Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions .github/workflows/codespell-reusable.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
name: Codespell (Reusable)

on:
workflow_call:

permissions:
contents: read

jobs:
codespell:
name: Codespell
runs-on: arc-runner-set
timeout-minutes: 10
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- run: make verify-codespell
18 changes: 18 additions & 0 deletions .github/workflows/cpo-container-sync-reusable.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
name: CPO Container Sync (Reusable)

on:
workflow_call:

permissions:
contents: read

jobs:
cpo-container-sync:
name: CPO Container Sync
runs-on: arc-runner-set
timeout-minutes: 10
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- run: make cpo-container-sync
32 changes: 32 additions & 0 deletions .github/workflows/docs-build-reusable.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
name: Docs Build (Reusable)

on:
workflow_call:

permissions:
contents: read

jobs:
build:
name: Build Docs
runs-on: arc-runner-set
timeout-minutes: 10
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
python-version: '3.x'
pip-install: '-r docs/requirements.txt'
env:
PIP_CACHE_DIR: ${{ runner.temp }}/.pip-cache
- name: Build documentation
run: mkdocs build --strict
working-directory: docs
- name: Save PR metadata
run: echo "${{ github.event.pull_request.number }}" > docs/site/pr-number.txt
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: docs-site
path: docs/site
84 changes: 84 additions & 0 deletions .github/workflows/envtest-kube-reusable.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,84 @@
name: Envtest Vanilla Kube API Validation (Reusable)

on:
workflow_call:
push:
branches:
- main
- release-4.22

permissions:
contents: read

jobs:
changes:
name: Detect Changes
runs-on: arc-runner-set
outputs:
should_run: ${{ steps.check.outputs.should_run }}
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0
persist-credentials: false
- name: Check for relevant file changes
id: check
env:
EVENT_NAME: ${{ github.event_name }}
CREATED: ${{ github.event.created }}
PR_DIFF_REF: origin/${{ github.base_ref }}...HEAD
PUSH_DIFF_REF: ${{ github.event.before }}..HEAD
run: |
if [ "$EVENT_NAME" = "workflow_dispatch" ] || [ "$CREATED" = "true" ]; then
echo "should_run=true" >> "$GITHUB_OUTPUT"
exit 0
fi
ref="$PUSH_DIFF_REF"
if [ "$EVENT_NAME" = "pull_request" ]; then
ref="$PR_DIFF_REF"
fi
if git diff --name-only "$ref" | grep -qE '^(api/|test/envtest/|cmd/install/assets/crds/hypershift-operator/tests/|karpenter-operator/controllers/karpenter/assets/tests/|\.github/workflows/envtest-kube(-reusable)?\.yaml$)'; then
echo "should_run=true"
else
echo "should_run=false"
fi >> "$GITHUB_OUTPUT"

envtest-kube:
name: Envtest Vanilla Kube ${{ matrix.version }}
needs: changes
if: needs.changes.outputs.should_run == 'true'
runs-on: arc-runner-set
timeout-minutes: 15
strategy:
fail-fast: false
matrix:
version: ["1.31.0", "1.32.0", "1.33.0", "1.34.0", "1.35.0"]
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- run: make test-envtest-kube ENVTEST_KUBE_VERSIONS="${{ matrix.version }}"

conclusion:
name: Conclusion
needs:
- changes
- envtest-kube
if: always()
runs-on: arc-runner-set
steps:
- name: Aggregate results
run: |
changes_result="${{ needs.changes.result }}"
envtest_result="${{ needs.envtest-kube.result }}"
if [ "$changes_result" != "success" ]; then
echo "Change detection failed: $changes_result"
exit 1
fi
if [ "$envtest_result" = "success" ] || [ "$envtest_result" = "skipped" ]; then
echo "All envtest jobs passed or were skipped"
exit 0
else
echo "Envtest jobs failed: $envtest_result"
exit 1
fi
85 changes: 85 additions & 0 deletions .github/workflows/envtest-ocp-reusable.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,85 @@
name: Envtest OCP API Validation (Reusable)

on:
workflow_call:
push:
branches:
- main
- release-4.22

permissions:
contents: read

jobs:
changes:
name: Detect Changes
runs-on: arc-runner-set
outputs:
should_run: ${{ steps.check.outputs.should_run }}
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0
persist-credentials: false
- name: Check for relevant file changes
id: check
env:
EVENT_NAME: ${{ github.event_name }}
CREATED: ${{ github.event.created }}
PR_DIFF_REF: origin/${{ github.base_ref }}...HEAD
PUSH_DIFF_REF: ${{ github.event.before }}..HEAD
run: |
if [ "$EVENT_NAME" = "workflow_dispatch" ] || [ "$CREATED" = "true" ]; then
echo "should_run=true" >> "$GITHUB_OUTPUT"
exit 0
fi
ref="$PUSH_DIFF_REF"
if [ "$EVENT_NAME" = "pull_request" ]; then
ref="$PR_DIFF_REF"
fi
if git diff --name-only "$ref" | grep -qE '^(api/|test/envtest/|cmd/install/assets/crds/hypershift-operator/tests/|karpenter-operator/controllers/karpenter/assets/tests/|\.github/workflows/envtest-ocp(-reusable)?\.yaml$)'; then
echo "should_run=true"
else
echo "should_run=false"
fi >> "$GITHUB_OUTPUT"
Comment on lines +27 to +44

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🌐 Web query:

For a called reusable workflow, what are the documented behaviors of github.event_name, github.eventpayload inheritance, andgithub.base_ref availability?

💡 Result:

In a called reusable workflow (triggered by workflow_call): - github.event_name: Inherits the event name from the calling (top-level) workflow. It is NOT workflow_call; instead, it reflects the original trigger event of the caller (e.g., push, pull_request, workflow_dispatch). This is confirmed by GitHub Docs stating the github context is associated with the caller workflow, and practical evidence from GitHub issues where echo ${{ github.event_name }} in called workflows shows the caller's event. - github.event payload: Fully inherits the event payload from the calling workflow. Official GitHub Docs explicitly state: "When a workflow is triggered with the workflow_call event, the event payload in the called workflow is the same event payload from the calling workflow." Also, GITHUB_SHA and GITHUB_REF are the same as the caller. - github.base_ref availability: Available if the inherited github.event_name is pull_request or pull_request_target (from the caller). Per contexts docs, github.base_ref is set for those event types, containing the target branch of the PR. For other inherited events (e.g., push), it is empty/undefined.

Citations:


🏁 Script executed:

find .github/workflows -type f -name "*.yaml" -o -name "*.yml" | head -20

Repository: openshift/hypershift

Length of output: 817


🏁 Script executed:

cat -n .github/workflows/envtest-kube-reusable.yaml | head -80

Repository: openshift/hypershift

Length of output: 3210


🏁 Script executed:

cat -n .github/workflows/envtest-ocp-reusable.yaml | head -80

Repository: openshift/hypershift

Length of output: 3266


🏁 Script executed:

cat -n .github/workflows/envtest-ocp.yaml | head -40

Repository: openshift/hypershift

Length of output: 1373


🏁 Script executed:

git log --oneline -20 -- .github/workflows/envtest-kube-reusable.yaml .github/workflows/envtest-ocp-reusable.yaml 2>/dev/null || echo "Git history not available"

Repository: openshift/hypershift

Length of output: 136


🏁 Script executed:

cd .github/workflows && git log --all --source --grep="workflow_call\|ref-resolution" -i --oneline 2>/dev/null | head -20 || echo "No relevant commits found"

Repository: openshift/hypershift

Length of output: 46


Apply ref-resolution fix for workflow_call context in this reusable workflow.

This workflow has the same event/ref handling issues that affect workflow_call contexts. When called as a reusable workflow with push, pull_request, or workflow_dispatch triggers, the current code relies on context variables that may be undefined:

  • Line 29: github.base_ref is only populated for pull_request events; it will be empty in other contexts
  • Line 28: github.event.created is only set for workflow_dispatch events
  • The ref resolution logic doesn't account for all event types properly

This causes git diff to fail or produce incorrect results, potentially skipping OCP envtest runs unintentionally.

Use direct SHA references instead of event name/payload assumptions:

Suggested fix
       - name: Check for relevant file changes
         id: check
         env:
-          EVENT_NAME: ${{ github.event_name }}
-          CREATED: ${{ github.event.created }}
-          PR_DIFF_REF: origin/${{ github.base_ref }}...HEAD
-          PUSH_DIFF_REF: ${{ github.event.before }}..HEAD
+          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          PUSH_BEFORE_SHA: ${{ github.event.before }}
         run: |
-          if [ "$EVENT_NAME" = "workflow_dispatch" ] || [ "$CREATED" = "true" ]; then
-            echo "should_run=true" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          ref="$PUSH_DIFF_REF"
-          if [ "$EVENT_NAME" = "pull_request" ]; then
-            ref="$PR_DIFF_REF"
-          fi
+          set -euo pipefail
+          if [ -n "${PR_BASE_SHA:-}" ] && [ -n "${PR_HEAD_SHA:-}" ]; then
+            ref="${PR_BASE_SHA}...${PR_HEAD_SHA}"
+          elif [ -n "${PUSH_BEFORE_SHA:-}" ] && [ "$PUSH_BEFORE_SHA" != "0000000000000000000000000000000000000000" ]; then
+            ref="${PUSH_BEFORE_SHA}..HEAD"
+          else
+            echo "should_run=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
           if git diff --name-only "$ref" | grep -qE '^(api/|test/envtest/|cmd/install/assets/crds/hypershift-operator/tests/|karpenter-operator/controllers/karpenter/assets/tests/|\.github/workflows/envtest-ocp(-reusable)?\.yaml$)'; then
             echo "should_run=true"
           else
             echo "should_run=false"
           fi >> "$GITHUB_OUTPUT"
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
EVENT_NAME: ${{ github.event_name }}
CREATED: ${{ github.event.created }}
PR_DIFF_REF: origin/${{ github.base_ref }}...HEAD
PUSH_DIFF_REF: ${{ github.event.before }}..HEAD
run: |
if [ "$EVENT_NAME" = "workflow_dispatch" ] || [ "$CREATED" = "true" ]; then
echo "should_run=true" >> "$GITHUB_OUTPUT"
exit 0
fi
ref="$PUSH_DIFF_REF"
if [ "$EVENT_NAME" = "pull_request" ]; then
ref="$PR_DIFF_REF"
fi
if git diff --name-only "$ref" | grep -qE '^(api/|test/envtest/|cmd/install/assets/crds/hypershift-operator/tests/|karpenter-operator/controllers/karpenter/assets/tests/|\.github/workflows/envtest-ocp(-reusable)?\.yaml$)'; then
echo "should_run=true"
else
echo "should_run=false"
fi >> "$GITHUB_OUTPUT"
PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
PUSH_BEFORE_SHA: ${{ github.event.before }}
run: |
set -euo pipefail
if [ -n "${PR_BASE_SHA:-}" ] && [ -n "${PR_HEAD_SHA:-}" ]; then
ref="${PR_BASE_SHA}...${PR_HEAD_SHA}"
elif [ -n "${PUSH_BEFORE_SHA:-}" ] && [ "$PUSH_BEFORE_SHA" != "0000000000000000000000000000000000000000" ]; then
ref="${PUSH_BEFORE_SHA}..HEAD"
else
echo "should_run=true" >> "$GITHUB_OUTPUT"
exit 0
fi
if git diff --name-only "$ref" | grep -qE '^(api/|test/envtest/|cmd/install/assets/crds/hypershift-operator/tests/|karpenter-operator/controllers/karpenter/assets/tests/|\.github/workflows/envtest-ocp(-reusable)?\.yaml$)'; then
echo "should_run=true"
else
echo "should_run=false"
fi >> "$GITHUB_OUTPUT"
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/envtest-ocp-reusable.yaml around lines 27 - 44, The
workflow's ref and event handling uses context fields that can be empty in
reusable/workflow_call contexts (EVENT_NAME, CREATED, PR_DIFF_REF,
PUSH_DIFF_REF) which breaks the git diff; fix by computing refs from explicit
SHAs: set CREATED based on github.event_name == 'workflow_dispatch' (don’t rely
on github.event.created), build PR_DIFF_REF using
github.event.pull_request.base.sha...github.sha (use
github.event.pull_request.base.sha only when pull_request exists), build
PUSH_DIFF_REF using github.event.before..github.sha (and if github.event.before
is empty fall back to github.sha..github.sha), then use that computed ref for
git diff --name-only; update the ref selection logic (the ref variable and the
git diff call) to use these explicit SHA-based values so git diff never receives
an empty ref.


envtest-ocp:
name: Envtest OCP (K8s ${{ matrix.version }})
needs: changes
if: needs.changes.outputs.should_run == 'true'
runs-on: arc-runner-set
timeout-minutes: 15
strategy:
fail-fast: false
matrix:
# OCP 4.17=1.30, 4.18=1.31, 4.19=1.32, 4.20=1.33, 4.21=1.34, 4.22=1.35
version: ["1.30.3", "1.31.2", "1.32.1", "1.33.2", "1.34.1", "1.35.1"]
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- run: make test-envtest-ocp ENVTEST_OCP_K8S_VERSIONS="${{ matrix.version }}"

conclusion:
name: Conclusion
needs:
- changes
- envtest-ocp
if: always()
runs-on: arc-runner-set
steps:
- name: Aggregate results
run: |
changes_result="${{ needs.changes.result }}"
envtest_result="${{ needs.envtest-ocp.result }}"
if [ "$changes_result" != "success" ]; then
echo "Change detection failed: $changes_result"
exit 1
fi
if [ "$envtest_result" = "success" ] || [ "$envtest_result" = "skipped" ]; then
echo "All envtest jobs passed or were skipped"
exit 0
else
echo "Envtest jobs failed: $envtest_result"
exit 1
fi
22 changes: 22 additions & 0 deletions .github/workflows/gitlint-reusable.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
name: Gitlint (Reusable)

on:
workflow_call:

permissions:
contents: read

jobs:
gitlint:
name: Gitlint
runs-on: arc-runner-set
timeout-minutes: 10
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0
persist-credentials: false
- run: make run-gitlint
env:
PULL_BASE_SHA: ${{ github.event.pull_request.base.sha }}
PULL_PULL_SHA: ${{ github.event.pull_request.head.sha }}
28 changes: 28 additions & 0 deletions .github/workflows/lint-reusable.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
name: Lint (Reusable)

on:
workflow_call:

permissions:
contents: read

jobs:
lint:
name: Lint
runs-on: arc-runner-set
timeout-minutes: 60
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0
persist-credentials: false
- run: git fetch origin ${{ github.base_ref }}:${{ github.base_ref }}

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Guard base-ref fetch to avoid invalid refspec failures.

Line 19 can fail when github.base_ref is empty (non-PR caller), causing git fetch origin :. Add a guard before fetching.

Proposed fix
-      - run: git fetch origin ${{ github.base_ref }}:${{ github.base_ref }}
+      - run: |
+          if [ -n "${{ github.base_ref }}" ]; then
+            git fetch origin "${{ github.base_ref }}:${{ github.base_ref }}"
+          fi
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/lint-reusable.yaml at line 19, Guard the git fetch step
that uses the refspec "git fetch origin ${{ github.base_ref }}:${{
github.base_ref }}" so it only runs when github.base_ref is non-empty (e.g., PR
runs); update the workflow step that contains that run command to check the
variable first (either with an if: conditional on github.base_ref or by wrapping
the fetch in a shell check like "if [ -n '${{ github.base_ref }}' ]; then ...;
fi") to avoid executing "git fetch origin :" when base_ref is empty.

- name: Use pre-built lint tools
run: |
if [ -d /opt/lint-tools ]; then
mkdir -p hack/tools/bin
cp /opt/lint-tools/golangci-lint hack/tools/bin/
cp /opt/lint-tools/kube-api-linter.so hack/tools/bin/
touch hack/tools/bin/golangci-lint hack/tools/bin/kube-api-linter.so
fi
- run: make lint
104 changes: 104 additions & 0 deletions .github/workflows/test-reusable.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,104 @@
name: Unit Tests (Reusable)

on:
workflow_call:
secrets:
CODECOV_TOKEN:
required: false
push:
branches:
- main
- release-4.22

permissions:
contents: read

jobs:
changes:
name: Detect Changes
runs-on: arc-runner-set
timeout-minutes: 5
outputs:
run_tests: ${{ steps.changes.outputs.run_tests }}
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0
persist-credentials: false
- uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
env:
HOME: /tmp
with:
go-version-file: go.mod
cache: false
- name: Check for non-contrib changes
id: changes
run: |
if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
echo "run_tests=true" >> "$GITHUB_OUTPUT"
exit 0
elif [ "${{ github.event_name }}" = "pull_request" ]; then
FILES=$(git diff --name-only origin/${{ github.base_ref }}...HEAD)
else
if [ "${{ github.event.before }}" = "0000000000000000000000000000000000000000" ]; then
echo "run_tests=true" >> "$GITHUB_OUTPUT"
exit 0
fi
FILES=$(git diff --name-only ${{ github.event.before }}..${{ github.sha }})
fi
if echo "$FILES" | grep -qvE '^(contrib|\.github|docs)/'; then
echo "run_tests=true" >> "$GITHUB_OUTPUT"
else
echo "run_tests=false" >> "$GITHUB_OUTPUT"
fi

test:
name: Unit Tests (${{ matrix.shard }})
needs: changes
if: needs.changes.outputs.run_tests == 'true'
runs-on: arc-runner-set
timeout-minutes: 30
strategy:
fail-fast: false
matrix:
include:
- shard: cpo-hostedcontrolplane
packages: ./control-plane-operator/controllers/hostedcontrolplane/...
- shard: cpo-other
packages: ./control-plane-operator/controllers/awsprivatelink/... ./control-plane-operator/controllers/azureprivatelinkservice/... ./control-plane-operator/controllers/gcpprivateserviceconnect/... ./control-plane-operator/controllers/healthcheck/... ./control-plane-operator/controllers/openshiftmanager/... ./control-plane-operator/endpoint-resolver/... ./control-plane-operator/hostedclusterconfigoperator/... ./control-plane-operator/metrics-proxy/...
- shard: hypershift-operator
packages: ./hypershift-operator/...
- shard: cmd-support
packages: ./cmd/... ./support/...
- shard: other
packages: ./karpenter-operator/... ./control-plane-pki-operator/... ./contrib/... ./ignition-server/... ./pkg/... ./dnsresolver/... ./product-cli/... ./client/... ./test/integration/... ./test/e2e/util/... ./test/util/... ./availability-prober/... ./konnectivity-socks5-proxy/... ./konnectivity-https-proxy/... ./kubernetes-default-proxy/... ./kubevirtexternalinfra/... ./etcd-defrag/... ./etcd-backup/... ./etcd-recovery/... ./etcd-upload/... ./kas-bootstrap/... ./sharedingress-config-generator/... ./sync-fg-configmap/... ./sync-global-pullsecret/... ./token-minter/...
env:
GOCACHE: /tmp/go-build-cache
GOMODCACHE: /tmp/go-mod-cache
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0
persist-credentials: false
- uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
env:
HOME: /tmp
with:
go-version-file: go.mod
cache: false
- name: Restore Go build cache
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
with:
path: /tmp/go-build-cache
key: go-build-${{ matrix.shard }}-${{ hashFiles('go.mod') }}-${{ github.sha }}
restore-keys: go-build-${{ matrix.shard }}-${{ hashFiles('go.mod') }}-
- name: Run tests
run: make test-shard TEST_PACKAGES="${{ matrix.packages }}" COVER_PROFILE="cover-${{ matrix.shard }}.out"
- name: Upload to Codecov
uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
env:
HOME: /tmp
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
with:
files: cover-${{ matrix.shard }}.out
flags: ${{ matrix.shard }}
Loading
Loading