 3 files
tasks/dummy-check/0.1/dummy-check.yaml#L141-L144(this comment)pipelines/dummy-integration-test/0.1/dummy-integration-test.yaml#L81-L86hack/create-dummy-its.sh#L8-L10
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@tasks/dummy-check/0.1/dummy-check.yaml` around lines 141 - 144, Pin every Git
resolver revision to an approved immutable full commit SHA: update the revision
default in tasks/dummy-check/0.1/dummy-check.yaml:141-144,
pipelines/dummy-integration-test/0.1/dummy-integration-test.yaml:81-86, and
hack/create-dummy-its.sh:8-10, replacing branch references such as main and
reqd-task-its-poc. If hack/create-dummy-its.sh enforces GIT_REVISION, validate
that the supplied value is a full commit SHA.
Code Review by Qodo
1.
|
![qodo-for-conforma[bot]](https://avatars.githubusercontent.com/in/3609154?s=60&v=4){kind=small}
| TEST_OUTPUT=$(printf '{ | ||
| "result": "%s", | ||
| "timestamp": "%s", | ||
| "note": "%s", |
There was a problem hiding this comment.
2. Unescaped note breaks json 🐞 Bug ≡ Correctness
dummy-check builds JSON using printf with the unescaped NOTE parameter, so a NOTE containing quotes/newlines/backslashes produces invalid JSON and can break the attest-test-result step and any downstream consumer expecting parseable JSON.
Agent Prompt
## Issue description
The task constructs JSON with `printf ... "note": "%s" ...` but does not JSON-escape `NOTE`. Any special characters in `NOTE` can invalidate the JSON output, which is then passed as `test-output` to the attestation step.
## Issue Context
The produced JSON is both:
- written to the task result `TEST_OUTPUT`
- passed into the `attest-test-result` step action
## Fix Focus Areas
- tasks/dummy-check/0.1/dummy-check.yaml[84-134]
- tasks/dummy-check/0.1/dummy-check.yaml[145-153]
## Recommended fix
Construct the JSON via a JSON-aware tool rather than `printf`, for example:
- Switch the step image to one that includes `jq` and do:
`TEST_OUTPUT=$(jq -n --arg result "$RESULT" --arg timestamp "$TIMESTAMP" --arg note "$NOTE" --arg ns "$NAMESPACE" --argjson successes "$SUCCESSES" --argjson failures "$FAILURES" --argjson warnings "$WARNINGS" '{result:$result,timestamp:$timestamp,note:$note,namespace:$ns,successes:$successes,failures:$failures,warnings:$warnings}')`
- Or, if you keep bash-only, implement proper JSON string escaping for `NOTE` before interpolation.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
| IMAGE=$(echo "${SNAPSHOT}" | grep -oP '"containerImage"\s*:\s*"\K[^"]+' | head -1) | ||
| if [[ -z "${IMAGE}" ]]; then | ||
| echo "ERROR: No containerImage found in SNAPSHOT" >&2 | ||
| exit 1 |
There was a problem hiding this comment.
3. Only first component validated 🐞 Bug ≡ Correctness
The pipeline description claims each components[].containerImage is validated, but parse-snapshot selects only the first match (head -1) and also doesn’t validate that the image reference contains an @ digest, which can pass incorrect image-url/image-digest into the attestation step.
Agent Prompt
## Issue description
`parse-snapshot` extracts only the first `containerImage` occurrence and splits it with shell substring ops, but the pipeline’s own parameter description states that each image in the `components` array is validated.
## Issue Context
- Current implementation does: `... | head -1`, so additional components are ignored.
- If `containerImage` is a tag reference (no `@sha256:...`), `IMAGE_DIGEST` becomes the whole string and `image-url`/`image-digest` become inconsistent inputs to the attestation.
## Fix Focus Areas
- pipelines/dummy-integration-test/0.1/dummy-integration-test.yaml[12-23]
- pipelines/dummy-integration-test/0.1/dummy-integration-test.yaml[51-64]
## Recommended fix
- Parse the snapshot with a real JSON parser (e.g., `jq -r '.components[].containerImage'`).
- Either:
1) loop over all component images and run `dummy-check` once per image, OR
2) update the param description to explicitly say only the first component is used.
- Add an explicit check that `containerImage` contains `@` (and ideally `@sha256:`) before producing `image-url`/`image-digest`.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Adds a dummy-check Tekton task that produces configurable pass/fail/warn results with a test-result attestation step, a pipeline that parses a Snapshot and runs the task, and a script to create the IntegrationTestScenario in the cluster. The goal is to dogfood the new method for required tasks to be run in ITS pipelines with their results visible to Conforma with a secure chain of trust. Ref: https://redhat.atlassian.net/browse/EC-2011 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
12663f2 to
4830e00
Compare
|
🤖 Finished Review · ✅ Success · Started 10:50 PM UTC · Completed 11:08 PM UTC Commit: |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/checks-codecov.yaml:
- Line 37: Replace the constant if: false conditions for the Test, Acceptance,
and Upload jobs with the same non-constant repository or workflow variable gate
that evaluates false for the POC, ensuring actionlint accepts all three
conditions. Update .github/workflows/checks-codecov.yaml at lines 37-37,
100-100, and 169-169.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: 9bfdcb78-2264-4d55-bbda-e6753493c88b
📒 Files selected for processing (4)
.github/workflows/checks-codecov.yamlhack/create-dummy-its.shpipelines/dummy-integration-test/0.1/dummy-integration-test.yamltasks/dummy-check/0.1/dummy-check.yaml
🚧 Files skipped from review as they are similar to previous changes (3)
- tasks/dummy-check/0.1/dummy-check.yaml
- hack/create-dummy-its.sh
- pipelines/dummy-integration-test/0.1/dummy-integration-test.yaml
| jobs: | ||
|
|
||
| Test: | ||
| if: false # skipped for POC branch |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Replace the constant job conditions with one lint-valid POC gate.
actionlint rejects each constant if: false condition. Use the same non-constant repository or workflow variable gate for all three jobs. Keep the gate false for the POC.
.github/workflows/checks-codecov.yaml#L37-L37: update theTestjob condition..github/workflows/checks-codecov.yaml#L100-L100: update theAcceptancejob condition..github/workflows/checks-codecov.yaml#L169-L169: update theUploadjob condition.
🧰 Tools
🪛 actionlint (1.7.12)
[error] 37-37: constant expression "false" in condition. remove the if: section
(if-cond)
📍 Affects 1 file
.github/workflows/checks-codecov.yaml#L37-L37(this comment).github/workflows/checks-codecov.yaml#L100-L100.github/workflows/checks-codecov.yaml#L169-L169
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/checks-codecov.yaml at line 37, Replace the constant if:
false conditions for the Test, Acceptance, and Upload jobs with the same
non-constant repository or workflow variable gate that evaluates false for the
POC, ensuring actionlint accepts all three conditions. Update
.github/workflows/checks-codecov.yaml at lines 37-37, 100-100, and 169-169.
Source: Linters/SAST tools
ReviewFindingsHigh
Medium
Low
Labels: PR modifies CI workflows under .github/ (protected path) and introduces supply-chain references to personal forks for security-critical attestation steps Next steps:
Previous runReviewFindingsHigh
Medium
Low
Labels: PR modifies CI workflow (.github/), adds Tekton pipeline and task, and includes test tooling Next steps:
|
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
fullsend-ai-review
Bot
added
ci
github_actions
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
simonbaird
changed the title
|
🤖 Finished Review · ✅ Success · Started 2:13 AM UTC · Completed 2:31 AM UTC Commit: |
| jobs: | ||
|
|
||
| Test: | ||
| if: false # skipped for POC branch |
There was a problem hiding this comment.
[high] CI coverage regression
Adding if: false to the Test, Acceptance, and Upload jobs disables all test and coverage CI for every PR and push to main. The release workflow (release.yaml) triggers on workflow_run with conclusion=='success'. Since the Tools job still runs and skipped jobs do not fail the workflow, the overall conclusion will be 'success', meaning releases could proceed on every main push without any test validation.
Suggested fix: Do not merge if: false on the main branch. Keep these changes on a separate POC branch, use path-based conditions, or disable the release workflow trigger as well.
| params: | ||
| - name: url | ||
| value: https://github.com/simonbaird/conforma-cli | ||
| - name: revision |
There was a problem hiding this comment.
[high] supply chain / untrusted code source
All git resolver references across the pipeline, task, and helper script point to personal forks (simonbaird/conforma-cli and simonbaird/step-actions) on mutable branches rather than canonical org repos or pinned SHAs. This includes the attestation-creation step which is security-critical. Fork branches can be force-pushed, deleted, or compromised without review.
Suggested fix: Point references to org repos or pin to commit SHAs. At minimum, add prominent comments documenting that these are temporary POC references.
| jobs: | ||
|
|
||
| Test: | ||
| if: false # skipped for POC branch |
There was a problem hiding this comment.
[medium] scope-creep
Disabling all three CI jobs is beyond the stated intent of adding a dummy task/pipeline. The PR is marked [DNM] but is not a draft, increasing the risk of accidental merge. No documented cleanup plan or expiration date exists for the POC artifacts.
Suggested fix: Remove CI workflow changes from this PR, or convert to a draft PR.
| ;; | ||
| ERROR|SKIPPED) | ||
| SUCCESSES="0" | ||
| FAILURES="0" |
There was a problem hiding this comment.
[low] JSON injection / malformed output
TEST_OUTPUT JSON is constructed via printf with %s interpolation of the NOTE variable. If NOTE contains double quotes, backslashes, or newlines, the output will be syntactically invalid. Limited blast radius in POC context.
| FAILURE, WARNING, ERROR, or SKIPPED. | ||
| default: "SUCCESS" | ||
| results: | ||
| - name: TEST_OUTPUT |
There was a problem hiding this comment.
[low] fragile JSON parsing
parse-snapshot uses grep -oP for JSON parsing, which is fragile for minified or escaped JSON and may not be portable across all container images.
| # SPDX-License-Identifier: Apache-2.0 | ||
|
|
||
| set -euo pipefail | ||
|
|
There was a problem hiding this comment.
[low] naming-convention
Script uses set -euo pipefail but repo convention is long-form (set -o errexit; set -o nounset; set -o pipefail).
| kind: Task | ||
| metadata: | ||
| labels: | ||
| app.kubernetes.io/version: "0.1" |
There was a problem hiding this comment.
[low] code-organization
Metadata fields ordered as labels/annotations/name but existing tasks use name/annotations/labels ordering.
| # you may not use this file except in compliance with the License. | ||
| # You may obtain a copy of the License at | ||
| # | ||
| # http://www.apache.org/licenses/LICENSE-2.0 |
There was a problem hiding this comment.
[low] pattern-inconsistency
License header URL indentation uses 5 spaces vs repo convention of 6 spaces. Affects all 3 new files.
| annotations: | ||
| tekton.dev/pipelines.minVersion: "0.12.1" | ||
| tekton.dev/tags: "konflux" | ||
| name: dummy-check |
There was a problem hiding this comment.
[low] pattern-inconsistency
Tags use quoted style vs unquoted comma-separated in existing tasks. Missing blank line before spec.
1 participant
Summary
attest-test-resultstep action)reqd-task-poc-ec2011pipeline that parses a Snapshot and runs the dummy-check taskhack/create-dummy-its.shto create the IntegrationTestScenario in the clusterContext
POC for EC-2011 — dog-fooding a required task in an ITS instead of the build pipeline.
Test plan
rhtap-contract-tenantnamespace🤖 Generated with Claude Code