feat: add private registry support to workspaces#280
Merged
bennyz merged 2 commits intoMay 14, 2026
Conversation
bennyz
force-pushed
the
private-registry-workspace
branch
from
b36878d to
9cf422a
Compare
|
Important Review skippedThis PR was authored by the user configured for CodeRabbit reviews. CodeRabbit does not review PRs authored by this user. It's recommended to use a dedicated user account to post CodeRabbit review feedback. ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughWalkthroughAdds operator and per-workspace imagePullSecrets, AllowedImages allowlist, optional ImageVerify with ImageCosignKeyRef; adds FetchCosignPublicKey and KeychainFromPullSecrets, prefers cosign v3 OCI bundle verification with legacy fallback, enforces allowed-images at API/controller layers, updates deepcopy/docs, and adds tests. ChangesWorkspace Image Access Control and Verification
Sequence DiagramsequenceDiagram
participant Client
participant BuildAPI
participant WorkspacesConfig
participant Keychain
participant BundleVerify
Client->>BuildAPI: createWorkspace(image, spec)
BuildAPI->>WorkspacesConfig: IsImageAllowed(image), GetImagePullSecrets()
alt image disallowed
WorkspacesConfig-->>BuildAPI: deny (403)
else image allowed
WorkspacesConfig->>Keychain: imagePullSecrets
Keychain->>BundleVerify: authn.Keychain
BundleVerify->>BuildAPI: verification result (200/403)
BuildAPI->>Client: create pod / error
end
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 8
🧹 Nitpick comments (3)
internal/common/bundleverify/verify.go (1)
27-31: ⚡ Quick winConsider validating that the PEM key is not empty.
The function returns an empty byte slice if
cm.Data[keyRef.Key]contains an empty string. WhileVerifyBundlewill catch this downstream during PEM parsing, validating here would provide a clearer error message to users.🛡️ Proposed validation
pubKeyPEM, ok := cm.Data[keyRef.Key] if !ok { return nil, fmt.Errorf("ConfigMap %q does not contain key %q", keyRef.Name, keyRef.Key) } + if strings.TrimSpace(pubKeyPEM) == "" { + return nil, fmt.Errorf("ConfigMap %q key %q is empty", keyRef.Name, keyRef.Key) + } return []byte(pubKeyPEM), nil🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@internal/common/bundleverify/verify.go` around lines 27 - 31, The code currently returns an empty byte slice when cm.Data[keyRef.Key] exists but is an empty string (pubKeyPEM), which should be validated earlier; modify the function that reads pubKeyPEM from the ConfigMap (the block using cm.Data[keyRef.Key] and variables keyRef.Name/keyRef.Key) to check that pubKeyPEM != "" and return a clear error (e.g. "ConfigMap %q key %q contains empty PEM") instead of returning an empty slice so callers like VerifyBundle get a clearer, earlier error.api/v1alpha1/zz_generated.deepcopy.go (1)
1393-1397: ⚡ Quick winExclude autogenerated deepcopy artifacts from the PR.
The deepcopy updates look correct, but this file is generated and should be omitted from source review/commit payload to keep PRs focused on handwritten changes.
Based on learnings: "Generated files that are not committed should be ignored in PRs. Specifically, do not include api/v1alpha1/zz_generated.deepcopy.go ... and ignore all config/crd/bases/*.yaml CRD manifests."
Also applies to: 1473-1487
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@api/v1alpha1/zz_generated.deepcopy.go` around lines 1393 - 1397, Revert/remove the autogenerated deepcopy file from the PR (api/v1alpha1/zz_generated.deepcopy.go and the other generated block around lines 1473-1487) and exclude it from future commits by adding its path to ignore rules; specifically, undo the committed changes to zz_generated.deepcopy.go (restore the handwritten state or remove the file from the commit), add the pattern api/v1alpha1/zz_generated.deepcopy.go to .gitignore (and add config/crd/bases/*.yaml to .gitignore as well) so generated CRD manifests are not committed, and update the PR so only handwritten source changes remain.internal/controller/workspace/controller_test.go (1)
406-457: ⚡ Quick winTest setup is incomplete for verification skip scenario.
The
OperatorConfigonly setsImageVerify=falsebut doesn't configure:
AllowedImages— so the image allow-list check behavior is unclearToolchainImage— so the default image fallback at controller.go line 232 may not work as expectedTo properly validate that verification is skipped, set up a complete configuration including the allowed images list and toolchain image.
🧪 Suggested improvement to add complete configuration
// OperatorConfig with imageVerify=false — signature check should be skipped oc := &automotivev1alpha1.OperatorConfig{ ObjectMeta: metav1.ObjectMeta{ Name: "config", Namespace: "default", }, Spec: automotivev1alpha1.OperatorConfigSpec{ Workspaces: &automotivev1alpha1.WorkspacesConfig{ - ImageVerify: false, + ImageVerify: false, + ToolchainImage: "quay.io/centos-automotive/toolchain:latest", + AllowedImages: []string{"quay.io/centos-automotive/toolchain:*"}, }, }, }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@internal/controller/workspace/controller_test.go` around lines 406 - 457, The test TestEnsurePod_SkipsVerifyWhenDisabled leaves OperatorConfig incomplete so controller fallback logic may still depend on missing fields; update the test's oc.Spec.Workspaces to include a non-empty AllowedImages list and a ToolchainImage value (i.e. populate WorkspacesConfig.AllowedImages and WorkspacesConfig.ToolchainImage) so ensurePod runs with a fully-specified OperatorConfig and correctly exercises skipping verification when ImageVerify is false.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@internal/buildapi/server.go`:
- Around line 1254-1269: Add unit tests for the verifyWorkspaceImage function
before modifying its implementation: create tests exercising
verifyWorkspaceImage covering (1) when ImageVerify is disabled (ensure it
returns success/no-op), (2) cosign key unavailable scenario by mocking the HTTP
client to return 400 and asserting the function returns the corresponding error,
(3) signature verification failure by mocking the HTTP client to return 403 and
asserting the appropriate error is returned, and (4) successful verification by
mocking a 200 response and asserting success; use the same test helpers/mocks
used elsewhere in the package to stub HTTP responses and reference
verifyWorkspaceImage and any config struct/field names (e.g., ImageVerify) to
locate the code under test.
- Line 1264: The verification currently runs in createWorkspace using only the
global WorkspacesConfig so per-workspace ImagePullSecrets are ignored; update
verifyWorkspaceImage to accept workspace-specific pull secrets (e.g., add an
imagePullSecrets parameter or include them on the request struct passed at line
where verifyWorkspaceImage is called) and change createWorkspace to pass the
Workspace spec's ImagePullSecrets (or delay verification until after the CR is
created and spec is available) so authn.DefaultKeychain can use those
credentials instead of the operator SA; also add failing tests in
workspace_test.go that exercise verifyWorkspaceImage with workspace-specific
ImagePullSecrets (assert that authn uses provided secret and signature
verification path differs from using only WorkspacesConfig) before implementing
the fix.
In `@internal/buildapi/workspace.go`:
- Around line 162-165: Add failing tests that exercise the image allowlist
validation before keeping the implementation: in
internal/buildapi/workspace_test.go add unit and HTTP tests that call
IsImageAllowed (or the handler that invokes it) with disallowed and allowed
image names, assert the function returns false for disallowed images and true
for allowed ones, verify that requests using disallowed images receive an HTTP
403 response and that the response body/error message matches the expected
rejection format; ensure tests run against the same handler functions (e.g., the
workspace image validation handler) used in production so the test fails until
the implementation is present.
In `@internal/common/bundleverify/verify.go`:
- Around line 17-32: Add unit tests in verify_test.go that exercise
FetchCosignPublicKey: create a test for a successful read where you build a fake
K8s client (controller-runtime fake client) with a ConfigMap containing the
expected key and PEM value and assert returned bytes match the PEM; add a test
that passes a nil ConfigMapKeySelector and asserts an error message about
configuration; add a test where the fake client has no ConfigMap (simulate
NotFound) and assert the error from FetchCosignPublicKey indicates failure to
read the ConfigMap; add a test where the ConfigMap exists but lacks the
requested key and assert the ConfigMap key-missing error; and add a test where
the ConfigMap key exists but the PEM value is empty and assert the function
returns an empty byte slice (or the expected error if you prefer) — reference
FetchCosignPublicKey, client.Reader, and verify_test.go when locating where to
add these cases.
In `@internal/controller/workspace/controller_test.go`:
- Around line 364-404: The test panics because OperatorConfig is missing so
wsConfig is nil and wsConfig.IsImageAllowed(image) is called; fix it by creating
and injecting an OperatorConfig with an AllowedImages entry into the test setup
before calling r.ensurePod (e.g., construct an OperatorConfig with the allowed
image list that does NOT include "quay.io/evil/rogue:latest" and add it to the
reconciler's fake client or test environment), ensuring ensurePod can load
wsConfig and perform the IsImageAllowed check instead of panicking.
In `@internal/controller/workspace/controller.go`:
- Around line 278-281: The code calls wsConfig.GetImagePullSecrets() without
ensuring wsConfig is non-nil, which can panic; update the imagePullSecrets
fallback logic to check wsConfig != nil before invoking GetImagePullSecrets
(e.g., when imagePullSecrets is empty, only call wsConfig.GetImagePullSecrets()
if wsConfig != nil) and otherwise leave imagePullSecrets empty or use a safe
default; refer to the variables imagePullSecrets, ws.Spec.ImagePullSecrets and
the method wsConfig.GetImagePullSecrets() to locate the change.
- Around line 226-236: The code dereferences wsConfig without nil checks; update
the workspace image logic in the function that uses wsConfig and ws (references:
wsConfig, operatorConfig, ws.Spec.Image, GetToolchainImage, IsImageAllowed) to
first handle a nil wsConfig (and nil operatorConfig.Spec.Workspaces) by either
using a safe default image or returning a clear error before calling
GetToolchainImage/IsImageAllowed; add explicit nil checks around wsConfig, use
ws.Spec.Image if present, otherwise only call wsConfig.GetToolchainImage when
wsConfig != nil, and guard the IsImageAllowed call similarly so no method is
invoked on a nil pointer.
- Around line 237-246: The verification uses authn.DefaultKeychain which ignores
workspace ImagePullSecrets; update the registry auth to use a keychain built
from the workspace ImagePullSecrets and pass that into
ociremote.WithRemoteOptions before calling bundleverify.VerifyBundle.
Specifically, replace the use of authn.DefaultKeychain in the registryOpts
assignment (currently
ociremote.WithRemoteOptions(remote.WithAuthFromKeychain(authn.DefaultKeychain)))
with a keychain constructed from the workspace image pull secrets (the same
ImagePullSecrets used for the pod), and ensure bundleverify.VerifyBundle(ctx,
image, pubKeyPEM, registryOpts) receives the new registryOpts so
private-registry images authenticated by the workspace secrets are verifiable.
---
Nitpick comments:
In `@api/v1alpha1/zz_generated.deepcopy.go`:
- Around line 1393-1397: Revert/remove the autogenerated deepcopy file from the
PR (api/v1alpha1/zz_generated.deepcopy.go and the other generated block around
lines 1473-1487) and exclude it from future commits by adding its path to ignore
rules; specifically, undo the committed changes to zz_generated.deepcopy.go
(restore the handwritten state or remove the file from the commit), add the
pattern api/v1alpha1/zz_generated.deepcopy.go to .gitignore (and add
config/crd/bases/*.yaml to .gitignore as well) so generated CRD manifests are
not committed, and update the PR so only handwritten source changes remain.
In `@internal/common/bundleverify/verify.go`:
- Around line 27-31: The code currently returns an empty byte slice when
cm.Data[keyRef.Key] exists but is an empty string (pubKeyPEM), which should be
validated earlier; modify the function that reads pubKeyPEM from the ConfigMap
(the block using cm.Data[keyRef.Key] and variables keyRef.Name/keyRef.Key) to
check that pubKeyPEM != "" and return a clear error (e.g. "ConfigMap %q key %q
contains empty PEM") instead of returning an empty slice so callers like
VerifyBundle get a clearer, earlier error.
In `@internal/controller/workspace/controller_test.go`:
- Around line 406-457: The test TestEnsurePod_SkipsVerifyWhenDisabled leaves
OperatorConfig incomplete so controller fallback logic may still depend on
missing fields; update the test's oc.Spec.Workspaces to include a non-empty
AllowedImages list and a ToolchainImage value (i.e. populate
WorkspacesConfig.AllowedImages and WorkspacesConfig.ToolchainImage) so ensurePod
runs with a fully-specified OperatorConfig and correctly exercises skipping
verification when ImageVerify is false.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 2a5f2cb0-5cfb-4225-8831-cedcb00e9083
⛔ Files ignored due to path filters (2)
config/crd/bases/automotive.sdv.cloud.redhat.com_operatorconfigs.yamlis excluded by!config/crd/bases/**config/crd/bases/automotive.sdv.cloud.redhat.com_workspaces.yamlis excluded by!config/crd/bases/**
📒 Files selected for processing (10)
api/v1alpha1/operatorconfig_types.goapi/v1alpha1/operatorconfig_types_test.goapi/v1alpha1/workspace_types.goapi/v1alpha1/zz_generated.deepcopy.gointernal/buildapi/server.gointernal/buildapi/workspace.gointernal/common/bundleverify/verify.gointernal/controller/imagebuild/controller.gointernal/controller/workspace/controller.gointernal/controller/workspace/controller_test.go
bennyz
force-pushed
the
private-registry-workspace
branch
2 times, most recently
from
ed4be81 to
06123c0
Compare
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Around line 21-23: The go.mod lists mixed Kubernetes minor versions; update
the modules so they share the same minor release to avoid API skew—either bump
k8s.io/apiserver, k8s.io/apiextensions-apiserver, and k8s.io/component-base to
v0.35.3 to match k8s.io/api, k8s.io/apimachinery, k8s.io/client-go, or revert
the latter three to v0.34.7 consistently; change the versions for the module
entries named "k8s.io/apiserver", "k8s.io/apiextensions-apiserver", and
"k8s.io/component-base" accordingly and run go mod tidy to ensure dependency
graph updates.
In `@internal/common/bundleverify/verify.go`:
- Around line 57-61: The new verification branching in verify.go (functions
verifyV3Bundles and verifyLegacy) lacks deterministic unit tests for the three
critical cases: v3 succeeds and short-circuits, v3 fails but legacy succeeds,
and both v3 and legacy fail; add focused failing-first tests under the package
(matching **/*.go test files) that mock or stub the verifier/registryOpts to
force each scenario and assert the expected return behavior for Verify (i.e.,
immediate nil on v3 success, fallback to legacy on v3 miss, and error when both
fail). Ensure tests reference the verifyV3Bundles and verifyLegacy paths (via
the public function that drives them) and use deterministic injected behavior
rather than network calls so they fail first and then guide implementation
changes.
- Around line 67-69: The current check in verify.go uses a single return
fmt.Errorf("no v3 bundles found: %w", err) when either err != nil or
len(bundles) == 0, which can wrap a nil error; split the branches so you return
a wrapped error only when err is non-nil (e.g., return fmt.Errorf("failed
listing bundles: %w", err) in the err != nil branch) and return a plain error
when bundles are empty (e.g., return errors.New("no v3 bundles found") for the
len(bundles) == 0 branch), updating the code around the err and bundles checks
in the same function in verify.go.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 7f7cb118-cdd6-4935-8c47-ce222f94ca9f
⛔ Files ignored due to path filters (287)
config/crd/bases/automotive.sdv.cloud.redhat.com_operatorconfigs.yamlis excluded by!config/crd/bases/**config/crd/bases/automotive.sdv.cloud.redhat.com_workspaces.yamlis excluded by!config/crd/bases/**go.sumis excluded by!**/*.sum,!**go.sumvendor/github.com/containerd/stargz-snapshotter/estargz/estargz.gois excluded by!vendor/**vendor/github.com/docker/cli/cli/config/configfile/file.gois excluded by!vendor/**vendor/github.com/docker/go-connections/tlsconfig/config.gois excluded by!vendor/**vendor/github.com/docker/go-connections/tlsconfig/config_client_ciphers.gois excluded by!vendor/**vendor/github.com/emicklei/go-restful/v3/.travis.ymlis excluded by!vendor/**vendor/github.com/emicklei/go-restful/v3/CHANGES.mdis excluded by!vendor/**vendor/github.com/emicklei/go-restful/v3/README.mdis excluded by!vendor/**vendor/github.com/emicklei/go-restful/v3/curly.gois excluded by!vendor/**vendor/github.com/emicklei/go-restful/v3/custom_verb.gois excluded by!vendor/**vendor/github.com/emicklei/go-restful/v3/doc.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/.git-blame-ignore-revsis excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/.golangci.ymlis excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/README.mdis excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/charset/charset.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/json/parser.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/magic/archive.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/magic/audio.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/magic/binary.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/magic/database.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/magic/document.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/magic/font.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/magic/ftyp.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/magic/image.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/magic/magic.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/magic/meteo.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/magic/ms_office.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/magic/text.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/magic/video.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/magic/zip.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/markup/markup.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/scan/bytes.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/mime.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/mimetype.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/supported_mimes.mdis excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/tree.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/chi.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/content_charset.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/request_id.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/route_headers.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/strip.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/mux.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/path_value.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/path_value_fallback.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/tree.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/.editorconfigis excluded by!vendor/**vendor/github.com/go-openapi/analysis/.gitignoreis excluded by!vendor/**vendor/github.com/go-openapi/analysis/.golangci.ymlis excluded by!vendor/**vendor/github.com/go-openapi/analysis/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/go-openapi/analysis/CONTRIBUTORS.mdis excluded by!vendor/**vendor/github.com/go-openapi/analysis/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/analysis/SECURITY.mdis excluded by!vendor/**vendor/github.com/go-openapi/analysis/analyzer.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/debug.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/doc.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/flatten.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/flatten_name.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/flatten_options.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/go.work.sumis excluded by!**/*.sum,!vendor/**vendor/github.com/go-openapi/analysis/internal/debug/debug.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/internal/flatten/normalize/normalize.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/internal/flatten/operations/operations.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/internal/flatten/replace/errors.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/internal/flatten/replace/replace.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/internal/flatten/schutils/flatten_schema.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/internal/flatten/sortref/keys.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/internal/flatten/sortref/sort_ref.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/mixin.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/schema.gois excluded by!vendor/**vendor/github.com/go-openapi/errors/.editorconfigis excluded by!vendor/**vendor/github.com/go-openapi/errors/.gitignoreis excluded by!vendor/**vendor/github.com/go-openapi/errors/.golangci.ymlis excluded by!vendor/**vendor/github.com/go-openapi/errors/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/go-openapi/errors/CONTRIBUTORS.mdis excluded by!vendor/**vendor/github.com/go-openapi/errors/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/errors/SECURITY.mdis excluded by!vendor/**vendor/github.com/go-openapi/errors/api.gois excluded by!vendor/**vendor/github.com/go-openapi/errors/auth.gois excluded by!vendor/**vendor/github.com/go-openapi/errors/doc.gois excluded by!vendor/**vendor/github.com/go-openapi/errors/headers.gois excluded by!vendor/**vendor/github.com/go-openapi/errors/middleware.gois excluded by!vendor/**vendor/github.com/go-openapi/errors/parsing.gois excluded by!vendor/**vendor/github.com/go-openapi/errors/schema.gois excluded by!vendor/**vendor/github.com/go-openapi/jsonpointer/.cliff.tomlis excluded by!vendor/**vendor/github.com/go-openapi/jsonpointer/.gitignoreis excluded by!vendor/**vendor/github.com/go-openapi/jsonpointer/.golangci.ymlis excluded by!vendor/**vendor/github.com/go-openapi/jsonpointer/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/go-openapi/jsonpointer/CONTRIBUTORS.mdis excluded by!vendor/**vendor/github.com/go-openapi/jsonpointer/LICENSEis excluded by!vendor/**vendor/github.com/go-openapi/jsonpointer/NOTICEis excluded by!vendor/**vendor/github.com/go-openapi/jsonpointer/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/jsonpointer/SECURITY.mdis excluded by!vendor/**vendor/github.com/go-openapi/jsonpointer/errors.gois excluded by!vendor/**vendor/github.com/go-openapi/jsonpointer/pointer.gois excluded by!vendor/**vendor/github.com/go-openapi/jsonreference/.editorconfigis excluded by!vendor/**vendor/github.com/go-openapi/jsonreference/.gitignoreis excluded by!vendor/**vendor/github.com/go-openapi/jsonreference/.golangci.ymlis excluded by!vendor/**vendor/github.com/go-openapi/jsonreference/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/go-openapi/jsonreference/CONTRIBUTORS.mdis excluded by!vendor/**vendor/github.com/go-openapi/jsonreference/NOTICEis excluded by!vendor/**vendor/github.com/go-openapi/jsonreference/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/jsonreference/SECURITY.mdis excluded by!vendor/**vendor/github.com/go-openapi/jsonreference/internal/normalize_url.gois excluded by!vendor/**vendor/github.com/go-openapi/jsonreference/reference.gois excluded by!vendor/**vendor/github.com/go-openapi/loads/.gitignoreis excluded by!vendor/**vendor/github.com/go-openapi/loads/.golangci.ymlis excluded by!vendor/**vendor/github.com/go-openapi/loads/.travis.ymlis excluded by!vendor/**vendor/github.com/go-openapi/loads/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/go-openapi/loads/CONTRIBUTORS.mdis excluded by!vendor/**vendor/github.com/go-openapi/loads/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/loads/SECURITY.mdis excluded by!vendor/**vendor/github.com/go-openapi/loads/doc.gois excluded by!vendor/**vendor/github.com/go-openapi/loads/errors.gois excluded by!vendor/**vendor/github.com/go-openapi/loads/loaders.gois excluded by!vendor/**vendor/github.com/go-openapi/loads/options.gois excluded by!vendor/**vendor/github.com/go-openapi/loads/spec.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/.gitignoreis excluded by!vendor/**vendor/github.com/go-openapi/runtime/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/go-openapi/runtime/NOTICEis excluded by!vendor/**vendor/github.com/go-openapi/runtime/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/runtime/SECURITY.mdis excluded by!vendor/**vendor/github.com/go-openapi/runtime/bytestream.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client/auth_info.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client/keepalive.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client/opentelemetry.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client/request.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client/runtime.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client_auth_info.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client_operation.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client_request.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client_response.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/constants.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/csv.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/csv_options.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/doc.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/go.work.sumis excluded by!**/*.sum,!vendor/**vendor/github.com/go-openapi/runtime/headers.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/interfaces.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/json.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/context.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/denco/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/denco/router.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/denco/server.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/denco/util.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/doc.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/not_implemented.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/operation.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/parameter.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/rapidoc.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/redoc.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/request.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/router.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/spec.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/swaggerui.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/ui_options.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/untyped/api.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/validation.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/request.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/security/authenticator.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/security/authorizer.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/statuses.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/text.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/values.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/xml.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/yamlpc/yaml.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/.gitignoreis excluded by!vendor/**vendor/github.com/go-openapi/spec/.golangci.ymlis excluded by!vendor/**vendor/github.com/go-openapi/spec/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/go-openapi/spec/CONTRIBUTORS.mdis excluded by!vendor/**vendor/github.com/go-openapi/spec/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/spec/SECURITY.mdis excluded by!vendor/**vendor/github.com/go-openapi/spec/cache.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/contact_info.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/debug.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/doc.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/errors.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/expander.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/header.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/info.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/items.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/license.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/normalizer.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/operation.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/parameter.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/path_item.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/paths.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/properties.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/ref.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/resolver.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/response.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/responses.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/schema.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/schema_loader.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/security_scheme.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/spec.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/swagger.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/tag.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/validations.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/xml_object.gois excluded by!vendor/**vendor/github.com/go-openapi/strfmt/.cliff.tomlis excluded by!vendor/**vendor/github.com/go-openapi/strfmt/.gitignoreis excluded by!vendor/**vendor/github.com/go-openapi/strfmt/.golangci.ymlis excluded by!vendor/**vendor/github.com/go-openapi/strfmt/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/go-openapi/strfmt/CONTRIBUTORS.mdis excluded by!vendor/**vendor/github.com/go-openapi/strfmt/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/strfmt/SECURITY.mdis excluded by!vendor/**vendor/github.com/go-openapi/strfmt/bson.gois excluded by!vendor/**vendor/github.com/go-openapi/strfmt/date.gois excluded by!vendor/**vendor/github.com/go-openapi/strfmt/default.gois excluded by!vendor/**vendor/github.com/go-openapi/strfmt/doc.gois excluded by!vendor/**vendor/github.com/go-openapi/strfmt/duration.gois excluded by!vendor/**vendor/github.com/go-openapi/strfmt/errors.gois excluded by!vendor/**vendor/github.com/go-openapi/strfmt/format.gois excluded by!vendor/**vendor/github.com/go-openapi/strfmt/go.work.sumis excluded by!**/*.sum,!vendor/**vendor/github.com/go-openapi/strfmt/ifaces.gois excluded by!vendor/**vendor/github.com/go-openapi/strfmt/internal/bsonlite/codec.gois excluded by!vendor/**vendor/github.com/go-openapi/strfmt/internal/bsonlite/lite.gois excluded by!vendor/**vendor/github.com/go-openapi/strfmt/mongo.gois excluded by!vendor/**vendor/github.com/go-openapi/strfmt/time.gois excluded by!vendor/**vendor/github.com/go-openapi/strfmt/ulid.gois excluded by!vendor/**vendor/github.com/go-openapi/swag/.gitignoreis excluded by!vendor/**vendor/github.com/go-openapi/swag/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/go-openapi/swag/CONTRIBUTORS.mdis excluded by!vendor/**vendor/github.com/go-openapi/swag/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/swag/jsonutils/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/swag/mangling/BENCHMARK.mdis excluded by!vendor/**vendor/github.com/go-openapi/validate/.gitignoreis excluded by!vendor/**vendor/github.com/go-openapi/validate/.golangci.ymlis excluded by!vendor/**vendor/github.com/go-openapi/validate/BENCHMARK.mdis excluded by!vendor/**vendor/github.com/go-openapi/validate/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/go-openapi/validate/CONTRIBUTORS.mdis excluded by!vendor/**vendor/github.com/go-openapi/validate/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/validate/SECURITY.mdis excluded by!vendor/**vendor/github.com/go-openapi/validate/context.gois excluded by!vendor/**vendor/github.com/go-openapi/validate/debug.gois excluded by!vendor/**vendor/github.com/go-openapi/validate/default_validator.gois excluded by!vendor/**vendor/github.com/go-openapi/validate/doc.gois excluded by!vendor/**vendor/github.com/go-openapi/validate/example_validator.gois excluded by!vendor/**vendor/github.com/go-openapi/validate/formats.gois excluded by!vendor/**vendor/github.com/go-openapi/validate/helpers.gois excluded by!vendor/**vendor/github.com/go-openapi/validate/object_validator.gois excluded by!vendor/**vendor/github.com/go-openapi/validate/options.gois excluded by!vendor/**vendor/github.com/go-openapi/validate/pools.gois excluded by!vendor/**vendor/github.com/go-openapi/validate/result.gois excluded by!vendor/**vendor/github.com/go-openapi/validate/rexp.gois excluded by!vendor/**vendor/github.com/go-openapi/validate/schema.gois excluded by!vendor/**vendor/github.com/go-openapi/validate/schema_messages.gois excluded by!vendor/**vendor/github.com/go-openapi/validate/schema_option.gois excluded by!vendor/**vendor/github.com/go-openapi/validate/schema_props.gois excluded by!vendor/**vendor/github.com/go-openapi/validate/slice_validator.gois excluded by!vendor/**vendor/github.com/go-openapi/validate/spec.gois excluded by!vendor/**vendor/github.com/go-openapi/validate/spec_messages.gois excluded by!vendor/**vendor/github.com/go-openapi/validate/type.gois excluded by!vendor/**vendor/github.com/go-openapi/validate/update-fixtures.shis excluded by!vendor/**vendor/github.com/go-openapi/validate/validator.gois excluded by!vendor/**vendor/github.com/go-openapi/validate/values.gois excluded by!vendor/**vendor/github.com/go-playground/validator/v10/.golangci.yamlis excluded by!vendor/**vendor/github.com/go-playground/validator/v10/README.mdis excluded by!vendor/**vendor/github.com/go-playground/validator/v10/baked_in.gois excluded by!vendor/**vendor/github.com/go-playground/validator/v10/cache.gois excluded by!vendor/**vendor/github.com/go-playground/validator/v10/country_codes.gois excluded by!vendor/**vendor/github.com/go-playground/validator/v10/currency_codes.gois excluded by!vendor/**vendor/github.com/go-playground/validator/v10/doc.gois excluded by!vendor/**vendor/github.com/go-playground/validator/v10/regexes.gois excluded by!vendor/**vendor/github.com/go-playground/validator/v10/util.gois excluded by!vendor/**vendor/github.com/go-viper/mapstructure/v2/.editorconfigis excluded by!vendor/**vendor/github.com/go-viper/mapstructure/v2/.envrcis excluded by!vendor/**vendor/github.com/go-viper/mapstructure/v2/.gitignoreis excluded by!vendor/**vendor/github.com/go-viper/mapstructure/v2/devenv.lockis excluded by!**/*.lock,!vendor/**vendor/github.com/go-viper/mapstructure/v2/devenv.nixis excluded by!vendor/**vendor/github.com/go-viper/mapstructure/v2/devenv.yamlis excluded by!vendor/**vendor/github.com/go-viper/mapstructure/v2/flake.lockis excluded by!**/*.lock,!vendor/**vendor/github.com/go-viper/mapstructure/v2/flake.nixis excluded by!vendor/**vendor/github.com/go-viper/mapstructure/v2/mapstructure.gois excluded by!vendor/**vendor/github.com/google/certificate-transparency-go/CHANGELOG.mdis excluded by!vendor/**vendor/github.com/google/certificate-transparency-go/README.mdis excluded by!vendor/**vendor/github.com/google/certificate-transparency-go/client/configpb/multilog.pb.gois excluded by!**/*.pb.go,!vendor/**vendor/github.com/google/certificate-transparency-go/loglist3/logfilter.gois excluded by!vendor/**vendor/github.com/google/certificate-transparency-go/loglist3/loglist3.gois excluded by!vendor/**vendor/github.com/google/certificate-transparency-go/loglist3/logstatus_string.gois excluded by!vendor/**vendor/github.com/google/certificate-transparency-go/types.gois excluded by!vendor/**vendor/github.com/google/go-containerregistry/pkg/authn/keychain.gois excluded by!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/hash.gois excluded by!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/layout/layoutpath.gois excluded by!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/mutate/mutate.gois excluded by!vendor/**
📒 Files selected for processing (13)
api/v1alpha1/operatorconfig_types.goapi/v1alpha1/operatorconfig_types_test.goapi/v1alpha1/workspace_types.goapi/v1alpha1/zz_generated.deepcopy.gogo.modinternal/buildapi/bundle_verify_test.gointernal/buildapi/server.gointernal/buildapi/workspace.gointernal/common/bundleverify/verify.gointernal/common/bundleverify/verify_test.gointernal/controller/imagebuild/controller.gointernal/controller/workspace/controller.gointernal/controller/workspace/controller_test.go
✅ Files skipped from review due to trivial changes (2)
- api/v1alpha1/operatorconfig_types_test.go
- api/v1alpha1/zz_generated.deepcopy.go
🚧 Files skipped from review as they are similar to previous changes (7)
- internal/buildapi/workspace.go
- api/v1alpha1/workspace_types.go
- internal/buildapi/server.go
- internal/controller/workspace/controller_test.go
- api/v1alpha1/operatorconfig_types.go
- internal/controller/imagebuild/controller.go
- internal/controller/workspace/controller.go
bennyz
force-pushed
the
private-registry-workspace
branch
2 times, most recently
from
ff0af43 to
60f6cec
Compare
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (1)
go.mod (1)
21-23:⚠️ Potential issue | 🟠 Major | ⚡ Quick winAlign all Kubernetes modules to the same minor version.
k8s.io/*is still split acrossv0.35.xandv0.34.x, which risks API/runtime skew. This was already flagged earlier and appears unresolved.#!/bin/bash # Verify current Kubernetes module minor alignment in go.mod rg -n '^\s*k8s\.io/(api|apimachinery|client-go|apiserver|apiextensions-apiserver|component-base)\s+v' go.modAlso applies to: 232-234
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@go.mod` around lines 21 - 23, The go.mod lists Kubernetes modules with mixed minor versions (k8s.io/apimachinery v0.35.3, k8s.io/apiserver v0.34.7, k8s.io/client-go v0.35.3); update the mismatched module(s) so all k8s.io/* entries use the same minor version (e.g., bump k8s.io/apiserver to v0.35.3) to avoid API/runtime skew—ensure you adjust any other k8s.io/* modules (apiextensions-apiserver, component-base, api, client-go, apimachinery, apiserver) to the identical v0.35.x version and run `go mod tidy` to reconcile dependencies.
🧹 Nitpick comments (2)
internal/common/bundleverify/keychain_test.go (1)
48-118: ⚡ Quick winAdd a test for the legacy
.dockercfgsecret path (corev1.DockerConfigKey).The new implementation supports both Docker config keys, but current tests only exercise
corev1.DockerConfigJsonKey. A focused test forcorev1.DockerConfigKeywould close the branch gap.As per coding guidelines "
**/*.go: Add failing tests before starting implementation".🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@internal/common/bundleverify/keychain_test.go` around lines 48 - 118, Add a new unit test that mirrors TestKeychainFromPullSecrets_ResolvesDockerConfigJSON but verifies the legacy .dockercfg path: create a secret with Type corev1.SecretTypeDockercfg and Data keyed by corev1.DockerConfigKey containing a dockercfg-formatted JSON (with registry.example.com username/password), call KeychainFromPullSecrets with newFakeReader, resolve a name.NewRegistry("registry.example.com") against the returned keychain and assert the Authorization() returns the expected username/password; this ensures the KeychainFromPullSecrets handling of corev1.DockerConfigKey is exercised.internal/common/bundleverify/keychain.go (1)
33-38: ⚡ Quick winFail fast when an explicitly referenced pull secret is not a Docker auth secret.
Silently skipping referenced secrets without
.dockerconfigjson/.dockercfgcan hide config mistakes and lead to confusing downstream auth failures. Returning an error here gives immediate feedback.Proposed change
data, ok := secret.Data[corev1.DockerConfigJsonKey] if !ok { data, ok = secret.Data[corev1.DockerConfigKey] if !ok { - continue + return nil, fmt.Errorf("pull secret %q does not contain %q or %q", ref.Name, corev1.DockerConfigJsonKey, corev1.DockerConfigKey) } }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@internal/common/bundleverify/keychain.go` around lines 33 - 38, The loop currently silently continues when a secret's Data lacks corev1.DockerConfigJsonKey or corev1.DockerConfigKey; change this to fail fast by returning an error (e.g., fmt.Errorf) indicating the secret name/namespace is not a Docker auth secret so callers get immediate feedback. Locate the block accessing secret.Data[corev1.DockerConfigJsonKey] / corev1.DockerConfigKey in keychain.go (the variable secret in the loop) and replace the inner continue with a returned error that includes secret.Name and secret.Namespace; ensure the function signature and callers propagate the error.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 59: The go.mod currently pins github.com/docker/docker to v28.5.2 which
contains security fixes; update the dependency declaration for
github.com/docker/docker to v29.3.1 (or later) in go.mod, then run `go get
github.com/docker/docker@v29.3.1` (or the equivalent tool/command in your
workflow) and `go mod tidy`/`go mod download` to refresh go.sum and vendor
files, rebuild and run tests to ensure compatibility; reference the module name
"github.com/docker/docker" when locating the version entry to change.
- Line 202: The go.mod currently pins github.com/tektoncd/pipeline at v1.6.0
which is vulnerable; update the module requirement for
github.com/tektoncd/pipeline to a patched release (minimum v1.6.1, preferably
v1.11.1) in go.mod, then run go get github.com/tektoncd/pipeline@v1.11.1 (or
`@v1.6.1` if constrained), followed by go mod tidy (and go mod vendor if you
vendor) and run the test suite to ensure no regressions; search for any code
referencing github.com/tektoncd/pipeline types or imports to confirm
compatibility and adjust imports/usages if the newer API requires changes.
---
Duplicate comments:
In `@go.mod`:
- Around line 21-23: The go.mod lists Kubernetes modules with mixed minor
versions (k8s.io/apimachinery v0.35.3, k8s.io/apiserver v0.34.7,
k8s.io/client-go v0.35.3); update the mismatched module(s) so all k8s.io/*
entries use the same minor version (e.g., bump k8s.io/apiserver to v0.35.3) to
avoid API/runtime skew—ensure you adjust any other k8s.io/* modules
(apiextensions-apiserver, component-base, api, client-go, apimachinery,
apiserver) to the identical v0.35.x version and run `go mod tidy` to reconcile
dependencies.
---
Nitpick comments:
In `@internal/common/bundleverify/keychain_test.go`:
- Around line 48-118: Add a new unit test that mirrors
TestKeychainFromPullSecrets_ResolvesDockerConfigJSON but verifies the legacy
.dockercfg path: create a secret with Type corev1.SecretTypeDockercfg and Data
keyed by corev1.DockerConfigKey containing a dockercfg-formatted JSON (with
registry.example.com username/password), call KeychainFromPullSecrets with
newFakeReader, resolve a name.NewRegistry("registry.example.com") against the
returned keychain and assert the Authorization() returns the expected
username/password; this ensures the KeychainFromPullSecrets handling of
corev1.DockerConfigKey is exercised.
In `@internal/common/bundleverify/keychain.go`:
- Around line 33-38: The loop currently silently continues when a secret's Data
lacks corev1.DockerConfigJsonKey or corev1.DockerConfigKey; change this to fail
fast by returning an error (e.g., fmt.Errorf) indicating the secret
name/namespace is not a Docker auth secret so callers get immediate feedback.
Locate the block accessing secret.Data[corev1.DockerConfigJsonKey] /
corev1.DockerConfigKey in keychain.go (the variable secret in the loop) and
replace the inner continue with a returned error that includes secret.Name and
secret.Namespace; ensure the function signature and callers propagate the error.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: c032cd2f-d037-4a41-b1a6-d53d0c4e2390
⛔ Files ignored due to path filters (285)
config/crd/bases/automotive.sdv.cloud.redhat.com_operatorconfigs.yamlis excluded by!config/crd/bases/**config/crd/bases/automotive.sdv.cloud.redhat.com_workspaces.yamlis excluded by!config/crd/bases/**go.sumis excluded by!**/*.sum,!**go.sumvendor/github.com/containerd/stargz-snapshotter/estargz/estargz.gois excluded by!vendor/**vendor/github.com/docker/cli/cli/config/configfile/file.gois excluded by!vendor/**vendor/github.com/docker/go-connections/tlsconfig/config.gois excluded by!vendor/**vendor/github.com/docker/go-connections/tlsconfig/config_client_ciphers.gois excluded by!vendor/**vendor/github.com/emicklei/go-restful/v3/.travis.ymlis excluded by!vendor/**vendor/github.com/emicklei/go-restful/v3/CHANGES.mdis excluded by!vendor/**vendor/github.com/emicklei/go-restful/v3/README.mdis excluded by!vendor/**vendor/github.com/emicklei/go-restful/v3/curly.gois excluded by!vendor/**vendor/github.com/emicklei/go-restful/v3/custom_verb.gois excluded by!vendor/**vendor/github.com/emicklei/go-restful/v3/doc.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/.git-blame-ignore-revsis excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/.golangci.ymlis excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/README.mdis excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/charset/charset.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/json/parser.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/magic/archive.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/magic/audio.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/magic/binary.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/magic/database.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/magic/document.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/magic/font.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/magic/ftyp.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/magic/image.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/magic/magic.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/magic/meteo.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/magic/ms_office.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/magic/text.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/magic/video.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/magic/zip.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/markup/markup.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/scan/bytes.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/mime.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/mimetype.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/supported_mimes.mdis excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/tree.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/chi.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/content_charset.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/request_id.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/route_headers.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/strip.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/mux.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/path_value.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/path_value_fallback.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/tree.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/.editorconfigis excluded by!vendor/**vendor/github.com/go-openapi/analysis/.gitignoreis excluded by!vendor/**vendor/github.com/go-openapi/analysis/.golangci.ymlis excluded by!vendor/**vendor/github.com/go-openapi/analysis/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/go-openapi/analysis/CONTRIBUTORS.mdis excluded by!vendor/**vendor/github.com/go-openapi/analysis/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/analysis/SECURITY.mdis excluded by!vendor/**vendor/github.com/go-openapi/analysis/analyzer.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/debug.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/doc.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/flatten.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/flatten_name.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/flatten_options.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/go.work.sumis excluded by!**/*.sum,!vendor/**vendor/github.com/go-openapi/analysis/internal/debug/debug.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/internal/flatten/normalize/normalize.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/internal/flatten/operations/operations.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/internal/flatten/replace/errors.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/internal/flatten/replace/replace.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/internal/flatten/schutils/flatten_schema.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/internal/flatten/sortref/keys.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/internal/flatten/sortref/sort_ref.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/mixin.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/schema.gois excluded by!vendor/**vendor/github.com/go-openapi/errors/.editorconfigis excluded by!vendor/**vendor/github.com/go-openapi/errors/.gitignoreis excluded by!vendor/**vendor/github.com/go-openapi/errors/.golangci.ymlis excluded by!vendor/**vendor/github.com/go-openapi/errors/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/go-openapi/errors/CONTRIBUTORS.mdis excluded by!vendor/**vendor/github.com/go-openapi/errors/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/errors/SECURITY.mdis excluded by!vendor/**vendor/github.com/go-openapi/errors/api.gois excluded by!vendor/**vendor/github.com/go-openapi/errors/auth.gois excluded by!vendor/**vendor/github.com/go-openapi/errors/doc.gois excluded by!vendor/**vendor/github.com/go-openapi/errors/headers.gois excluded by!vendor/**vendor/github.com/go-openapi/errors/middleware.gois excluded by!vendor/**vendor/github.com/go-openapi/errors/parsing.gois excluded by!vendor/**vendor/github.com/go-openapi/errors/schema.gois excluded by!vendor/**vendor/github.com/go-openapi/jsonpointer/.cliff.tomlis excluded by!vendor/**vendor/github.com/go-openapi/jsonpointer/.gitignoreis excluded by!vendor/**vendor/github.com/go-openapi/jsonpointer/.golangci.ymlis excluded by!vendor/**vendor/github.com/go-openapi/jsonpointer/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/go-openapi/jsonpointer/CONTRIBUTORS.mdis excluded by!vendor/**vendor/github.com/go-openapi/jsonpointer/LICENSEis excluded by!vendor/**vendor/github.com/go-openapi/jsonpointer/NOTICEis excluded by!vendor/**vendor/github.com/go-openapi/jsonpointer/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/jsonpointer/SECURITY.mdis excluded by!vendor/**vendor/github.com/go-openapi/jsonpointer/errors.gois excluded by!vendor/**vendor/github.com/go-openapi/jsonpointer/pointer.gois excluded by!vendor/**vendor/github.com/go-openapi/jsonreference/.editorconfigis excluded by!vendor/**vendor/github.com/go-openapi/jsonreference/.gitignoreis excluded by!vendor/**vendor/github.com/go-openapi/jsonreference/.golangci.ymlis excluded by!vendor/**vendor/github.com/go-openapi/jsonreference/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/go-openapi/jsonreference/CONTRIBUTORS.mdis excluded by!vendor/**vendor/github.com/go-openapi/jsonreference/NOTICEis excluded by!vendor/**vendor/github.com/go-openapi/jsonreference/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/jsonreference/SECURITY.mdis excluded by!vendor/**vendor/github.com/go-openapi/jsonreference/internal/normalize_url.gois excluded by!vendor/**vendor/github.com/go-openapi/jsonreference/reference.gois excluded by!vendor/**vendor/github.com/go-openapi/loads/.gitignoreis excluded by!vendor/**vendor/github.com/go-openapi/loads/.golangci.ymlis excluded by!vendor/**vendor/github.com/go-openapi/loads/.travis.ymlis excluded by!vendor/**vendor/github.com/go-openapi/loads/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/go-openapi/loads/CONTRIBUTORS.mdis excluded by!vendor/**vendor/github.com/go-openapi/loads/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/loads/SECURITY.mdis excluded by!vendor/**vendor/github.com/go-openapi/loads/doc.gois excluded by!vendor/**vendor/github.com/go-openapi/loads/errors.gois excluded by!vendor/**vendor/github.com/go-openapi/loads/loaders.gois excluded by!vendor/**vendor/github.com/go-openapi/loads/options.gois excluded by!vendor/**vendor/github.com/go-openapi/loads/spec.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/.gitignoreis excluded by!vendor/**vendor/github.com/go-openapi/runtime/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/go-openapi/runtime/NOTICEis excluded by!vendor/**vendor/github.com/go-openapi/runtime/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/runtime/SECURITY.mdis excluded by!vendor/**vendor/github.com/go-openapi/runtime/bytestream.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client/auth_info.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client/keepalive.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client/opentelemetry.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client/request.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client/runtime.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client_auth_info.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client_operation.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client_request.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client_response.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/constants.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/csv.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/csv_options.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/doc.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/go.work.sumis excluded by!**/*.sum,!vendor/**vendor/github.com/go-openapi/runtime/headers.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/interfaces.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/json.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/context.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/denco/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/denco/router.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/denco/server.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/denco/util.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/doc.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/not_implemented.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/operation.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/parameter.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/rapidoc.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/redoc.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/request.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/router.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/spec.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/swaggerui.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/ui_options.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/untyped/api.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/validation.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/request.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/security/authenticator.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/security/authorizer.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/statuses.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/text.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/values.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/xml.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/yamlpc/yaml.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/.gitignoreis excluded by!vendor/**vendor/github.com/go-openapi/spec/.golangci.ymlis excluded by!vendor/**vendor/github.com/go-openapi/spec/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/go-openapi/spec/CONTRIBUTORS.mdis excluded by!vendor/**vendor/github.com/go-openapi/spec/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/spec/SECURITY.mdis excluded by!vendor/**vendor/github.com/go-openapi/spec/cache.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/contact_info.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/debug.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/doc.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/errors.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/expander.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/header.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/info.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/items.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/license.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/normalizer.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/operation.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/parameter.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/path_item.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/paths.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/properties.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/ref.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/resolver.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/response.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/responses.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/schema.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/schema_loader.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/security_scheme.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/spec.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/swagger.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/tag.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/validations.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/xml_object.gois excluded by!vendor/**vendor/github.com/go-openapi/strfmt/.cliff.tomlis excluded by!vendor/**vendor/github.com/go-openapi/strfmt/.gitignoreis excluded by!vendor/**vendor/github.com/go-openapi/strfmt/.golangci.ymlis excluded by!vendor/**vendor/github.com/go-openapi/strfmt/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/go-openapi/strfmt/CONTRIBUTORS.mdis excluded by!vendor/**vendor/github.com/go-openapi/strfmt/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/strfmt/SECURITY.mdis excluded by!vendor/**vendor/github.com/go-openapi/strfmt/bson.gois excluded by!vendor/**vendor/github.com/go-openapi/strfmt/date.gois excluded by!vendor/**vendor/github.com/go-openapi/strfmt/default.gois excluded by!vendor/**vendor/github.com/go-openapi/strfmt/doc.gois excluded by!vendor/**vendor/github.com/go-openapi/strfmt/duration.gois excluded by!vendor/**vendor/github.com/go-openapi/strfmt/errors.gois excluded by!vendor/**vendor/github.com/go-openapi/strfmt/format.gois excluded by!vendor/**vendor/github.com/go-openapi/strfmt/go.work.sumis excluded by!**/*.sum,!vendor/**vendor/github.com/go-openapi/strfmt/ifaces.gois excluded by!vendor/**vendor/github.com/go-openapi/strfmt/internal/bsonlite/codec.gois excluded by!vendor/**vendor/github.com/go-openapi/strfmt/internal/bsonlite/lite.gois excluded by!vendor/**vendor/github.com/go-openapi/strfmt/mongo.gois excluded by!vendor/**vendor/github.com/go-openapi/strfmt/time.gois excluded by!vendor/**vendor/github.com/go-openapi/strfmt/ulid.gois excluded by!vendor/**vendor/github.com/go-openapi/swag/.gitignoreis excluded by!vendor/**vendor/github.com/go-openapi/swag/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/go-openapi/swag/CONTRIBUTORS.mdis excluded by!vendor/**vendor/github.com/go-openapi/swag/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/swag/jsonutils/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/swag/mangling/BENCHMARK.mdis excluded by!vendor/**vendor/github.com/go-openapi/validate/.gitignoreis excluded by!vendor/**vendor/github.com/go-openapi/validate/.golangci.ymlis excluded by!vendor/**vendor/github.com/go-openapi/validate/BENCHMARK.mdis excluded by!vendor/**vendor/github.com/go-openapi/validate/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/go-openapi/validate/CONTRIBUTORS.mdis excluded by!vendor/**vendor/github.com/go-openapi/validate/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/validate/SECURITY.mdis excluded by!vendor/**vendor/github.com/go-openapi/validate/context.gois excluded by!vendor/**vendor/github.com/go-openapi/validate/debug.gois excluded by!vendor/**vendor/github.com/go-openapi/validate/default_validator.gois excluded by!vendor/**vendor/github.com/go-openapi/validate/doc.gois excluded by!vendor/**vendor/github.com/go-openapi/validate/example_validator.gois excluded by!vendor/**vendor/github.com/go-openapi/validate/formats.gois excluded by!vendor/**vendor/github.com/go-openapi/validate/helpers.gois excluded by!vendor/**vendor/github.com/go-openapi/validate/object_validator.gois excluded by!vendor/**vendor/github.com/go-openapi/validate/options.gois excluded by!vendor/**vendor/github.com/go-openapi/validate/pools.gois excluded by!vendor/**vendor/github.com/go-openapi/validate/result.gois excluded by!vendor/**vendor/github.com/go-openapi/validate/rexp.gois excluded by!vendor/**vendor/github.com/go-openapi/validate/schema.gois excluded by!vendor/**vendor/github.com/go-openapi/validate/schema_messages.gois excluded by!vendor/**vendor/github.com/go-openapi/validate/schema_option.gois excluded by!vendor/**vendor/github.com/go-openapi/validate/schema_props.gois excluded by!vendor/**vendor/github.com/go-openapi/validate/slice_validator.gois excluded by!vendor/**vendor/github.com/go-openapi/validate/spec.gois excluded by!vendor/**vendor/github.com/go-openapi/validate/spec_messages.gois excluded by!vendor/**vendor/github.com/go-openapi/validate/type.gois excluded by!vendor/**vendor/github.com/go-openapi/validate/update-fixtures.shis excluded by!vendor/**vendor/github.com/go-openapi/validate/validator.gois excluded by!vendor/**vendor/github.com/go-openapi/validate/values.gois excluded by!vendor/**vendor/github.com/go-playground/validator/v10/.golangci.yamlis excluded by!vendor/**vendor/github.com/go-playground/validator/v10/README.mdis excluded by!vendor/**vendor/github.com/go-playground/validator/v10/baked_in.gois excluded by!vendor/**vendor/github.com/go-playground/validator/v10/cache.gois excluded by!vendor/**vendor/github.com/go-playground/validator/v10/country_codes.gois excluded by!vendor/**vendor/github.com/go-playground/validator/v10/currency_codes.gois excluded by!vendor/**vendor/github.com/go-playground/validator/v10/doc.gois excluded by!vendor/**vendor/github.com/go-playground/validator/v10/regexes.gois excluded by!vendor/**vendor/github.com/go-playground/validator/v10/util.gois excluded by!vendor/**vendor/github.com/go-viper/mapstructure/v2/.editorconfigis excluded by!vendor/**vendor/github.com/go-viper/mapstructure/v2/.envrcis excluded by!vendor/**vendor/github.com/go-viper/mapstructure/v2/.gitignoreis excluded by!vendor/**vendor/github.com/go-viper/mapstructure/v2/devenv.lockis excluded by!**/*.lock,!vendor/**vendor/github.com/go-viper/mapstructure/v2/devenv.nixis excluded by!vendor/**vendor/github.com/go-viper/mapstructure/v2/devenv.yamlis excluded by!vendor/**vendor/github.com/go-viper/mapstructure/v2/flake.lockis excluded by!**/*.lock,!vendor/**vendor/github.com/go-viper/mapstructure/v2/flake.nixis excluded by!vendor/**vendor/github.com/go-viper/mapstructure/v2/mapstructure.gois excluded by!vendor/**vendor/github.com/google/certificate-transparency-go/CHANGELOG.mdis excluded by!vendor/**vendor/github.com/google/certificate-transparency-go/README.mdis excluded by!vendor/**vendor/github.com/google/certificate-transparency-go/client/configpb/multilog.pb.gois excluded by!**/*.pb.go,!vendor/**vendor/github.com/google/certificate-transparency-go/loglist3/logfilter.gois excluded by!vendor/**vendor/github.com/google/certificate-transparency-go/loglist3/loglist3.gois excluded by!vendor/**vendor/github.com/google/certificate-transparency-go/loglist3/logstatus_string.gois excluded by!vendor/**vendor/github.com/google/certificate-transparency-go/types.gois excluded by!vendor/**vendor/github.com/google/go-containerregistry/pkg/authn/keychain.gois excluded by!vendor/**vendor/github.com/google/go-containerregistry/pkg/v1/hash.gois excluded by!vendor/**
📒 Files selected for processing (15)
api/v1alpha1/operatorconfig_types.goapi/v1alpha1/operatorconfig_types_test.goapi/v1alpha1/workspace_types.goapi/v1alpha1/zz_generated.deepcopy.gogo.modinternal/buildapi/bundle_verify_test.gointernal/buildapi/server.gointernal/buildapi/workspace.gointernal/common/bundleverify/keychain.gointernal/common/bundleverify/keychain_test.gointernal/common/bundleverify/verify.gointernal/common/bundleverify/verify_test.gointernal/controller/imagebuild/controller.gointernal/controller/workspace/controller.gointernal/controller/workspace/controller_test.go
✅ Files skipped from review due to trivial changes (1)
- api/v1alpha1/zz_generated.deepcopy.go
🚧 Files skipped from review as they are similar to previous changes (11)
- internal/controller/workspace/controller_test.go
- internal/buildapi/workspace.go
- internal/buildapi/bundle_verify_test.go
- api/v1alpha1/workspace_types.go
- api/v1alpha1/operatorconfig_types_test.go
- internal/controller/workspace/controller.go
- internal/common/bundleverify/verify_test.go
- internal/buildapi/server.go
- api/v1alpha1/operatorconfig_types.go
- internal/controller/imagebuild/controller.go
- internal/common/bundleverify/verify.go
| github.com/docker/cli v29.0.3+incompatible // indirect | ||
| github.com/docker/cli v29.3.0+incompatible // indirect | ||
| github.com/docker/distribution v2.8.3+incompatible // indirect | ||
| github.com/docker/docker v28.5.2+incompatible // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Query OSV for vulnerabilities on current Docker module version
curl -s https://api.osv.dev/v1/query \
-H 'Content-Type: application/json' \
-d '{"package":{"ecosystem":"Go","name":"github.com/docker/docker"},"version":"28.5.2+incompatible"}' | jqRepository: centos-automotive-suite/automotive-dev-operator
Length of output: 16566
Bump github.com/docker/docker to v29.3.1 or later to patch HIGH and MODERATE severity vulnerabilities.
The current version (v28.5.2) is affected by two advisories:
- GHSA-x744-4wpc-v9h2 (HIGH): AuthZ plugin bypass when provided oversized request bodies
- GHSA-pxq6-2prw-chj9 (MODERATE): Off-by-one error in plugin privilege validation
Both are fixed in v29.3.1. Even if used indirectly, upgrading reduces supply-chain risk.
🧰 Tools
🪛 OSV Scanner (2.3.8)
[HIGH] 59-59: github.com/docker/docker 28.5.2+incompatible: Moby has an Off-by-one error in its plugin privilege validation in github.com/docker/docker
(GO-2026-4883)
[HIGH] 59-59: github.com/docker/docker 28.5.2+incompatible: Moby has AuthZ plugin bypass when provided oversized request bodies in github.com/docker/docker
(GO-2026-4887)
[HIGH] 59-59: github.com/docker/docker 28.5.2+incompatible: Moby has an Off-by-one error in its plugin privilege validation
[HIGH] 59-59: github.com/docker/docker 28.5.2+incompatible: Moby has AuthZ plugin bypass when provided oversized request bodies
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 59, The go.mod currently pins github.com/docker/docker to
v28.5.2 which contains security fixes; update the dependency declaration for
github.com/docker/docker to v29.3.1 (or later) in go.mod, then run `go get
github.com/docker/docker@v29.3.1` (or the equivalent tool/command in your
workflow) and `go mod tidy`/`go mod download` to refresh go.sum and vendor
files, rebuild and run tests to ensure compatibility; reference the module name
"github.com/docker/docker" when locating the version entry to change.
- and cosign verification - and allowlist Signed-off-by: Benny Zlotnik <bzlotnik@redhat.com> Assisted-by: claude-opus-4.6
bennyz
force-pushed
the
private-registry-workspace
branch
from
60f6cec to
9522816
Compare
Contributor
Author
|
@ambient-code please review |
Contributor
Author
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 208: Update the vulnerable dependency entry in go.mod from
go.opentelemetry.io/otel/sdk v1.42.0 to v1.43.0 and then run go get
go.opentelemetry.io/otel/sdk@v1.43.0 followed by go mod tidy to remove any
transitive references to the old version; additionally inspect host_id.go where
the kenv invocation is used and change the bare "kenv" call to an absolute path
or a safe lookup (ensure the symbol/name host_id.go and any function calling
kenv are updated) so PATH hijacking is avoided before re-running go mod tidy and
tests.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: ffdbfe51-5ef6-4c36-9193-720e079c1d24
⛔ Files ignored due to path filters (284)
config/crd/bases/automotive.sdv.cloud.redhat.com_operatorconfigs.yamlis excluded by!config/crd/bases/**config/crd/bases/automotive.sdv.cloud.redhat.com_workspaces.yamlis excluded by!config/crd/bases/**go.sumis excluded by!**/*.sum,!**go.sumvendor/contrib.go.opencensus.io/exporter/ocagent/.gitignoreis excluded by!vendor/**vendor/contrib.go.opencensus.io/exporter/ocagent/.travis.ymlis excluded by!vendor/**vendor/contrib.go.opencensus.io/exporter/ocagent/CONTRIBUTING.mdis excluded by!vendor/**vendor/contrib.go.opencensus.io/exporter/ocagent/README.mdis excluded by!vendor/**vendor/contrib.go.opencensus.io/exporter/ocagent/common.gois excluded by!vendor/**vendor/contrib.go.opencensus.io/exporter/ocagent/connection.gois excluded by!vendor/**vendor/contrib.go.opencensus.io/exporter/ocagent/nodeinfo.gois excluded by!vendor/**vendor/contrib.go.opencensus.io/exporter/ocagent/ocagent.gois excluded by!vendor/**vendor/contrib.go.opencensus.io/exporter/ocagent/options.gois excluded by!vendor/**vendor/contrib.go.opencensus.io/exporter/ocagent/span_config.gois excluded by!vendor/**vendor/contrib.go.opencensus.io/exporter/ocagent/transform_spans.gois excluded by!vendor/**vendor/contrib.go.opencensus.io/exporter/ocagent/transform_stats_to_metrics.gois excluded by!vendor/**vendor/contrib.go.opencensus.io/exporter/ocagent/version.gois excluded by!vendor/**vendor/contrib.go.opencensus.io/exporter/prometheus/.gitignoreis excluded by!vendor/**vendor/contrib.go.opencensus.io/exporter/prometheus/.golangci.ymlis excluded by!vendor/**vendor/contrib.go.opencensus.io/exporter/prometheus/.travis.ymlis excluded by!vendor/**vendor/contrib.go.opencensus.io/exporter/prometheus/Makefileis excluded by!vendor/**vendor/contrib.go.opencensus.io/exporter/prometheus/README.mdis excluded by!vendor/**vendor/contrib.go.opencensus.io/exporter/prometheus/prometheus.gois excluded by!vendor/**vendor/contrib.go.opencensus.io/exporter/prometheus/sanitize.gois excluded by!vendor/**vendor/github.com/blendle/zapdriver/.gitignoreis excluded by!vendor/**vendor/github.com/blendle/zapdriver/LICENSEis excluded by!vendor/**vendor/github.com/blendle/zapdriver/README.mdis excluded by!vendor/**vendor/github.com/blendle/zapdriver/config.gois excluded by!vendor/**vendor/github.com/blendle/zapdriver/core.gois excluded by!vendor/**vendor/github.com/blendle/zapdriver/encoder.gois excluded by!vendor/**vendor/github.com/blendle/zapdriver/http.gois excluded by!vendor/**vendor/github.com/blendle/zapdriver/label.gois excluded by!vendor/**vendor/github.com/blendle/zapdriver/logger.gois excluded by!vendor/**vendor/github.com/blendle/zapdriver/operation.gois excluded by!vendor/**vendor/github.com/blendle/zapdriver/report.gois excluded by!vendor/**vendor/github.com/blendle/zapdriver/service.gois excluded by!vendor/**vendor/github.com/blendle/zapdriver/source.gois excluded by!vendor/**vendor/github.com/blendle/zapdriver/trace.gois excluded by!vendor/**vendor/github.com/census-instrumentation/opencensus-proto/AUTHORSis excluded by!vendor/**vendor/github.com/census-instrumentation/opencensus-proto/gen-go/agent/common/v1/common.pb.gois excluded by!**/*.pb.go,!vendor/**vendor/github.com/census-instrumentation/opencensus-proto/gen-go/agent/metrics/v1/metrics_service.pb.gois excluded by!**/*.pb.go,!vendor/**vendor/github.com/census-instrumentation/opencensus-proto/gen-go/agent/trace/v1/trace_service.pb.gois excluded by!**/*.pb.go,!vendor/**vendor/github.com/census-instrumentation/opencensus-proto/gen-go/agent/trace/v1/trace_service.pb.gw.gois excluded by!**/*.pb.gw.go,!vendor/**vendor/github.com/census-instrumentation/opencensus-proto/gen-go/metrics/v1/metrics.pb.gois excluded by!**/*.pb.go,!vendor/**vendor/github.com/census-instrumentation/opencensus-proto/gen-go/resource/v1/resource.pb.gois excluded by!**/*.pb.go,!vendor/**vendor/github.com/census-instrumentation/opencensus-proto/gen-go/trace/v1/trace.pb.gois excluded by!**/*.pb.go,!vendor/**vendor/github.com/census-instrumentation/opencensus-proto/gen-go/trace/v1/trace_config.pb.gois excluded by!**/*.pb.go,!vendor/**vendor/github.com/containerd/stargz-snapshotter/estargz/estargz.gois excluded by!vendor/**vendor/github.com/docker/cli/AUTHORSis excluded by!vendor/**vendor/github.com/docker/cli/cli/config/configfile/file.gois excluded by!vendor/**vendor/github.com/docker/cli/cli/config/credentials/file_store.gois excluded by!vendor/**vendor/github.com/docker/cli/cli/config/memorystore/store.gois excluded by!vendor/**vendor/github.com/docker/distribution/registry/client/auth/challenge/addr.gois excluded by!vendor/**vendor/github.com/docker/go-connections/tlsconfig/config.gois excluded by!vendor/**vendor/github.com/docker/go-connections/tlsconfig/config_client_ciphers.gois excluded by!vendor/**vendor/github.com/emicklei/go-restful/v3/.travis.ymlis excluded by!vendor/**vendor/github.com/emicklei/go-restful/v3/CHANGES.mdis excluded by!vendor/**vendor/github.com/emicklei/go-restful/v3/README.mdis excluded by!vendor/**vendor/github.com/emicklei/go-restful/v3/curly.gois excluded by!vendor/**vendor/github.com/emicklei/go-restful/v3/custom_verb.gois excluded by!vendor/**vendor/github.com/emicklei/go-restful/v3/doc.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/.git-blame-ignore-revsis excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/.golangci.ymlis excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/README.mdis excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/charset/charset.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/json/parser.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/magic/archive.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/magic/audio.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/magic/binary.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/magic/database.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/magic/document.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/magic/font.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/magic/ftyp.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/magic/image.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/magic/magic.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/magic/meteo.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/magic/ms_office.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/magic/text.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/magic/video.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/magic/zip.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/markup/markup.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/internal/scan/bytes.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/mime.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/mimetype.gois excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/supported_mimes.mdis excluded by!vendor/**vendor/github.com/gabriel-vasile/mimetype/tree.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/chi.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/content_charset.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/request_id.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/route_headers.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/middleware/strip.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/mux.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/path_value.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/path_value_fallback.gois excluded by!vendor/**vendor/github.com/go-chi/chi/v5/tree.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/.editorconfigis excluded by!vendor/**vendor/github.com/go-openapi/analysis/.gitignoreis excluded by!vendor/**vendor/github.com/go-openapi/analysis/.golangci.ymlis excluded by!vendor/**vendor/github.com/go-openapi/analysis/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/go-openapi/analysis/CONTRIBUTORS.mdis excluded by!vendor/**vendor/github.com/go-openapi/analysis/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/analysis/SECURITY.mdis excluded by!vendor/**vendor/github.com/go-openapi/analysis/analyzer.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/debug.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/doc.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/flatten.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/flatten_name.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/flatten_options.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/go.work.sumis excluded by!**/*.sum,!vendor/**vendor/github.com/go-openapi/analysis/internal/debug/debug.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/internal/flatten/normalize/normalize.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/internal/flatten/operations/operations.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/internal/flatten/replace/errors.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/internal/flatten/replace/replace.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/internal/flatten/schutils/flatten_schema.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/internal/flatten/sortref/keys.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/internal/flatten/sortref/sort_ref.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/mixin.gois excluded by!vendor/**vendor/github.com/go-openapi/analysis/schema.gois excluded by!vendor/**vendor/github.com/go-openapi/errors/.editorconfigis excluded by!vendor/**vendor/github.com/go-openapi/errors/.gitignoreis excluded by!vendor/**vendor/github.com/go-openapi/errors/.golangci.ymlis excluded by!vendor/**vendor/github.com/go-openapi/errors/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/go-openapi/errors/CONTRIBUTORS.mdis excluded by!vendor/**vendor/github.com/go-openapi/errors/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/errors/SECURITY.mdis excluded by!vendor/**vendor/github.com/go-openapi/errors/api.gois excluded by!vendor/**vendor/github.com/go-openapi/errors/auth.gois excluded by!vendor/**vendor/github.com/go-openapi/errors/doc.gois excluded by!vendor/**vendor/github.com/go-openapi/errors/headers.gois excluded by!vendor/**vendor/github.com/go-openapi/errors/middleware.gois excluded by!vendor/**vendor/github.com/go-openapi/errors/parsing.gois excluded by!vendor/**vendor/github.com/go-openapi/errors/schema.gois excluded by!vendor/**vendor/github.com/go-openapi/jsonpointer/.cliff.tomlis excluded by!vendor/**vendor/github.com/go-openapi/jsonpointer/.gitignoreis excluded by!vendor/**vendor/github.com/go-openapi/jsonpointer/.golangci.ymlis excluded by!vendor/**vendor/github.com/go-openapi/jsonpointer/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/go-openapi/jsonpointer/CONTRIBUTORS.mdis excluded by!vendor/**vendor/github.com/go-openapi/jsonpointer/LICENSEis excluded by!vendor/**vendor/github.com/go-openapi/jsonpointer/NOTICEis excluded by!vendor/**vendor/github.com/go-openapi/jsonpointer/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/jsonpointer/SECURITY.mdis excluded by!vendor/**vendor/github.com/go-openapi/jsonpointer/errors.gois excluded by!vendor/**vendor/github.com/go-openapi/jsonpointer/pointer.gois excluded by!vendor/**vendor/github.com/go-openapi/jsonreference/.editorconfigis excluded by!vendor/**vendor/github.com/go-openapi/jsonreference/.gitignoreis excluded by!vendor/**vendor/github.com/go-openapi/jsonreference/.golangci.ymlis excluded by!vendor/**vendor/github.com/go-openapi/jsonreference/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/go-openapi/jsonreference/CONTRIBUTORS.mdis excluded by!vendor/**vendor/github.com/go-openapi/jsonreference/NOTICEis excluded by!vendor/**vendor/github.com/go-openapi/jsonreference/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/jsonreference/SECURITY.mdis excluded by!vendor/**vendor/github.com/go-openapi/jsonreference/internal/normalize_url.gois excluded by!vendor/**vendor/github.com/go-openapi/jsonreference/reference.gois excluded by!vendor/**vendor/github.com/go-openapi/loads/.gitignoreis excluded by!vendor/**vendor/github.com/go-openapi/loads/.golangci.ymlis excluded by!vendor/**vendor/github.com/go-openapi/loads/.travis.ymlis excluded by!vendor/**vendor/github.com/go-openapi/loads/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/go-openapi/loads/CONTRIBUTORS.mdis excluded by!vendor/**vendor/github.com/go-openapi/loads/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/loads/SECURITY.mdis excluded by!vendor/**vendor/github.com/go-openapi/loads/doc.gois excluded by!vendor/**vendor/github.com/go-openapi/loads/errors.gois excluded by!vendor/**vendor/github.com/go-openapi/loads/loaders.gois excluded by!vendor/**vendor/github.com/go-openapi/loads/options.gois excluded by!vendor/**vendor/github.com/go-openapi/loads/spec.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/.gitignoreis excluded by!vendor/**vendor/github.com/go-openapi/runtime/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/go-openapi/runtime/NOTICEis excluded by!vendor/**vendor/github.com/go-openapi/runtime/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/runtime/SECURITY.mdis excluded by!vendor/**vendor/github.com/go-openapi/runtime/bytestream.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client/auth_info.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client/keepalive.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client/opentelemetry.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client/request.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client/runtime.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client_auth_info.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client_operation.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client_request.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/client_response.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/constants.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/csv.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/csv_options.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/doc.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/go.work.sumis excluded by!**/*.sum,!vendor/**vendor/github.com/go-openapi/runtime/headers.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/interfaces.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/json.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/context.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/denco/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/denco/router.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/denco/server.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/denco/util.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/doc.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/not_implemented.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/operation.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/parameter.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/rapidoc.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/redoc.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/request.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/router.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/spec.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/swaggerui.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/ui_options.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/untyped/api.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/middleware/validation.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/request.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/security/authenticator.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/security/authorizer.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/statuses.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/text.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/values.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/xml.gois excluded by!vendor/**vendor/github.com/go-openapi/runtime/yamlpc/yaml.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/.gitignoreis excluded by!vendor/**vendor/github.com/go-openapi/spec/.golangci.ymlis excluded by!vendor/**vendor/github.com/go-openapi/spec/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/go-openapi/spec/CONTRIBUTORS.mdis excluded by!vendor/**vendor/github.com/go-openapi/spec/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/spec/SECURITY.mdis excluded by!vendor/**vendor/github.com/go-openapi/spec/cache.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/contact_info.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/debug.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/doc.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/errors.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/expander.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/header.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/info.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/items.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/license.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/normalizer.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/operation.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/parameter.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/path_item.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/paths.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/properties.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/ref.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/resolver.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/response.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/responses.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/schema.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/schema_loader.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/security_scheme.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/spec.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/swagger.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/tag.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/validations.gois excluded by!vendor/**vendor/github.com/go-openapi/spec/xml_object.gois excluded by!vendor/**vendor/github.com/go-openapi/strfmt/.cliff.tomlis excluded by!vendor/**vendor/github.com/go-openapi/strfmt/.gitignoreis excluded by!vendor/**vendor/github.com/go-openapi/strfmt/.golangci.ymlis excluded by!vendor/**vendor/github.com/go-openapi/strfmt/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/go-openapi/strfmt/CONTRIBUTORS.mdis excluded by!vendor/**vendor/github.com/go-openapi/strfmt/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/strfmt/SECURITY.mdis excluded by!vendor/**vendor/github.com/go-openapi/strfmt/bson.gois excluded by!vendor/**vendor/github.com/go-openapi/strfmt/date.gois excluded by!vendor/**vendor/github.com/go-openapi/strfmt/default.gois excluded by!vendor/**vendor/github.com/go-openapi/strfmt/doc.gois excluded by!vendor/**vendor/github.com/go-openapi/strfmt/duration.gois excluded by!vendor/**vendor/github.com/go-openapi/strfmt/errors.gois excluded by!vendor/**vendor/github.com/go-openapi/strfmt/format.gois excluded by!vendor/**vendor/github.com/go-openapi/strfmt/go.work.sumis excluded by!**/*.sum,!vendor/**vendor/github.com/go-openapi/strfmt/ifaces.gois excluded by!vendor/**vendor/github.com/go-openapi/strfmt/internal/bsonlite/codec.gois excluded by!vendor/**vendor/github.com/go-openapi/strfmt/internal/bsonlite/lite.gois excluded by!vendor/**vendor/github.com/go-openapi/strfmt/mongo.gois excluded by!vendor/**vendor/github.com/go-openapi/strfmt/time.gois excluded by!vendor/**vendor/github.com/go-openapi/strfmt/ulid.gois excluded by!vendor/**vendor/github.com/go-openapi/swag/.gitignoreis excluded by!vendor/**vendor/github.com/go-openapi/swag/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/go-openapi/swag/CONTRIBUTORS.mdis excluded by!vendor/**vendor/github.com/go-openapi/swag/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/swag/jsonutils/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/swag/mangling/BENCHMARK.mdis excluded by!vendor/**vendor/github.com/go-openapi/validate/.gitignoreis excluded by!vendor/**vendor/github.com/go-openapi/validate/.golangci.ymlis excluded by!vendor/**vendor/github.com/go-openapi/validate/BENCHMARK.mdis excluded by!vendor/**vendor/github.com/go-openapi/validate/CODE_OF_CONDUCT.mdis excluded by!vendor/**vendor/github.com/go-openapi/validate/CONTRIBUTORS.mdis excluded by!vendor/**vendor/github.com/go-openapi/validate/README.mdis excluded by!vendor/**vendor/github.com/go-openapi/validate/SECURITY.mdis excluded by!vendor/**vendor/github.com/go-openapi/validate/context.gois excluded by!vendor/**vendor/github.com/go-openapi/validate/debug.gois excluded by!vendor/**
📒 Files selected for processing (16)
api/v1alpha1/operatorconfig_types.goapi/v1alpha1/operatorconfig_types_test.goapi/v1alpha1/workspace_types.goapi/v1alpha1/zz_generated.deepcopy.godocs/workspace-image-security.mdgo.modinternal/buildapi/bundle_verify_test.gointernal/buildapi/server.gointernal/buildapi/workspace.gointernal/common/bundleverify/keychain.gointernal/common/bundleverify/keychain_test.gointernal/common/bundleverify/verify.gointernal/common/bundleverify/verify_test.gointernal/controller/imagebuild/controller.gointernal/controller/workspace/controller.gointernal/controller/workspace/controller_test.go
✅ Files skipped from review due to trivial changes (5)
- docs/workspace-image-security.md
- internal/common/bundleverify/verify_test.go
- api/v1alpha1/zz_generated.deepcopy.go
- internal/controller/workspace/controller_test.go
- internal/common/bundleverify/keychain_test.go
🚧 Files skipped from review as they are similar to previous changes (10)
- internal/buildapi/workspace.go
- api/v1alpha1/operatorconfig_types_test.go
- internal/common/bundleverify/verify.go
- internal/buildapi/bundle_verify_test.go
- internal/controller/workspace/controller.go
- api/v1alpha1/operatorconfig_types.go
- internal/common/bundleverify/keychain.go
- api/v1alpha1/workspace_types.go
- internal/controller/imagebuild/controller.go
- internal/buildapi/server.go
| go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.42.0 // indirect | ||
| go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0 | ||
| go.opentelemetry.io/otel/metric v1.42.0 // indirect | ||
| go.opentelemetry.io/otel/sdk v1.42.0 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify advisories and fixed versions for the currently pinned otel/sdk.
set -euo pipefail
echo "Current pinned version:"
rg -n '^\s*go\.opentelemetry\.io/otel/sdk\s+v' go.mod
echo
echo "OSV advisory lookup for v1.42.0:"
curl -s https://api.osv.dev/v1/query \
-H 'Content-Type: application/json' \
-d '{"package":{"ecosystem":"Go","name":"go.opentelemetry.io/otel/sdk"},"version":"1.42.0"}' | jq
echo
echo "After bump, confirm go.mod no longer pins vulnerable version:"
rg -n '^\s*go\.opentelemetry\.io/otel/sdk\s+v1\.42\.0\b' go.mod || trueRepository: centos-automotive-suite/automotive-dev-operator
Length of output: 4097
Upgrade go.opentelemetry.io/otel/sdk from v1.42.0 to v1.43.0 due to HIGH-severity PATH hijacking advisory GHSA-hfvc-g4fc-pqhx.
The kenv command in host_id.go uses a bare name instead of an absolute path, enabling PATH hijacking on BSD and Solaris platforms. Bump to v1.43.0 and re-tidy go.mod to ensure the vulnerable version is not retained transitively.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 208, Update the vulnerable dependency entry in go.mod from
go.opentelemetry.io/otel/sdk v1.42.0 to v1.43.0 and then run go get
go.opentelemetry.io/otel/sdk@v1.43.0 followed by go mod tidy to remove any
transitive references to the old version; additionally inspect host_id.go where
the kenv invocation is used and change the bare "kenv" call to an absolute path
or a safe lookup (ensure the symbol/name host_id.go and any function calling
kenv are updated) so PATH hijacking is avoided before re-running go mod tidy and
tests.
![ambient-code[bot]](https://avatars.githubusercontent.com/u/231559327?s=60&v=4){kind=small}
There was a problem hiding this comment.
Overall this is a well-structured PR — the image allowlist, cosign verification, and private registry pull secret support are cleanly layered. The refactoring of FetchCosignPublicKey into a shared utility and the cosign v2→v3 upgrade with v3 bundle fallback are solid improvements. Tests are thorough.
A few things worth looking at below.
| if c == nil || len(c.AllowedImages) == 0 { | ||
| return false | ||
| } | ||
| for _, pattern := range c.AllowedImages { |
There was a problem hiding this comment.
The nil check for c comes after calling c.GetToolchainImage() on line 484. While GetToolchainImage() happens to handle nil receivers, the ordering is misleading — a reader would expect the nil guard to come first.
Consider reordering:
Suggested change
| for _, pattern := range c.AllowedImages { | |
| func (c *WorkspacesConfig) IsImageAllowed(image string) bool { | |
| if c == nil { | |
| return image == DefaultToolchainImage | |
| } | |
| if image == c.GetToolchainImage() { | |
| return true | |
| } | |
| if len(c.AllowedImages) == 0 { | |
| return false | |
| } |
| } | ||
| if wsConfig != nil && !wsConfig.IsImageAllowed(image) { | ||
| return nil, fmt.Errorf("image %q is not in the allowed images list", image) | ||
| } |
There was a problem hiding this comment.
The image resolution logic here (lines 232-238) duplicates what buildPod does (lines 284-289). If they drift, the image verified by cosign could differ from the one actually used in the pod.
Consider extracting a shared helper (e.g. resolveWorkspaceImage(ws, wsConfig) string) and calling it from both places, or passing the resolved image into buildPod.
| if status, verifyErr := verifyWorkspaceImage(c.Request.Context(), k8sClient, namespace, wsConfig, image, wsConfig.GetImagePullSecrets()); verifyErr != nil { | ||
| c.JSON(status, gin.H{"error": verifyErr.Error()}) | ||
| return | ||
| } |
There was a problem hiding this comment.
nit: This always passes the global wsConfig.GetImagePullSecrets() for cosign verification. If a future version of the workspace create request accepts per-workspace imagePullSecrets, this would need updating to match the controller's fallback logic (per-workspace first, then global). Fine for now since the API request doesn't expose that field.
Signed-off-by: Benny Zlotnik <bzlotnik@redhat.com> Assisted-by: claude-sonnet-4.6
bennyz
force-pushed
the
private-registry-workspace
branch
from
9522816 to
618f86d
Compare
bkhizgiy
approved these changes
May 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Related Issues
Type of Change
Testing
make test)make lint)make manifests generate)Summary by CodeRabbit
New Features
Validation
Docs
Tests