feat: Add cosign signature verification for Tekton Bundles#279
Merged
Conversation
Signed-off-by: Benny Zlotnik <bzlotnik@redhat.com> Assisted-by: claude-opus-4.6
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThis PR adds optional cosign-based signature verification for Tekton task bundles during secure builds. It extends the OperatorConfig API schema with verification toggles, implements a bundle verification library, wires verification into the build API and controller, improves registry credential discovery, adds comprehensive tests and documentation, and updates all tooling to Go 1.25. ChangesBundle Verification Feature
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (5)
internal/buildapi/server.go (2)
1239-1242: ⚡ Quick winMisconfiguration vs transient error are conflated as HTTP 500.
When the cosign key
ConfigMapis genuinely absent (admin enabledtaskBundleVerifywithout creating the CM), this returns 500, suggesting a server fault. The CRD requirestaskBundleCosignKeyRefwhentaskBundleVerify=true, but does not enforce that the referenced ConfigMap exists, so a missing CM is a legitimate misconfiguration. DistinguishingIsNotFoundand returning 400 would help operators diagnose without searching server logs:cm := &corev1.ConfigMap{} if err := k8sClient.Get(ctx, types.NamespacedName{Name: cosignKeyRef.Name, Namespace: namespace}, cm); err != nil { + if k8serrors.IsNotFound(err) { + return http.StatusBadRequest, fmt.Errorf("cosign key ConfigMap %q not found in namespace %q", cosignKeyRef.Name, namespace) + } return http.StatusInternalServerError, fmt.Errorf("failed to read cosign key ConfigMap %q: %w", cosignKeyRef.Name, err) }Note: this would require updating the corresponding test in
bundle_verify_test.go(which currently expects 500 for the missing-CM case).🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@internal/buildapi/server.go` around lines 1239 - 1242, The current k8sClient.Get call in the handler conflates a missing cosign key ConfigMap with server/internal errors; change the error handling around k8sClient.Get(ctx, types.NamespacedName{Name: cosignKeyRef.Name, Namespace: namespace}, cm) to detect apierrors.IsNotFound(err) and return http.StatusBadRequest with a clear message about the missing/misconfigured cosign key reference (including cosignKeyRef.Name and namespace), while keeping other errors as http.StatusInternalServerError; also update the expectation in bundle_verify_test.go for the missing-CM case to expect 400 instead of 500.
1189-1208: 💤 Low valueDefensive nil-check on
operatorConfigwould hardenresolveTaskBundleRef.
loadOperatorConfigFnis a package-level variable that test code already overrides (seebundle_verify_test.go). If a future test or implementation returns(nil, nil)(e.g., to model "no config" without an error), Line 1201 (operatorConfig.Spec.OSBuilds == nil ...) panics with NPE before the not-set 400 branch can run.operatorConfig, err := loadOperatorConfigFn(ctx, k8sClient, namespace) if err != nil { return "", http.StatusInternalServerError, fmt.Errorf("secureBuild requested but OperatorConfig could not be read: %w", err) } + if operatorConfig == nil { + return "", http.StatusInternalServerError, fmt.Errorf("secureBuild requested but OperatorConfig is nil") + }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@internal/buildapi/server.go` around lines 1189 - 1208, The code calls loadOperatorConfigFn and then dereferences operatorConfig.Spec which can NPE if loadOperatorConfigFn returns (nil, nil); update the resolveTaskBundleRef logic to check if operatorConfig == nil (and return the same 400-style error used when the config field is missing) before accessing operatorConfig.Spec or operatorConfig.Spec.OSBuilds; specifically, in the block after loadOperatorConfigFn (and before using operatorConfig.Spec.OSBuilds.TaskBundleRef) add a nil-check for operatorConfig and handle it identically to the "not set" branch so the subsequent TrimSpace/MatchString checks never dereference a nil pointer.internal/buildapi/bundle_verify_test.go (1)
127-170: ⚡ Quick winConsider adding a test for the OperatorConfig fallback path.
The current
resolveTaskBundleRefcases cover (a)SecureBuild=false, (b) explicit non-digest-pinned ref, and (c) operator-config load failure, but not the path wherereq.TaskBundleRefis empty and the resolver falls back tooperatorConfig.Spec.OSBuilds.TaskBundleRef. That branch has its own digest-pinning check (Line 1205-1206 ofserver.go) and the "OSBuilds.TaskBundleRef is not set" 400 (Line 1201-1202). A small case asserting the digest-pinned fallback resolves successfully (withTaskBundleVerify=falsesoverifyTaskBundleis skipped) would lock in that contract.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@internal/buildapi/bundle_verify_test.go` around lines 127 - 170, Add a test covering the fallback where req.TaskBundleRef is empty and resolveTaskBundleRef reads operatorConfig.Spec.OSBuilds.TaskBundleRef: stub loadOperatorConfigFn to return an automotivev1alpha1.OperatorConfig whose Spec.OSBuilds.TaskBundleRef is a digest-pinned ref and set TaskBundleVerify=false in the returned config (so verifyTaskBundle is skipped), call resolveTaskBundleRef with BuildRequest{SecureBuild:true, TaskBundleRef:""}, and assert no error, ref equals the operatorConfig ref, and status==0; also add a separate small test asserting that when operatorConfig.Spec.OSBuilds.TaskBundleRef is unset the call returns an HTTP 400 as per the OSS branch.internal/common/bundleverify/verify.go (1)
35-43: ⚡ Quick winSupport RSA and Ed25519 cosign keys by using
signature.LoadDefaultVerifier.The current code rejects valid cosign keys generated with RSA or Ed25519 (
cosign generate-key-pairdefaults to ECDSA P-256 but users can supply other keys). Replace the hard ECDSA type assertion withsignature.LoadDefaultVerifier(pubKey), which automatically selects the appropriate algorithm and hash for any supported key type. This also eliminates thehashForCurvehelper function, simplifying the code.Before implementing this change, add tests for RSA and Ed25519 key scenarios to verify the updated implementation works correctly with non-ECDSA keys.
Suggested diff
- ecdsaKey, ok := pubKey.(*ecdsa.PublicKey) - if !ok { - return fmt.Errorf("cosign public key is %T, expected *ecdsa.PublicKey", pubKey) - } - - verifier, err := signature.LoadECDSAVerifier(ecdsaKey, hashForCurve(ecdsaKey.Curve)) + verifier, err := signature.LoadDefaultVerifier(pubKey) if err != nil { - return fmt.Errorf("creating ECDSA verifier: %w", err) + return fmt.Errorf("creating verifier: %w", err) }The
hashForCurvehelper (lines 17–26) can also be removed as it is no longer needed.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@internal/common/bundleverify/verify.go` around lines 35 - 43, The code currently type-asserts pubKey to *ecdsa.PublicKey and calls signature.LoadECDSAVerifier; replace that block to call signature.LoadDefaultVerifier(pubKey) so RSA and Ed25519 keys are accepted (remove the ecdsaKey type assertion and the LoadECDSAVerifier call), and delete the now-unused hashForCurve helper; after making this change, add unit tests exercising RSA and Ed25519 cosign keys to verify signature.LoadDefaultVerifier handles those cases.cmd/caib/README.md (1)
617-629: ⚡ Quick winClarify the relationship between
--output-dirand--restore-sourcesin the rebuild workflow.The rebuild workflow shows using both
inspect -o ./rebuild/(line 620) and--restore-sources quay.io/org/my-os:v1@sha256:def...(line 627). It's not immediately clear why both are needed, since one downloads artifacts locally while the other references an OCI registry.Consider adding a brief explanation that:
- The local download (
-o ./rebuild/) provides the manifest and metadata for inspection- The
--restore-sourcesflag tells the build process to fetch archived sources from the registry at build timeThis would help users understand that they use the downloaded manifest but the build fetches sources from the OCI referrer, not from the local download.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@cmd/caib/README.md` around lines 617 - 629, The README example is ambiguous about why both `caib image inspect -o ./rebuild/` and `--restore-sources quay.io/org/my-os:...` are used; update the text near the `caib image inspect` and `caib image build` example to explicitly state that the `-o ./rebuild/` download provides the manifest and metadata (e.g., `manifest.aib.yml`) for local inspection, while the `--restore-sources` flag given to `caib image build` instructs the build to fetch archived sources from the OCI registry at build time (the build uses the local manifest but restores sources from the specified OCI referrer), so users understand both are required for inspection + reproducible rebuild.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@cmd/caib/README.md`:
- Around line 224-225: The README currently lists --reproducible and
--restore-sources for the image build and image build-dev commands but omits
them from the image disk command; update the image disk section to explicitly
state whether those flags are supported by the image disk command by either
adding the two flags to the image disk flag table (include `--reproducible` and
`--restore-sources` with matching descriptions) if they are supported, or add a
brief note under the image disk command explaining why image disk does not
support `--reproducible` and `--restore-sources` (e.g., because image disk
creates a disk from an existing container rather than performing a build),
referencing the commands `image disk`, `image build`, `image build-dev` and the
flags `--reproducible` and `--restore-sources`.
In `@go.mod`:
- Around line 20-21: Update the cosign dependency and pin fulcio to a fixed
version: change the module version for github.com/sigstore/cosign/v2 from v2.5.0
to v2.6.3 in go.mod and add an explicit replace or require to force
github.com/sigstore/fulcio to v1.8.5 (to address GHSA-59jp-pj84-45mr) so that
cosign pulls the fixed transitive dependency; after making these changes run
your vuln scanner (govulncheck/osv-scanner) and `go mod tidy` to verify the
vulnerabilities are resolved and modules are consistent.
In `@internal/common/bundleverify/verify.go`:
- Around line 30-62: The VerifyBundle function currently doesn't pass registry
auth into cosign, causing private-registry verification to fail; add a way to
inject a keychain/auth into VerifyBundle (e.g. extend signature with a new
parameter or options struct for a remote auth keychain or path to docker
config/serviceaccount token) and thread it into the cosign CheckOpts via
CheckOpts.RegistryClientOpts =
[]ociremote.RegistryClientOption{ociremote.WithRemoteOptions(remote.WithAuthFromKeychain(myKeychain))}
(or equivalent remote.WithAuthFromKeychain call) so cosign uses the provided
credentials when calling cosign.VerifyImageSignatures; also add failing unit
tests first that exercise VerifyBundle against a simulated private registry (or
mock cosign/remote) that fails without auth and succeeds when the injected
keychain is provided, then implement the fix so the tests pass.
---
Nitpick comments:
In `@cmd/caib/README.md`:
- Around line 617-629: The README example is ambiguous about why both `caib
image inspect -o ./rebuild/` and `--restore-sources quay.io/org/my-os:...` are
used; update the text near the `caib image inspect` and `caib image build`
example to explicitly state that the `-o ./rebuild/` download provides the
manifest and metadata (e.g., `manifest.aib.yml`) for local inspection, while the
`--restore-sources` flag given to `caib image build` instructs the build to
fetch archived sources from the OCI registry at build time (the build uses the
local manifest but restores sources from the specified OCI referrer), so users
understand both are required for inspection + reproducible rebuild.
In `@internal/buildapi/bundle_verify_test.go`:
- Around line 127-170: Add a test covering the fallback where req.TaskBundleRef
is empty and resolveTaskBundleRef reads
operatorConfig.Spec.OSBuilds.TaskBundleRef: stub loadOperatorConfigFn to return
an automotivev1alpha1.OperatorConfig whose Spec.OSBuilds.TaskBundleRef is a
digest-pinned ref and set TaskBundleVerify=false in the returned config (so
verifyTaskBundle is skipped), call resolveTaskBundleRef with
BuildRequest{SecureBuild:true, TaskBundleRef:""}, and assert no error, ref
equals the operatorConfig ref, and status==0; also add a separate small test
asserting that when operatorConfig.Spec.OSBuilds.TaskBundleRef is unset the call
returns an HTTP 400 as per the OSS branch.
In `@internal/buildapi/server.go`:
- Around line 1239-1242: The current k8sClient.Get call in the handler conflates
a missing cosign key ConfigMap with server/internal errors; change the error
handling around k8sClient.Get(ctx, types.NamespacedName{Name: cosignKeyRef.Name,
Namespace: namespace}, cm) to detect apierrors.IsNotFound(err) and return
http.StatusBadRequest with a clear message about the missing/misconfigured
cosign key reference (including cosignKeyRef.Name and namespace), while keeping
other errors as http.StatusInternalServerError; also update the expectation in
bundle_verify_test.go for the missing-CM case to expect 400 instead of 500.
- Around line 1189-1208: The code calls loadOperatorConfigFn and then
dereferences operatorConfig.Spec which can NPE if loadOperatorConfigFn returns
(nil, nil); update the resolveTaskBundleRef logic to check if operatorConfig ==
nil (and return the same 400-style error used when the config field is missing)
before accessing operatorConfig.Spec or operatorConfig.Spec.OSBuilds;
specifically, in the block after loadOperatorConfigFn (and before using
operatorConfig.Spec.OSBuilds.TaskBundleRef) add a nil-check for operatorConfig
and handle it identically to the "not set" branch so the subsequent
TrimSpace/MatchString checks never dereference a nil pointer.
In `@internal/common/bundleverify/verify.go`:
- Around line 35-43: The code currently type-asserts pubKey to *ecdsa.PublicKey
and calls signature.LoadECDSAVerifier; replace that block to call
signature.LoadDefaultVerifier(pubKey) so RSA and Ed25519 keys are accepted
(remove the ecdsaKey type assertion and the LoadECDSAVerifier call), and delete
the now-unused hashForCurve helper; after making this change, add unit tests
exercising RSA and Ed25519 cosign keys to verify signature.LoadDefaultVerifier
handles those cases.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 185b93f6-5405-4e4e-ac8f-094430ccb916
⛔ Files ignored due to path filters (291)
config/crd/bases/automotive.sdv.cloud.redhat.com_operatorconfigs.yamlis excluded by!config/crd/bases/**go.sumis excluded by!**/*.sum,!**go.sumvendor/github.com/asaskevich/govalidator/.gitignoreis excluded by!vendor/**vendor/github.com/asaskevich/govalidator/.travis.ymlis excluded by!vendor/**vendor/github.com/asaskevich/govalidator/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/asaskevich/govalidator/CONTRIBUTING.mdis excluded by!vendor/**vendor/github.com/asaskevich/govalidator/LICENSEis excluded by!vendor/**vendor/github.com/asaskevich/govalidator/README.mdis excluded by!vendor/**vendor/github.com/asaskevich/govalidator/arrays.gois excluded by!vendor/**vendor/github.com/asaskevich/govalidator/converter.gois excluded by!vendor/**vendor/github.com/asaskevich/govalidator/doc.gois excluded by!vendor/**vendor/github.com/asaskevich/govalidator/error.gois excluded by!vendor/**vendor/github.com/asaskevich/govalidator/numerics.gois excluded by!vendor/**vendor/github.com/asaskevich/govalidator/patterns.gois excluded by!vendor/**vendor/github.com/asaskevich/govalidator/types.gois excluded by!vendor/**vendor/github.com/asaskevich/govalidator/utils.gois excluded by!vendor/**vendor/github.com/asaskevich/govalidator/validator.gois excluded by!vendor/**vendor/github.com/asaskevich/govalidator/wercker.ymlis excluded by!vendor/**vendor/github.com/blang/semver/.travis.ymlis excluded by!vendor/**vendor/github.com/blang/semver/LICENSEis excluded by!vendor/**vendor/github.com/blang/semver/README.mdis excluded by!vendor/**vendor/github.com/blang/semver/json.gois excluded by!vendor/**vendor/github.com/blang/semver/package.jsonis excluded by!vendor/**vendor/github.com/blang/semver/range.gois excluded by!vendor/**vendor/github.com/blang/semver/semver.gois excluded by!vendor/**vendor/github.com/blang/semver/sort.gois excluded by!vendor/**vendor/github.com/blang/semver/sql.gois excluded by!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/LICENSEis excluded by!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/build.gois excluded by!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/errorutil/errors.gois excluded by!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/estargz.gois excluded by!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/gzip.gois excluded by!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/testutil.gois excluded by!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/types.gois excluded by!vendor/**vendor/github.com/digitorus/pkcs7/.gitignoreis excluded by!vendor/**vendor/github.com/digitorus/pkcs7/LICENSEis excluded by!vendor/**vendor/github.com/digitorus/pkcs7/Makefileis excluded by!vendor/**vendor/github.com/digitorus/pkcs7/README.mdis excluded by!vendor/**vendor/github.com/digitorus/pkcs7/ber.gois excluded by!vendor/**vendor/github.com/digitorus/pkcs7/decrypt.gois excluded by!vendor/**vendor/github.com/digitorus/pkcs7/encrypt.gois excluded by!vendor/**vendor/github.com/digitorus/pkcs7/pkcs7.gois excluded by!vendor/**vendor/github.com/digitorus/pkcs7/sign.gois excluded by!vendor/**vendor/github.com/digitorus/pkcs7/verify.gois excluded by!vendor/**vendor/github.com/digitorus/pkcs7/verify_test_dsa.gois excluded by!vendor/**vendor/github.com/digitorus/timestamp/LICENSEis excluded by!vendor/**vendor/github.com/digitorus/timestamp/README.mdis excluded by!vendor/**vendor/github.com/digitorus/timestamp/borrowed.gois excluded by!vendor/**vendor/github.com/digitorus/timestamp/rfc3161_struct.gois excluded by!vendor/**vendor/github.com/digitorus/timestamp/signing_cert_v2_struct.gois excluded by!vendor/**vendor/github.com/digitorus/timestamp/timestamp.gois excluded by!vendor/**vendor/github.com/docker/cli/AUTHORSis excluded by!vendor/**vendor/github.com/docker/cli/LICENSEis excluded by!vendor/**vendor/github.com/docker/cli/NOTICEis excluded by!vendor/**vendor/github.com/docker/cli/cli/config/config.gois excluded by!vendor/**vendor/github.com/docker/cli/cli/config/configfile/file.gois excluded by!vendor/**vendor/github.com/docker/cli/cli/config/configfile/file_unix.gois excluded by!vendor/**vendor/github.com/docker/cli/cli/config/configfile/file_windows.gois excluded by!vendor/**vendor/github.com/docker/cli/cli/config/credentials/credentials.gois excluded by!vendor/**vendor/github.com/docker/cli/cli/config/credentials/default_store.gois excluded by!vendor/**vendor/github.com/docker/cli/cli/config/credentials/default_store_darwin.gois excluded by!vendor/**vendor/github.com/docker/cli/cli/config/credentials/default_store_linux.gois excluded by!vendor/**vendor/github.com/docker/cli/cli/config/credentials/default_store_unsupported.gois excluded by!vendor/**vendor/github.com/docker/cli/cli/config/credentials/default_store_windows.gois excluded by!vendor/**vendor/github.com/docker/cli/cli/config/credentials/file_store.gois excluded by!vendor/**vendor/github.com/docker/cli/cli/config/credentials/native_store.gois excluded by!vendor/**vendor/github.com/docker/cli/cli/config/memorystore/store.gois excluded by!vendor/**vendor/github.com/docker/cli/cli/config/types/authconfig.gois excluded by!vendor/**vendor/github.com/docker/distribution/registry/client/auth/challenge/addr.gois excluded by!vendor/**vendor/github.com/docker/distribution/registry/client/auth/challenge/authchallenge.gois excluded by!vendor/**vendor/github.com/dustin/go-humanize/.travis.ymlis excluded by!vendor/**vendor/github.com/dustin/go-humanize/LICENSEis excluded by!vendor/**vendor/github.com/dustin/go-humanize/README.markdownis excluded by!vendor/**vendor/github.com/dustin/go-humanize/big.gois excluded by!vendor/**vendor/github.com/dustin/go-humanize/bigbytes.gois excluded by!vendor/**vendor/github.com/dustin/go-humanize/bytes.gois excluded by!vendor/**vendor/github.com/dustin/go-humanize/comma.gois excluded by!vendor/**vendor/github.com/dustin/go-humanize/commaf.gois excluded by!vendor/**vendor/github.com/dustin/go-humanize/ftoa.gois excluded by!vendor/**vendor/github.com/dustin/go-humanize/humanize.gois excluded by!vendor/**vendor/github.com/dustin/go-humanize/number.gois excluded by!vendor/**vendor/github.com/dustin/go-humanize/ordinals.gois excluded by!vendor/**vendor/github.com/dustin/go-humanize/si.gois excluded by!vendor/**vendor/github.com/dustin/go-humanize/times.gois excluded by!vendor/**vendor/github.com/go-chi/chi/.gitignoreis excluded by!vendor/**vendor/github.com/go-chi/chi/.travis.ymlis excluded by!vendor/**vendor/github.com/go-chi/chi/CHANGELOG.mdis excluded by!vendor/**vendor/github.com/go-chi/chi/CONTRIBUTING.mdis excluded by!vendor/**vendor/github.com/go-chi/chi/LICENSEis excluded by!vendor/**vendor/github.com/go-chi/chi/README.mdis excluded by!vendor/**vendor/github.com/go-chi/chi/chain.gois excluded by!vendor/**vendor/github.com/go-chi/chi/chi.gois excluded by!vendor/**vendor/github.com/go-chi/chi/context.gois excluded by!vendor/**vendor/github.com/go-chi/chi/middleware/basic_auth.gois excluded by!vendor/**vendor/github.com/go-chi/chi/middleware/compress.gois excluded by!vendor/**vendor/github.com/go-chi/chi/middleware/content_charset.gois excluded by!vendor/**vendor/github.com/go-chi/chi/middleware/content_encoding.gois excluded by!vendor/**vendor/github.com/go-chi/chi/middleware/content_type.gois excluded by!vendor/**vendor/github.com/go-chi/chi/middleware/get_head.gois excluded by!vendor/**vendor/github.com/go-chi/chi/middleware/heartbeat.gois excluded by!vendor/**vendor/github.com/go-chi/chi/middleware/logger.gois excluded by!vendor/**vendor/github.com/go-chi/chi/middleware/middleware.gois excluded by!vendor/**vendor/github.com/go-chi/chi/middleware/nocache.gois excluded by!vendor/**vendor/github.com/go-chi/chi/middleware/profiler.gois excluded by!vendor/**vendor/github.com/go-chi/chi/middleware/realip.gois excluded by!vendor/**vendor/github.com/go-chi/chi/middleware/recoverer.gois excluded by!vendor/**vendor/github.com/go-chi/chi/middleware/request_id.gois excluded by!vendor/**vendor/github.com/go-chi/chi/middleware/route_headers.gois excluded by!vendor/**vendor/github.com/go-chi/chi/middleware/strip.gois excluded by!vendor/**vendor/github.com/go-chi/chi/middleware/terminal.gois excluded by!vendor/**vendor/github.com/go-chi/chi/middleware/throttle.gois excluded by!vendor/**vendor/github.com/go-chi/chi/middleware/timeout.gois excluded by!vendor/**vendor/github.com/go-chi/chi/middleware/url_format.gois excluded by!vendor/**vendor/github.com/go-chi/chi/middleware/value.gois excluded by!vendor/**vendor/github.com/go-chi/chi/middleware/wrap_writer.gois excluded by!vendor/**vendor/github.com/go-chi/chi/mux.gois excluded by!vendor/**vendor/github.com/go-chi/chi/tree.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/.codecov.ymlis excluded by!vendor/**vendor/github.com/go-openapi/analysis/.gitattributesis excluded by!vendor/**vendor/github.com/go-openapi/analysis/.gitignoreis excluded by!vendor/**vendor/github.com/go-openapi/analysis/.golangci.ymlis excluded by!vendor/**vendor/github.com/go-openapi/analysis/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/go-openapi/analysis/LICENSEis excluded by!vendor/**vendor/github.com/go-openapi/analysis/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/analysis/analyzer.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/debug.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/doc.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/fixer.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/flatten.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/flatten_name.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/flatten_options.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/internal/debug/debug.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/internal/flatten/normalize/normalize.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/internal/flatten/operations/operations.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/internal/flatten/replace/replace.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/internal/flatten/schutils/flatten_schema.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/internal/flatten/sortref/keys.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/internal/flatten/sortref/sort_ref.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/mixin.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/schema.gois excluded by!vendor/**vendor/github.com/go-openapi/errors/.gitattributesis excluded by!vendor/**vendor/github.com/go-openapi/errors/.gitignoreis excluded by!vendor/**vendor/github.com/go-openapi/errors/.golangci.ymlis excluded by!vendor/**vendor/github.com/go-openapi/errors/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/go-openapi/errors/LICENSEis excluded by!vendor/**vendor/github.com/go-openapi/errors/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/errors/api.gois excluded by!vendor/**vendor/github.com/go-openapi/errors/auth.gois excluded by!vendor/**vendor/github.com/go-openapi/errors/doc.gois excluded by!vendor/**vendor/github.com/go-openapi/errors/headers.gois excluded by!vendor/**vendor/github.com/go-openapi/errors/middleware.gois excluded by!vendor/**vendor/github.com/go-openapi/errors/parsing.gois excluded by!vendor/**vendor/github.com/go-openapi/errors/schema.gois excluded by!vendor/**vendor/github.com/go-openapi/loads/.editorconfigis excluded by!vendor/**vendor/github.com/go-openapi/loads/.gitignoreis excluded by!vendor/**vendor/github.com/go-openapi/loads/.golangci.ymlis excluded by!vendor/**vendor/github.com/go-openapi/loads/.travis.ymlis excluded by!vendor/**vendor/github.com/go-openapi/loads/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/go-openapi/loads/LICENSEis excluded by!vendor/**vendor/github.com/go-openapi/loads/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/loads/doc.gois excluded by!vendor/**vendor/github.com/go-openapi/loads/loaders.gois excluded by!vendor/**vendor/github.com/go-openapi/loads/options.gois excluded by!vendor/**vendor/github.com/go-openapi/loads/spec.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/.editorconfigis excluded by!vendor/**vendor/github.com/go-openapi/runtime/.gitattributesis excluded by!vendor/**vendor/github.com/go-openapi/runtime/.gitignoreis excluded by!vendor/**vendor/github.com/go-openapi/runtime/.golangci.ymlis excluded by!vendor/**vendor/github.com/go-openapi/runtime/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/go-openapi/runtime/LICENSEis excluded by!vendor/**vendor/github.com/go-openapi/runtime/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/runtime/bytestream.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client/auth_info.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client/keepalive.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client/opentelemetry.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client/opentracing.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client/request.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client/response.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client/runtime.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client_auth_info.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client_operation.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client_request.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client_response.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/constants.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/csv.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/csv_options.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/discard.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/file.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/headers.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/interfaces.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/json.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/logger/logger.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/logger/standard.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/context.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/denco/LICENSEis excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/denco/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/denco/router.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/denco/server.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/denco/util.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/doc.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/header/header.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/negotiate.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/not_implemented.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/operation.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/parameter.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/rapidoc.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/redoc.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/request.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/router.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/security.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/spec.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/swaggerui.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/swaggerui_oauth2.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/ui_options.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/untyped/api.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/validation.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/request.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/security/authenticator.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/security/authorizer.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/statuses.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/text.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/values.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/xml.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/yamlpc/yaml.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/.editorconfigis excluded by!vendor/**vendor/github.com/go-openapi/spec/.gitignoreis excluded by!vendor/**vendor/github.com/go-openapi/spec/.golangci.ymlis excluded by!vendor/**vendor/github.com/go-openapi/spec/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/go-openapi/spec/LICENSEis excluded by!vendor/**vendor/github.com/go-openapi/spec/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/spec/cache.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/contact_info.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/debug.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/embed.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/errors.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/expander.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/external_docs.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/header.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/info.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/items.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/license.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/normalizer.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/normalizer_nonwindows.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/normalizer_windows.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/operation.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/parameter.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/path_item.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/paths.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/properties.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/ref.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/resolver.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/response.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/responses.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/schema.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/schema_loader.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/schemas/jsonschema-draft-04.jsonis excluded by!vendor/**vendor/github.com/go-openapi/spec/schemas/v2/schema.jsonis excluded by!vendor/**vendor/github.com/go-openapi/spec/security_scheme.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/spec.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/swagger.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/tag.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/url_go19.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/validations.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/xml_object.gois excluded by!vendor/**vendor/github.com/go-openapi/strfmt/.editorconfigis excluded by!vendor/**vendor/github.com/go-openapi/strfmt/.gitattributesis excluded by!vendor/**vendor/github.com/go-openapi/strfmt/.gitignoreis excluded by!vendor/**vendor/github.com/go-openapi/strfmt/.golangci.ymlis excluded by!vendor/**vendor/github.com/go-openapi/strfmt/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/go-openapi/strfmt/LICENSEis excluded by!vendor/**vendor/github.com/go-openapi/strfmt/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/strfmt/bson.gois excluded by!vendor/**vendor/github.com/go-openapi/strfmt/date.gois excluded by!vendor/**vendor/github.com/go-openapi/strfmt/default.gois excluded by!vendor/**vendor/github.com/go-openapi/strfmt/doc.gois excluded by!vendor/**vendor/github.com/go-openapi/strfmt/duration.gois excluded by!vendor/**vendor/github.com/go-openapi/strfmt/format.gois excluded by!vendor/**vendor/github.com/go-openapi/strfmt/time.gois excluded by!vendor/**vendor/github.com/go-openapi/strfmt/ulid.gois excluded by!vendor/**vendor/github.com/go-openapi/validate/.editorconfigis excluded by!vendor/**vendor/github.com/go-openapi/validate/.gitattributesis excluded by!vendor/**vendor/github.com/go-openapi/validate/.gitignoreis excluded by!vendor/**vendor/github.com/go-openapi/validate/.golangci.ymlis excluded by!vendor/**vendor/github.com/go-openapi/validate/BENCHMARK.mdis excluded by!vendor/**vendor/github.com/go-openapi/validate/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/go-openapi/validate/LICENSEis excluded by!vendor/**vendor/github.com/go-openapi/validate/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/validate/context.gois excluded by!vendor/**vendor/github.com/go-openapi/validate/debug.gois excluded by!vendor/**vendor/github.com/go-openapi/validate/default_validator.gois excluded by!vendor/**vendor/github.com/go-openapi/validate/doc.gois excluded by!vendor/**
📒 Files selected for processing (9)
api/v1alpha1/operatorconfig_types.goapi/v1alpha1/zz_generated.deepcopy.gocmd/caib/README.mdcmd/caib/inspectcmd/inspect.gocmd/caib/registryauth/loader.gogo.modinternal/buildapi/bundle_verify_test.gointernal/buildapi/server.gointernal/common/bundleverify/verify.go
Contributor
Author
|
@ambient-code please review |
Contributor
Author
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 203: The go.mod currently pins github.com/tektoncd/pipeline at v1.6.0
which is vulnerable; update the dependency line for github.com/tektoncd/pipeline
to a fixed version (minimum v1.11.1, preferably the current stable v1.12.0),
then run your module update (e.g., go get or the equivalent) and go mod tidy to
refresh the lockfile and vendor data; after updating, run unit/integration tests
and verify any pipeline API changes in call sites that import
github.com/tektoncd/pipeline to fix compilation or behavioral regressions.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 6a5a4aeb-6b2b-4d88-8edb-60ddbf0b11e7
⛔ Files ignored due to path filters (283)
config/crd/bases/automotive.sdv.cloud.redhat.com_operatorconfigs.yamlis excluded by!config/crd/bases/**config/crd/bases/automotive.sdv.cloud.redhat.com_workspaces.yamlis excluded by!config/crd/bases/**go.sumis excluded by!**/*.sum,!**go.sumvendor/github.com/Azure/go-ansiterm/LICENSEis excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/README.mdis excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/SECURITY.mdis excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/constants.gois excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/context.gois excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/csi_entry_state.gois excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/csi_param_state.gois excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/escape_intermediate_state.gois excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/escape_state.gois excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/event_handler.gois excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/ground_state.gois excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/osc_string_state.gois excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/parser.gois excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/parser_action_helpers.gois excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/parser_actions.gois excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/states.gois excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/utilities.gois excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/winterm/ansi.gois excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/winterm/api.gois excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/winterm/attr_translation.gois excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/winterm/cursor_helpers.gois excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/winterm/erase_helpers.gois excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/winterm/scroll_helper.gois excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/winterm/utilities.gois excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/winterm/win_event_handler.gois excluded by!vendor/**vendor/github.com/asaskevich/govalidator/.gitignoreis excluded by!vendor/**vendor/github.com/asaskevich/govalidator/.travis.ymlis excluded by!vendor/**vendor/github.com/asaskevich/govalidator/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/asaskevich/govalidator/CONTRIBUTING.mdis excluded by!vendor/**vendor/github.com/asaskevich/govalidator/LICENSEis excluded by!vendor/**vendor/github.com/asaskevich/govalidator/README.mdis excluded by!vendor/**vendor/github.com/asaskevich/govalidator/arrays.gois excluded by!vendor/**vendor/github.com/asaskevich/govalidator/converter.gois excluded by!vendor/**vendor/github.com/asaskevich/govalidator/doc.gois excluded by!vendor/**vendor/github.com/asaskevich/govalidator/error.gois excluded by!vendor/**vendor/github.com/asaskevich/govalidator/numerics.gois excluded by!vendor/**vendor/github.com/asaskevich/govalidator/patterns.gois excluded by!vendor/**vendor/github.com/asaskevich/govalidator/types.gois excluded by!vendor/**vendor/github.com/asaskevich/govalidator/utils.gois excluded by!vendor/**vendor/github.com/asaskevich/govalidator/validator.gois excluded by!vendor/**vendor/github.com/asaskevich/govalidator/wercker.ymlis excluded by!vendor/**vendor/github.com/blang/semver/.travis.ymlis excluded by!vendor/**vendor/github.com/blang/semver/LICENSEis excluded by!vendor/**vendor/github.com/blang/semver/README.mdis excluded by!vendor/**vendor/github.com/blang/semver/json.gois excluded by!vendor/**vendor/github.com/blang/semver/package.jsonis excluded by!vendor/**vendor/github.com/blang/semver/range.gois excluded by!vendor/**vendor/github.com/blang/semver/semver.gois excluded by!vendor/**vendor/github.com/blang/semver/sort.gois excluded by!vendor/**vendor/github.com/blang/semver/sql.gois excluded by!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/LICENSEis excluded by!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/build.gois excluded by!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/errorutil/errors.gois excluded by!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/estargz.gois excluded by!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/gzip.gois excluded by!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/testutil.gois excluded by!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/types.gois excluded by!vendor/**vendor/github.com/coreos/go-oidc/v3/LICENSEis excluded by!vendor/**vendor/github.com/coreos/go-oidc/v3/NOTICEis excluded by!vendor/**vendor/github.com/coreos/go-oidc/v3/oidc/jose.gois excluded by!vendor/**vendor/github.com/coreos/go-oidc/v3/oidc/jwks.gois excluded by!vendor/**vendor/github.com/coreos/go-oidc/v3/oidc/oidc.gois excluded by!vendor/**vendor/github.com/coreos/go-oidc/v3/oidc/verify.gois excluded by!vendor/**vendor/github.com/digitorus/pkcs7/.gitignoreis excluded by!vendor/**vendor/github.com/digitorus/pkcs7/LICENSEis excluded by!vendor/**vendor/github.com/digitorus/pkcs7/Makefileis excluded by!vendor/**vendor/github.com/digitorus/pkcs7/README.mdis excluded by!vendor/**vendor/github.com/digitorus/pkcs7/ber.gois excluded by!vendor/**vendor/github.com/digitorus/pkcs7/decrypt.gois excluded by!vendor/**vendor/github.com/digitorus/pkcs7/encrypt.gois excluded by!vendor/**vendor/github.com/digitorus/pkcs7/pkcs7.gois excluded by!vendor/**vendor/github.com/digitorus/pkcs7/sign.gois excluded by!vendor/**vendor/github.com/digitorus/pkcs7/verify.gois excluded by!vendor/**vendor/github.com/digitorus/pkcs7/verify_test_dsa.gois excluded by!vendor/**vendor/github.com/digitorus/timestamp/LICENSEis excluded by!vendor/**vendor/github.com/digitorus/timestamp/README.mdis excluded by!vendor/**vendor/github.com/digitorus/timestamp/borrowed.gois excluded by!vendor/**vendor/github.com/digitorus/timestamp/rfc3161_struct.gois excluded by!vendor/**vendor/github.com/digitorus/timestamp/signing_cert_v2_struct.gois excluded by!vendor/**vendor/github.com/digitorus/timestamp/timestamp.gois excluded by!vendor/**vendor/github.com/docker/cli/AUTHORSis excluded by!vendor/**vendor/github.com/docker/cli/LICENSEis excluded by!vendor/**vendor/github.com/docker/cli/NOTICEis excluded by!vendor/**vendor/github.com/docker/cli/cli/config/config.gois excluded by!vendor/**vendor/github.com/docker/cli/cli/config/configfile/file.gois excluded by!vendor/**vendor/github.com/docker/cli/cli/config/configfile/file_unix.gois excluded by!vendor/**vendor/github.com/docker/cli/cli/config/configfile/file_windows.gois excluded by!vendor/**vendor/github.com/docker/cli/cli/config/credentials/credentials.gois excluded by!vendor/**vendor/github.com/docker/cli/cli/config/credentials/default_store.gois excluded by!vendor/**vendor/github.com/docker/cli/cli/config/credentials/default_store_darwin.gois excluded by!vendor/**vendor/github.com/docker/cli/cli/config/credentials/default_store_linux.gois excluded by!vendor/**vendor/github.com/docker/cli/cli/config/credentials/default_store_unsupported.gois excluded by!vendor/**vendor/github.com/docker/cli/cli/config/credentials/default_store_windows.gois excluded by!vendor/**vendor/github.com/docker/cli/cli/config/credentials/file_store.gois excluded by!vendor/**vendor/github.com/docker/cli/cli/config/credentials/native_store.gois excluded by!vendor/**vendor/github.com/docker/cli/cli/config/memorystore/store.gois excluded by!vendor/**vendor/github.com/docker/cli/cli/config/types/authconfig.gois excluded by!vendor/**vendor/github.com/docker/distribution/registry/client/auth/challenge/addr.gois excluded by!vendor/**vendor/github.com/docker/distribution/registry/client/auth/challenge/authchallenge.gois excluded by!vendor/**vendor/github.com/dustin/go-humanize/.travis.ymlis excluded by!vendor/**vendor/github.com/dustin/go-humanize/LICENSEis excluded by!vendor/**vendor/github.com/dustin/go-humanize/README.markdownis excluded by!vendor/**vendor/github.com/dustin/go-humanize/big.gois excluded by!vendor/**vendor/github.com/dustin/go-humanize/bigbytes.gois excluded by!vendor/**vendor/github.com/dustin/go-humanize/bytes.gois excluded by!vendor/**vendor/github.com/dustin/go-humanize/comma.gois excluded by!vendor/**vendor/github.com/dustin/go-humanize/commaf.gois excluded by!vendor/**vendor/github.com/dustin/go-humanize/ftoa.gois excluded by!vendor/**vendor/github.com/dustin/go-humanize/humanize.gois excluded by!vendor/**vendor/github.com/dustin/go-humanize/number.gois excluded by!vendor/**vendor/github.com/dustin/go-humanize/ordinals.gois excluded by!vendor/**vendor/github.com/dustin/go-humanize/si.gois excluded by!vendor/**vendor/github.com/dustin/go-humanize/times.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/.gitignoreis excluded by!vendor/**vendor/github.com/go-chi/chi/v5/CHANGELOG.mdis excluded by!vendor/**vendor/github.com/go-chi/chi/v5/CONTRIBUTING.mdis excluded by!vendor/**vendor/github.com/go-chi/chi/v5/LICENSEis excluded by!vendor/**vendor/github.com/go-chi/chi/v5/Makefileis excluded by!vendor/**vendor/github.com/go-chi/chi/v5/README.mdis excluded by!vendor/**vendor/github.com/go-chi/chi/v5/SECURITY.mdis excluded by!vendor/**vendor/github.com/go-chi/chi/v5/chain.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/chi.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/context.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/basic_auth.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/clean_path.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/compress.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/content_charset.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/content_encoding.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/content_type.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/get_head.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/heartbeat.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/logger.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/maybe.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/middleware.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/nocache.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/page_route.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/path_rewrite.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/profiler.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/realip.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/recoverer.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/request_id.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/request_size.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/route_headers.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/strip.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/sunset.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/supress_notfound.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/terminal.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/throttle.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/timeout.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/url_format.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/value.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/wrap_writer.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/mux.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/path_value.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/path_value_fallback.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/pattern.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/pattern_fallback.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/tree.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/.codecov.ymlis excluded by!vendor/**vendor/github.com/go-openapi/analysis/.gitattributesis excluded by!vendor/**vendor/github.com/go-openapi/analysis/.gitignoreis excluded by!vendor/**vendor/github.com/go-openapi/analysis/.golangci.ymlis excluded by!vendor/**vendor/github.com/go-openapi/analysis/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/go-openapi/analysis/LICENSEis excluded by!vendor/**vendor/github.com/go-openapi/analysis/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/analysis/analyzer.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/debug.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/doc.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/errors.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/fixer.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/flatten.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/flatten_name.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/flatten_options.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/internal/debug/debug.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/internal/flatten/normalize/normalize.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/internal/flatten/operations/operations.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/internal/flatten/replace/errors.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/internal/flatten/replace/replace.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/internal/flatten/schutils/flatten_schema.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/internal/flatten/sortref/keys.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/internal/flatten/sortref/sort_ref.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/mixin.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/schema.gois excluded by!vendor/**vendor/github.com/go-openapi/errors/.gitattributesis excluded by!vendor/**vendor/github.com/go-openapi/errors/.gitignoreis excluded by!vendor/**vendor/github.com/go-openapi/errors/.golangci.ymlis excluded by!vendor/**vendor/github.com/go-openapi/errors/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/go-openapi/errors/LICENSEis excluded by!vendor/**vendor/github.com/go-openapi/errors/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/errors/api.gois excluded by!vendor/**vendor/github.com/go-openapi/errors/auth.gois excluded by!vendor/**vendor/github.com/go-openapi/errors/doc.gois excluded by!vendor/**vendor/github.com/go-openapi/errors/headers.gois excluded by!vendor/**vendor/github.com/go-openapi/errors/middleware.gois excluded by!vendor/**vendor/github.com/go-openapi/errors/parsing.gois excluded by!vendor/**vendor/github.com/go-openapi/errors/schema.gois excluded by!vendor/**vendor/github.com/go-openapi/jsonpointer/.golangci.ymlis excluded by!vendor/**vendor/github.com/go-openapi/jsonpointer/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/jsonpointer/pointer.gois excluded by!vendor/**vendor/github.com/go-openapi/jsonreference/.golangci.ymlis excluded by!vendor/**vendor/github.com/go-openapi/jsonreference/NOTICEis excluded by!vendor/**vendor/github.com/go-openapi/jsonreference/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/jsonreference/internal/normalize_url.gois excluded by!vendor/**vendor/github.com/go-openapi/jsonreference/reference.gois excluded by!vendor/**vendor/github.com/go-openapi/loads/.editorconfigis excluded by!vendor/**vendor/github.com/go-openapi/loads/.gitignoreis excluded by!vendor/**vendor/github.com/go-openapi/loads/.golangci.ymlis excluded by!vendor/**vendor/github.com/go-openapi/loads/.travis.ymlis excluded by!vendor/**vendor/github.com/go-openapi/loads/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/go-openapi/loads/LICENSEis excluded by!vendor/**vendor/github.com/go-openapi/loads/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/loads/doc.gois excluded by!vendor/**vendor/github.com/go-openapi/loads/errors.gois excluded by!vendor/**vendor/github.com/go-openapi/loads/loaders.gois excluded by!vendor/**vendor/github.com/go-openapi/loads/options.gois excluded by!vendor/**vendor/github.com/go-openapi/loads/spec.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/.editorconfigis excluded by!vendor/**vendor/github.com/go-openapi/runtime/.gitattributesis excluded by!vendor/**vendor/github.com/go-openapi/runtime/.gitignoreis excluded by!vendor/**vendor/github.com/go-openapi/runtime/.golangci.ymlis excluded by!vendor/**vendor/github.com/go-openapi/runtime/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/go-openapi/runtime/LICENSEis excluded by!vendor/**vendor/github.com/go-openapi/runtime/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/runtime/bytestream.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client/auth_info.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client/keepalive.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client/opentelemetry.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client/request.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client/response.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client/runtime.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client_auth_info.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client_operation.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client_request.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client_response.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/constants.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/csv.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/csv_options.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/discard.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/file.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/go.work.sumis excluded by!**/*.sum,!vendor/**vendor/github.com/go-openapi/runtime/headers.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/interfaces.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/json.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/logger/logger.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/logger/standard.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/context.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/denco/LICENSEis excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/denco/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/denco/router.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/denco/server.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/denco/util.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/doc.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/header/header.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/negotiate.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/not_implemented.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/operation.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/parameter.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/rapidoc.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/redoc.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/request.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/router.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/security.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/spec.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/swaggerui.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/swaggerui_oauth2.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/ui_options.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/untyped/api.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/validation.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/request.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/security/authenticator.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/security/authorizer.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/statuses.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/text.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/values.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/xml.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/yamlpc/yaml.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/.editorconfigis excluded by!vendor/**vendor/github.com/go-openapi/spec/.gitignoreis excluded by!vendor/**vendor/github.com/go-openapi/spec/.golangci.ymlis excluded by!vendor/**vendor/github.com/go-openapi/spec/CODE_OF_CONDUCT.mdis excluded by!vendor/**
📒 Files selected for processing (15)
.github/workflows/build.yml.github/workflows/e2e.yml.github/workflows/lint.yml.github/workflows/test-images.yml.gitignoreDockerfileapi/v1alpha1/operatorconfig_types.goapi/v1alpha1/zz_generated.deepcopy.gocmd/caib/README.mdconfig/manager/kustomization.yamlgo.modinternal/buildapi/bundle_verify_test.gointernal/buildapi/server.gointernal/common/bundleverify/verify.gointernal/common/bundleverify/verify_test.go
✅ Files skipped from review due to trivial changes (5)
- config/manager/kustomization.yaml
- Dockerfile
- .gitignore
- .github/workflows/build.yml
- cmd/caib/README.md
🚧 Files skipped from review as they are similar to previous changes (2)
- api/v1alpha1/operatorconfig_types.go
- internal/buildapi/server.go
| github.com/spf13/cobra v1.10.2 | ||
| github.com/spf13/pflag v1.0.10 // indirect | ||
| github.com/stoewer/go-strcase v1.3.1 // indirect | ||
| github.com/tektoncd/pipeline v1.6.0 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Check latest Tekton Pipeline release and security advisories
echo "=== Latest Tekton Pipeline releases ==="
gh api repos/tektoncd/pipeline/releases --jq '.[0:3] | .[] | {tag_name, published_at, name}'
echo -e "\n=== Security advisories for tektoncd/pipeline ==="
gh api graphql -f query='
{
repository(owner: "tektoncd", name: "pipeline") {
vulnerabilityAlerts(first: 10) {
nodes {
securityAdvisory {
ghsaId
summary
severity
publishedAt
}
vulnerableManifestFilename
vulnerableRequirements
fixedIn
}
}
}
}'
echo -e "\n=== Known CVEs affecting v1.6.0 ==="
for ghsa in GHSA-94jr-7pqp-xhcq GHSA-j5q5-j9gm-2w5c GHSA-m2cx-gpqf-qf74 GHSA-cv4x-93xx-wgfj GHSA-wjxp-xrpv-xpff; do
echo "--- $ghsa ---"
gh api advisories/$ghsa --jq '{severity, summary, fixed_versions: .vulnerabilities[0].first_patched_version}'
doneRepository: centos-automotive-suite/automotive-dev-operator
Length of output: 1935
Upgrade Tekton Pipeline immediately: v1.6.0 is severely outdated and vulnerable.
v1.6.0 contains multiple known vulnerabilities including 1 CRITICAL and 4 HIGH/MEDIUM severity issues. Most critical: GHSA-j5q5-j9gm-2w5c (path traversal in git resolver) allows arbitrary file reads from the resolver pod, and GHSA-94jr-7pqp-xhcq (git argument injection) enables RCE via unsanitized revision parameters. Current stable release is v1.12.0; upgrade path to v1.11.1 or later is recommended.
🧰 Tools
🪛 OSV Scanner (2.3.6)
[CRITICAL] 203-203: github.com/tektoncd/pipeline 1.6.0: Pipelines do not validate child UIDs in github.com/tektoncd/pipeline
(GO-2023-1901)
[CRITICAL] 203-203: github.com/tektoncd/pipeline 1.6.0: Tekton Pipelines controller panic via long resolver name in TaskRun/PipelineRun in github.com/tektoncd/pipeline
(GO-2026-4730)
[CRITICAL] 203-203: github.com/tektoncd/pipeline 1.6.0: Path traversal in Tekton Pipelines git resolver allows reading arbitrary files from the resolver pod in github.com/tektoncd/pipeline
(GO-2026-4761)
[CRITICAL] 203-203: github.com/tektoncd/pipeline 1.6.0: Tekton Pipeline: Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCE
[CRITICAL] 203-203: github.com/tektoncd/pipeline 1.6.0: Tekton Pipelines controller panic via long resolver name in TaskRun/PipelineRun
[CRITICAL] 203-203: github.com/tektoncd/pipeline 1.6.0: Path traversal in Tekton Pipelines git resolver allows reading arbitrary files from the resolver pod
[CRITICAL] 203-203: github.com/tektoncd/pipeline 1.6.0: Tekton Pipelines: HTTP Resolver Unbounded Response Body Read Enables Denial of Service via Memory Exhaustion
[CRITICAL] 203-203: github.com/tektoncd/pipeline 1.6.0: Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching
[CRITICAL] 203-203: github.com/tektoncd/pipeline 1.6.0: Tekton Pipelines: VolumeMount path restriction bypass via missing filepath.Clean in /tekton/ check
[CRITICAL] 203-203: github.com/tektoncd/pipeline 1.6.0: Tekton Pipelines: Git resolver API mode leaks system-configured API token to user-controlled serverURL
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 203, The go.mod currently pins github.com/tektoncd/pipeline
at v1.6.0 which is vulnerable; update the dependency line for
github.com/tektoncd/pipeline to a fixed version (minimum v1.11.1, preferably the
current stable v1.12.0), then run your module update (e.g., go get or the
equivalent) and go mod tidy to refresh the lockfile and vendor data; after
updating, run unit/integration tests and verify any pipeline API changes in call
sites that import github.com/tektoncd/pipeline to fix compilation or behavioral
regressions.
![ambient-code[bot]](https://avatars.githubusercontent.com/u/231559327?s=60&v=4){kind=small}
There was a problem hiding this comment.
Thanks for the PR! The cosign verification flow is well-designed — loading OperatorConfig once in resolveTaskBundleRef and passing it through to verifyTaskBundle is clean, and the CEL validation rule on the CRD correctly enforces the taskBundleCosignKeyRef requirement. The fail-closed behavior on OperatorConfig load errors is the right call for a security feature.
The documentation additions (secure builds guide, image inspect) are thorough and well-structured.
A few items to address below — one looks like an accidental commit, one is a dependency consistency issue, and a couple of smaller suggestions.
bennyz
force-pushed
the
bundle-management
branch
2 times, most recently
from
a86b435 to
a54c0da
Compare
Bump Go from 1.24 to 1.25 across go.mod, Dockerfile, and CI workflows to enable cosign v2.6.3 with security fixes: - cosign v2.5.0 → v2.6.3 - fulcio v1.6.6 → v1.8.5 (fixes GHSA-59jp-pj84-45mr SSRF, GHSA-f83f-xpx7-ffpw OOM) - timestamp-authority v1.2.5 → v2.0.3 (fixes GHSA-4qg8-fj49-pxjh OOM) - k8s.io/* v0.33 → v0.34 (required by cosign v2.6.3) Also fixes .gitignore: `bundle/` → `/bundle/` to stop ignoring vendor/*/bundle/ directories (was hiding sigstore vendor packages from git, causing CI build failures). Assisted-by: claude-opus-4.6
Add optional cosign public-key verification of Tekton task bundles when secure builds are enabled. OperatorConfig gains taskBundleVerify (bool) and taskBundleCosignKeyRef (ConfigMapKeySelector) fields. Key design choices: - LoadDefaultVerifier instead of ECDSA-only — supports RSA/Ed25519 keys - Registry auth via DefaultKeychain in CheckOpts.RegistryClientOpts — uses pod SA credentials for private registry access - IgnoreTlog/IgnoreSCT: offline verification with explicit public key - ConfigMap not found returns 400 (misconfiguration), not 500 - Nil OperatorConfig guard prevents NPE on (nil, nil) return Assisted-by: claude-opus-4.6
…spect docs Document new secure and reproducible build workflow in caib README: - --secure, --reproducible, --task-bundle-ref, --restore-sources flags - caib image inspect command for build provenance - Rebuilding from prior builds workflow - Note that image disk does not support --reproducible/--restore-sources (creates disk from existing container, not a full build) Assisted-by: claude-opus-4.6
Ensures Tekton Bundle signature is verified when ImageBuild CRs are created directly (bypassing the API server). Uses ConfigMapKeySelector for flexible cosign public key reference. Assisted-by: claude-opus-4.6
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Around line 21-26: The dependency versions are misaligned: update
sigs.k8s.io/controller-runtime to the v0.22.x line (to match Kubernetes v0.34)
and also bump k8s.io/apiextensions-apiserver to v0.34.1 so all k8s/* modules
(k8s.io/apimachinery, k8s.io/apiserver, k8s.io/client-go,
k8s.io/apiextensions-apiserver) use v0.34.1; alternatively, if you prefer the
older stack, downgrade k8s.io/apimachinery, k8s.io/apiserver, and
k8s.io/client-go back to the v0.33.x line to remain compatible with
sigs.k8s.io/controller-runtime v0.21.0—apply the chosen change in go.mod and run
go mod tidy to update go.sum.
In `@internal/controller/imagebuild/controller.go`:
- Around line 947-961: The error handling in the secure-build block treats all
errors as configuration errors by prefixing them with "secureBuild", which
causes transient VerifyBundle failures to be considered terminal; modify the
block around operatorConfig.Spec.OSBuilds.TaskBundleVerify (including
cosignKeyRef validation, the r.Get(ConfigMap) lookup, and the
bundleverify.VerifyBundle call) so that only genuine configuration issues
(missing cosignKeyRef, missing ConfigMap key, failed r.Get due to
NotFound/misconfig) return errors prefixed with "secureBuild", while runtime
verification errors from bundleverify.VerifyBundle are returned without the
"secureBuild" prefix (or requeued/propagated) so they are treated as transient
and can be retried. Ensure the unique symbols referenced (TaskBundleVerify,
TaskBundleCosignKeyRef, cosignKeyRef, r.Get, corev1.ConfigMap,
bundleverify.VerifyBundle) are the ones updated.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 749a5e7e-c5f5-456a-8e10-4d392c5e69bb
⛔ Files ignored due to path filters (283)
config/crd/bases/automotive.sdv.cloud.redhat.com_operatorconfigs.yamlis excluded by!config/crd/bases/**config/crd/bases/automotive.sdv.cloud.redhat.com_workspaces.yamlis excluded by!config/crd/bases/**go.sumis excluded by!**/*.sum,!**go.sumvendor/github.com/Azure/go-ansiterm/LICENSEis excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/README.mdis excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/SECURITY.mdis excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/constants.gois excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/context.gois excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/csi_entry_state.gois excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/csi_param_state.gois excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/escape_intermediate_state.gois excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/escape_state.gois excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/event_handler.gois excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/ground_state.gois excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/osc_string_state.gois excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/parser.gois excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/parser_action_helpers.gois excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/parser_actions.gois excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/states.gois excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/utilities.gois excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/winterm/ansi.gois excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/winterm/api.gois excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/winterm/attr_translation.gois excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/winterm/cursor_helpers.gois excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/winterm/erase_helpers.gois excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/winterm/scroll_helper.gois excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/winterm/utilities.gois excluded by!vendor/**vendor/github.com/Azure/go-ansiterm/winterm/win_event_handler.gois excluded by!vendor/**vendor/github.com/asaskevich/govalidator/.gitignoreis excluded by!vendor/**vendor/github.com/asaskevich/govalidator/.travis.ymlis excluded by!vendor/**vendor/github.com/asaskevich/govalidator/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/asaskevich/govalidator/CONTRIBUTING.mdis excluded by!vendor/**vendor/github.com/asaskevich/govalidator/LICENSEis excluded by!vendor/**vendor/github.com/asaskevich/govalidator/README.mdis excluded by!vendor/**vendor/github.com/asaskevich/govalidator/arrays.gois excluded by!vendor/**vendor/github.com/asaskevich/govalidator/converter.gois excluded by!vendor/**vendor/github.com/asaskevich/govalidator/doc.gois excluded by!vendor/**vendor/github.com/asaskevich/govalidator/error.gois excluded by!vendor/**vendor/github.com/asaskevich/govalidator/numerics.gois excluded by!vendor/**vendor/github.com/asaskevich/govalidator/patterns.gois excluded by!vendor/**vendor/github.com/asaskevich/govalidator/types.gois excluded by!vendor/**vendor/github.com/asaskevich/govalidator/utils.gois excluded by!vendor/**vendor/github.com/asaskevich/govalidator/validator.gois excluded by!vendor/**vendor/github.com/asaskevich/govalidator/wercker.ymlis excluded by!vendor/**vendor/github.com/blang/semver/.travis.ymlis excluded by!vendor/**vendor/github.com/blang/semver/LICENSEis excluded by!vendor/**vendor/github.com/blang/semver/README.mdis excluded by!vendor/**vendor/github.com/blang/semver/json.gois excluded by!vendor/**vendor/github.com/blang/semver/package.jsonis excluded by!vendor/**vendor/github.com/blang/semver/range.gois excluded by!vendor/**vendor/github.com/blang/semver/semver.gois excluded by!vendor/**vendor/github.com/blang/semver/sort.gois excluded by!vendor/**vendor/github.com/blang/semver/sql.gois excluded by!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/LICENSEis excluded by!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/build.gois excluded by!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/errorutil/errors.gois excluded by!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/estargz.gois excluded by!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/gzip.gois excluded by!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/testutil.gois excluded by!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/types.gois excluded by!vendor/**vendor/github.com/coreos/go-oidc/v3/LICENSEis excluded by!vendor/**vendor/github.com/coreos/go-oidc/v3/NOTICEis excluded by!vendor/**vendor/github.com/coreos/go-oidc/v3/oidc/jose.gois excluded by!vendor/**vendor/github.com/coreos/go-oidc/v3/oidc/jwks.gois excluded by!vendor/**vendor/github.com/coreos/go-oidc/v3/oidc/oidc.gois excluded by!vendor/**vendor/github.com/coreos/go-oidc/v3/oidc/verify.gois excluded by!vendor/**vendor/github.com/digitorus/pkcs7/.gitignoreis excluded by!vendor/**vendor/github.com/digitorus/pkcs7/LICENSEis excluded by!vendor/**vendor/github.com/digitorus/pkcs7/Makefileis excluded by!vendor/**vendor/github.com/digitorus/pkcs7/README.mdis excluded by!vendor/**vendor/github.com/digitorus/pkcs7/ber.gois excluded by!vendor/**vendor/github.com/digitorus/pkcs7/decrypt.gois excluded by!vendor/**vendor/github.com/digitorus/pkcs7/encrypt.gois excluded by!vendor/**vendor/github.com/digitorus/pkcs7/pkcs7.gois excluded by!vendor/**vendor/github.com/digitorus/pkcs7/sign.gois excluded by!vendor/**vendor/github.com/digitorus/pkcs7/verify.gois excluded by!vendor/**vendor/github.com/digitorus/pkcs7/verify_test_dsa.gois excluded by!vendor/**vendor/github.com/digitorus/timestamp/LICENSEis excluded by!vendor/**vendor/github.com/digitorus/timestamp/README.mdis excluded by!vendor/**vendor/github.com/digitorus/timestamp/borrowed.gois excluded by!vendor/**vendor/github.com/digitorus/timestamp/rfc3161_struct.gois excluded by!vendor/**vendor/github.com/digitorus/timestamp/signing_cert_v2_struct.gois excluded by!vendor/**vendor/github.com/digitorus/timestamp/timestamp.gois excluded by!vendor/**vendor/github.com/docker/cli/AUTHORSis excluded by!vendor/**vendor/github.com/docker/cli/LICENSEis excluded by!vendor/**vendor/github.com/docker/cli/NOTICEis excluded by!vendor/**vendor/github.com/docker/cli/cli/config/config.gois excluded by!vendor/**vendor/github.com/docker/cli/cli/config/configfile/file.gois excluded by!vendor/**vendor/github.com/docker/cli/cli/config/configfile/file_unix.gois excluded by!vendor/**vendor/github.com/docker/cli/cli/config/configfile/file_windows.gois excluded by!vendor/**vendor/github.com/docker/cli/cli/config/credentials/credentials.gois excluded by!vendor/**vendor/github.com/docker/cli/cli/config/credentials/default_store.gois excluded by!vendor/**vendor/github.com/docker/cli/cli/config/credentials/default_store_darwin.gois excluded by!vendor/**vendor/github.com/docker/cli/cli/config/credentials/default_store_linux.gois excluded by!vendor/**vendor/github.com/docker/cli/cli/config/credentials/default_store_unsupported.gois excluded by!vendor/**vendor/github.com/docker/cli/cli/config/credentials/default_store_windows.gois excluded by!vendor/**vendor/github.com/docker/cli/cli/config/credentials/file_store.gois excluded by!vendor/**vendor/github.com/docker/cli/cli/config/credentials/native_store.gois excluded by!vendor/**vendor/github.com/docker/cli/cli/config/memorystore/store.gois excluded by!vendor/**vendor/github.com/docker/cli/cli/config/types/authconfig.gois excluded by!vendor/**vendor/github.com/docker/distribution/registry/client/auth/challenge/addr.gois excluded by!vendor/**vendor/github.com/docker/distribution/registry/client/auth/challenge/authchallenge.gois excluded by!vendor/**vendor/github.com/dustin/go-humanize/.travis.ymlis excluded by!vendor/**vendor/github.com/dustin/go-humanize/LICENSEis excluded by!vendor/**vendor/github.com/dustin/go-humanize/README.markdownis excluded by!vendor/**vendor/github.com/dustin/go-humanize/big.gois excluded by!vendor/**vendor/github.com/dustin/go-humanize/bigbytes.gois excluded by!vendor/**vendor/github.com/dustin/go-humanize/bytes.gois excluded by!vendor/**vendor/github.com/dustin/go-humanize/comma.gois excluded by!vendor/**vendor/github.com/dustin/go-humanize/commaf.gois excluded by!vendor/**vendor/github.com/dustin/go-humanize/ftoa.gois excluded by!vendor/**vendor/github.com/dustin/go-humanize/humanize.gois excluded by!vendor/**vendor/github.com/dustin/go-humanize/number.gois excluded by!vendor/**vendor/github.com/dustin/go-humanize/ordinals.gois excluded by!vendor/**vendor/github.com/dustin/go-humanize/si.gois excluded by!vendor/**vendor/github.com/dustin/go-humanize/times.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/.gitignoreis excluded by!vendor/**vendor/github.com/go-chi/chi/v5/CHANGELOG.mdis excluded by!vendor/**vendor/github.com/go-chi/chi/v5/CONTRIBUTING.mdis excluded by!vendor/**vendor/github.com/go-chi/chi/v5/LICENSEis excluded by!vendor/**vendor/github.com/go-chi/chi/v5/Makefileis excluded by!vendor/**vendor/github.com/go-chi/chi/v5/README.mdis excluded by!vendor/**vendor/github.com/go-chi/chi/v5/SECURITY.mdis excluded by!vendor/**vendor/github.com/go-chi/chi/v5/chain.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/chi.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/context.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/basic_auth.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/clean_path.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/compress.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/content_charset.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/content_encoding.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/content_type.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/get_head.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/heartbeat.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/logger.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/maybe.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/middleware.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/nocache.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/page_route.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/path_rewrite.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/profiler.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/realip.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/recoverer.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/request_id.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/request_size.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/route_headers.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/strip.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/sunset.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/supress_notfound.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/terminal.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/throttle.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/timeout.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/url_format.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/value.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/wrap_writer.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/mux.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/path_value.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/path_value_fallback.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/pattern.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/pattern_fallback.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/tree.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/.codecov.ymlis excluded by!vendor/**vendor/github.com/go-openapi/analysis/.gitattributesis excluded by!vendor/**vendor/github.com/go-openapi/analysis/.gitignoreis excluded by!vendor/**vendor/github.com/go-openapi/analysis/.golangci.ymlis excluded by!vendor/**vendor/github.com/go-openapi/analysis/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/go-openapi/analysis/LICENSEis excluded by!vendor/**vendor/github.com/go-openapi/analysis/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/analysis/analyzer.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/debug.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/doc.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/errors.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/fixer.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/flatten.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/flatten_name.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/flatten_options.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/internal/debug/debug.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/internal/flatten/normalize/normalize.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/internal/flatten/operations/operations.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/internal/flatten/replace/errors.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/internal/flatten/replace/replace.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/internal/flatten/schutils/flatten_schema.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/internal/flatten/sortref/keys.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/internal/flatten/sortref/sort_ref.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/mixin.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/schema.gois excluded by!vendor/**vendor/github.com/go-openapi/errors/.gitattributesis excluded by!vendor/**vendor/github.com/go-openapi/errors/.gitignoreis excluded by!vendor/**vendor/github.com/go-openapi/errors/.golangci.ymlis excluded by!vendor/**vendor/github.com/go-openapi/errors/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/go-openapi/errors/LICENSEis excluded by!vendor/**vendor/github.com/go-openapi/errors/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/errors/api.gois excluded by!vendor/**vendor/github.com/go-openapi/errors/auth.gois excluded by!vendor/**vendor/github.com/go-openapi/errors/doc.gois excluded by!vendor/**vendor/github.com/go-openapi/errors/headers.gois excluded by!vendor/**vendor/github.com/go-openapi/errors/middleware.gois excluded by!vendor/**vendor/github.com/go-openapi/errors/parsing.gois excluded by!vendor/**vendor/github.com/go-openapi/errors/schema.gois excluded by!vendor/**vendor/github.com/go-openapi/jsonpointer/.golangci.ymlis excluded by!vendor/**vendor/github.com/go-openapi/jsonpointer/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/jsonpointer/pointer.gois excluded by!vendor/**vendor/github.com/go-openapi/jsonreference/.golangci.ymlis excluded by!vendor/**vendor/github.com/go-openapi/jsonreference/NOTICEis excluded by!vendor/**vendor/github.com/go-openapi/jsonreference/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/jsonreference/internal/normalize_url.gois excluded by!vendor/**vendor/github.com/go-openapi/jsonreference/reference.gois excluded by!vendor/**vendor/github.com/go-openapi/loads/.editorconfigis excluded by!vendor/**vendor/github.com/go-openapi/loads/.gitignoreis excluded by!vendor/**vendor/github.com/go-openapi/loads/.golangci.ymlis excluded by!vendor/**vendor/github.com/go-openapi/loads/.travis.ymlis excluded by!vendor/**vendor/github.com/go-openapi/loads/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/go-openapi/loads/LICENSEis excluded by!vendor/**vendor/github.com/go-openapi/loads/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/loads/doc.gois excluded by!vendor/**vendor/github.com/go-openapi/loads/errors.gois excluded by!vendor/**vendor/github.com/go-openapi/loads/loaders.gois excluded by!vendor/**vendor/github.com/go-openapi/loads/options.gois excluded by!vendor/**vendor/github.com/go-openapi/loads/spec.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/.editorconfigis excluded by!vendor/**vendor/github.com/go-openapi/runtime/.gitattributesis excluded by!vendor/**vendor/github.com/go-openapi/runtime/.gitignoreis excluded by!vendor/**vendor/github.com/go-openapi/runtime/.golangci.ymlis excluded by!vendor/**vendor/github.com/go-openapi/runtime/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/go-openapi/runtime/LICENSEis excluded by!vendor/**vendor/github.com/go-openapi/runtime/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/runtime/bytestream.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client/auth_info.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client/keepalive.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client/opentelemetry.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client/request.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client/response.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client/runtime.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client_auth_info.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client_operation.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client_request.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client_response.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/constants.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/csv.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/csv_options.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/discard.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/file.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/go.work.sumis excluded by!**/*.sum,!vendor/**vendor/github.com/go-openapi/runtime/headers.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/interfaces.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/json.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/logger/logger.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/logger/standard.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/context.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/denco/LICENSEis excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/denco/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/denco/router.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/denco/server.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/denco/util.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/doc.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/header/header.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/negotiate.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/not_implemented.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/operation.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/parameter.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/rapidoc.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/redoc.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/request.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/router.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/security.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/spec.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/swaggerui.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/swaggerui_oauth2.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/ui_options.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/untyped/api.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/validation.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/request.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/security/authenticator.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/security/authorizer.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/statuses.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/text.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/values.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/xml.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/yamlpc/yaml.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/.editorconfigis excluded by!vendor/**vendor/github.com/go-openapi/spec/.gitignoreis excluded by!vendor/**vendor/github.com/go-openapi/spec/.golangci.ymlis excluded by!vendor/**vendor/github.com/go-openapi/spec/CODE_OF_CONDUCT.mdis excluded by!vendor/**
📒 Files selected for processing (15)
.github/workflows/build.yml.github/workflows/e2e.yml.github/workflows/lint.yml.github/workflows/test-images.yml.gitignoreDockerfileapi/v1alpha1/operatorconfig_types.goapi/v1alpha1/zz_generated.deepcopy.gocmd/caib/README.mdgo.modinternal/buildapi/bundle_verify_test.gointernal/buildapi/server.gointernal/common/bundleverify/verify.gointernal/common/bundleverify/verify_test.gointernal/controller/imagebuild/controller.go
✅ Files skipped from review due to trivial changes (7)
- Dockerfile
- .gitignore
- .github/workflows/lint.yml
- .github/workflows/e2e.yml
- .github/workflows/test-images.yml
- api/v1alpha1/zz_generated.deepcopy.go
- cmd/caib/README.md
🚧 Files skipped from review as they are similar to previous changes (6)
- internal/common/bundleverify/verify_test.go
- .github/workflows/build.yml
- api/v1alpha1/operatorconfig_types.go
- internal/common/bundleverify/verify.go
- internal/buildapi/server.go
- internal/buildapi/bundle_verify_test.go
VerifyBundle errors (registry timeouts, network issues) should requeue for retry, not permanently fail the build. Only config errors (missing key ref, missing ConfigMap) use the "secureBuild" prefix that triggers terminal failure classification. Assisted-by: claude-opus-4.6
controller-runtime v0.21 targets k8s 1.33 (v0.33.x), but k8s modules were already bumped to v0.34. Upgrade controller-runtime to v0.22.5 and all k8s.io modules to v0.34.7 for consistent compatibility. Assisted-by: claude-opus-4.6
bkhizgiy
approved these changes
May 11, 2026
10 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Related Issues
Type of Change
Testing
make test)make lint)make manifests generate)Summary by CodeRabbit
New Features
caib image inspectcommand to display build provenance and reproducibility details.--reproducible,--task-bundle-ref, and--restore-sourcesfor enhanced build reproducibility.Chores