NO-JIRA: use ai-helpers container image for Claude WIF test - #8609
Conversation
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
openshift-ci-robot
added
the
jira/valid-reference
|
@bryan-cox: This pull request explicitly references no jira issue. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
📝 WalkthroughWalkthroughThe Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 11✅ Passed checks (11 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: bryan-cox The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
4b8574b to
4121569
Compare
ARC runner containers use dash as default shell and don't have gh CLI installed. Use bash explicitly for the Claude installer and curl for the GitHub API call. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
4121569 to
8ba9ef3
Compare
|
/test-wif |
|
/area ai |
openshift-ci
Bot
added
area/ai
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/claude-wif-test.yaml:
- Around line 22-23: Replace the mutable container image tag used in the WIF
test job with the provided immutable digest: update the container.image value
that currently references quay.io/rh_ee_brcox/hypershift:ai-helpers-arm64 to
quay.io/rh_ee_brcox/hypershift@sha256:3bb04d71e4ccec762db43d6ee8a0789f22638e53561a278fd5bccf1b60a88189
so the job uses a pinned, immutable image; ensure the change is applied to the
container.image field in the workflow definition where the image is declared.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 685cfa14-a195-442c-b210-19898ca5abbc
📒 Files selected for processing (1)
.github/workflows/claude-wif-test.yaml
| container: | ||
| image: quay.io/rh_ee_brcox/hypershift:ai-helpers-arm64 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
repo="rh_ee_brcox/hypershift"
tag="ai-helpers-arm64"
curl -fsSL "https://quay.io/api/v1/repository/${repo}/tag/?onlyActiveTags=true&specificTag=${tag}" \
| jq -r '.tags[] | select(.name=="'"$tag"'") | .manifest_digest'Repository: openshift/hypershift
Length of output: 136
🏁 Script executed:
curl -fsSL "https://quay.io/api/v1/repository/rh_ee_brcox/hypershift/tag/?onlyActiveTags=true&specificTag=ai-helpers-arm64" \
| jq -r '.tags[] | select(.name=="ai-helpers-arm64") | .manifest_digest'Repository: openshift/hypershift
Length of output: 136
🏁 Script executed:
curl -fsSL "https://quay.io/api/v1/repository/rh_ee_brcox/hypershift/tag/?onlyActiveTags=true&specificTag=ai-helpers-arm64" \
| jq -r '.tags[] | select(.name=="ai-helpers-arm64") | .manifest_digest'Repository: openshift/hypershift
Length of output: 136
🏁 Script executed:
repo="rh_ee_brcox/hypershift"
tag="ai-helpers-arm64"
curl -fsSL "https://quay.io/api/v1/repository/${repo}/tag/?onlyActiveTags=true&specificTag=${tag}" \
| jq -r '.tags[] | select(.name=="'"$tag"'") | .manifest_digest'Repository: openshift/hypershift
Length of output: 136
🏁 Script executed:
repo="rh_ee_brcox/hypershift"
tag="ai-helpers-arm64"
curl -fsSL "https://quay.io/api/v1/repository/${repo}/tag/?onlyActiveTags=true&specificTag=${tag}" \
| jq -r '.tags[] | select(.name=="'"$tag"'") | .manifest_digest'Repository: openshift/hypershift
Length of output: 136
🏁 Script executed:
repo="rh_ee_brcox/hypershift"
tag="ai-helpers-arm64"
curl -fsSL "https://quay.io/api/v1/repository/${repo}/tag/?onlyActiveTags=true&specificTag=${tag}" \
| jq -r '.tags[] | select(.name=="'"$tag"'") | .manifest_digest'Repository: openshift/hypershift
Length of output: 136
🏁 Script executed:
repo="rh_ee_brcox/hypershift"
tag="ai-helpers-arm64"
curl -fsSL "https://quay.io/api/v1/repository/${repo}/tag/?onlyActiveTags=true&specificTag=${tag}" \
| jq -r '.tags[] | select(.name=="'"$tag"'") | .manifest_digest'Repository: openshift/hypershift
Length of output: 136
🏁 Script executed:
repo="rh_ee_brcox/hypershift"
tag="ai-helpers-arm64"
curl -fsSL "https://quay.io/api/v1/repository/${repo}/tag/?onlyActiveTags=true&specificTag=${tag}" \
| jq -r '.tags[] | select(.name=="'"$tag"'") | .manifest_digest'Repository: openshift/hypershift
Length of output: 136
🏁 Script executed:
repo="rh_ee_brcox/hypershift"
tag="ai-helpers-arm64"
curl -fsSL "https://quay.io/api/v1/repository/${repo}/tag/?onlyActiveTags=true&specificTag=${tag}" \
| jq -r '.tags[] | select(.name=="'"$tag"'") | .manifest_digest'Repository: openshift/hypershift
Length of output: 136
🏁 Script executed:
repo="rh_ee_brcox/hypershift"
tag="ai-helpers-arm64"
curl -fsSL "https://quay.io/api/v1/repository/${repo}/tag/?onlyActiveTags=true&specificTag=${tag}" \
| jq -r '.tags[] | select(.name=="'"$tag"'") | .manifest_digest'Repository: openshift/hypershift
Length of output: 136
🏁 Script executed:
repo="rh_ee_brcox/hypershift"
tag="ai-helpers-arm64"
curl -fsSL "https://quay.io/api/v1/repository/${repo}/tag/?onlyActiveTags=true&specificTag=${tag}" \
| jq -r '.tags[] | select(.name=="'"$tag"'") | .manifest_digest'Repository: openshift/hypershift
Length of output: 136
🏁 Script executed:
#!/bin/bash
set -euo pipefail
repo="rh_ee_brcox/hypershift"
tag="ai-helpers-arm64"
curl -fsSL "https://quay.io/api/v1/repository/${repo}/tag/?onlyActiveTags=true&specificTag=${tag}" \
| jq -r '.tags[] | select(.name=="'"$tag"'") | .manifest_digest'Repository: openshift/hypershift
Length of output: 136
🏁 Script executed:
repo="rh_ee_brcox/hypershift"
tag="ai-helpers-arm64"
curl -fsSL "https://quay.io/api/v1/repository/${repo}/tag/?onlyActiveTags=true&specificTag=${tag}" \
| jq -r '.tags[] | select(.name=="'"$tag"'") | .manifest_digest'Repository: openshift/hypershift
Length of output: 136
Pin the WIF test job container image to an immutable digest
.github/workflows/claude-wif-test.yaml line 23 uses a mutable tag (quay.io/rh_ee_brcox/hypershift:ai-helpers-arm64), which can silently drift. Pin it to quay.io/rh_ee_brcox/hypershift@sha256:3bb04d71e4ccec762db43d6ee8a0789f22638e53561a278fd5bccf1b60a88189.
Proposed change
container:
- image: quay.io/rh_ee_brcox/hypershift:ai-helpers-arm64
+ image: quay.io/rh_ee_brcox/hypershift@sha256:3bb04d71e4ccec762db43d6ee8a0789f22638e53561a278fd5bccf1b60a88189 # ai-helpers-arm64📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| container: | |
| image: quay.io/rh_ee_brcox/hypershift:ai-helpers-arm64 | |
| container: | |
| image: quay.io/rh_ee_brcox/hypershift@sha256:3bb04d71e4ccec762db43d6ee8a0789f22638e53561a278fd5bccf1b60a88189 # ai-helpers-arm64 |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/claude-wif-test.yaml around lines 22 - 23, Replace the
mutable container image tag used in the WIF test job with the provided immutable
digest: update the container.image value that currently references
quay.io/rh_ee_brcox/hypershift:ai-helpers-arm64 to
quay.io/rh_ee_brcox/hypershift@sha256:3bb04d71e4ccec762db43d6ee8a0789f22638e53561a278fd5bccf1b60a88189
so the job uses a pinned, immutable image; ensure the change is applied to the
container.image field in the workflow definition where the image is declared.
There was a problem hiding this comment.
♻️ Duplicate comments (1)
.github/workflows/claude-wif-test.yaml (1)
23-24:⚠️ Potential issue | 🟠 Major | ⚡ Quick winPin the workflow container image to an immutable digest.
Line 24 still uses a mutable image tag, which can drift silently between runs.
Proposed change
container: - image: quay.io/rh_ee_brcox/hypershift:ai-helpers-arm64 + image: quay.io/rh_ee_brcox/hypershift@sha256:<resolved-digest> # ai-helpers-arm64#!/bin/bash set -euo pipefail curl -fsSL "https://quay.io/api/v1/repository/rh_ee_brcox/hypershift/tag/?onlyActiveTags=true&specificTag=ai-helpers-arm64" \ | jq -r '.tags[] | select(.name=="ai-helpers-arm64") | .manifest_digest'🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/claude-wif-test.yaml around lines 23 - 24, Replace the mutable image tag used in the workflow (container.image currently set to "quay.io/rh_ee_brcox/hypershift:ai-helpers-arm64") with an immutable digest-pinned reference (quay.io/rh_ee_brcox/hypershift@sha256:<MANIFEST_DIGEST>); obtain the correct <MANIFEST_DIGEST> by running the provided curl+jq command against the Quay API and then update the container.image value to use the `@sha256` digest form so the workflow uses an immutable image.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In @.github/workflows/claude-wif-test.yaml:
- Around line 23-24: Replace the mutable image tag used in the workflow
(container.image currently set to
"quay.io/rh_ee_brcox/hypershift:ai-helpers-arm64") with an immutable
digest-pinned reference
(quay.io/rh_ee_brcox/hypershift@sha256:<MANIFEST_DIGEST>); obtain the correct
<MANIFEST_DIGEST> by running the provided curl+jq command against the Quay API
and then update the container.image value to use the `@sha256` digest form so the
workflow uses an immutable image.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 13193736-aecb-43b6-84b4-58a940abc691
📒 Files selected for processing (1)
.github/workflows/claude-wif-test.yaml
|
@bryan-cox: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/lgtm |
|
Pipeline controller notification No second-stage tests were triggered for this PR. This can happen when:
Use |
|
/verified bypass |
openshift-ci-robot
added
the
verified
|
@bryan-cox: The DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/test-wif |
2 similar comments
|
/test-wif |
|
/test-wif |
|
/test-wif |
1 similar comment
|
/test-wif |
3 participants
Summary
quay.io/rh_ee_brcox/hypershift:ai-helpers-arm64container image for the Claude WIF test workflowHOME: /tmpworkaround — the container has a proper home directoryTest plan
/test-wifon any open PR🤖 Generated with Claude Code
Summary by CodeRabbit