NO-JIRA: replace container image with workflow-step plugin setup - #8611
Conversation
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
openshift-ci-robot
added
the
jira/valid-reference
|
@bryan-cox: This pull request explicitly references no jira issue. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThis PR modifies the Claude Code WIF authentication test workflow by removing the job-level container image so the test-wif job runs on the arc-runner-set runner, and adds a "Set up ai-helpers plugins" step that clones openshift-eng/ai-helpers into /tmp/ai-helpers and writes Claude configuration files under $HOME/.claude/ to enable selected ai-helpers plugins before running the Claude Code test. Possibly related PRs
Suggested reviewers
Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error)
✅ Passed checks (10 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: bryan-cox The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
The container: directive requires containerMode on ARC runners which needs anyuid SCC and a long-running process. Replace it by installing Claude and cloning ai-helpers directly in workflow steps. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
openshift-ci
Bot
added
the
approved
212495a to
9dda6ec
Compare
| - name: Set up ai-helpers plugins | ||
| run: | | ||
| git clone --depth 1 https://github.com/openshift-eng/ai-helpers.git /tmp/ai-helpers | ||
| mkdir -p "$HOME/.claude/plugins" | ||
| printf '%s\n' '{"enabledPlugins":{"hello-world@ai-helpers":true,"jira@ai-helpers":true,"ci@ai-helpers":true}}' > "$HOME/.claude/settings.json" | ||
| printf '%s\n' '{"ai-helpers":{"source":{"source":"directory","path":"/tmp/ai-helpers"},"installLocation":"/tmp/ai-helpers","lastUpdated":"2025-10-27T12:00:00.000Z"}}' > "$HOME/.claude/plugins/known_marketplaces.json" | ||
|
|
There was a problem hiding this comment.
Could we use the claude cli command for this?
| - name: Set up ai-helpers plugins | |
| run: | | |
| git clone --depth 1 https://github.com/openshift-eng/ai-helpers.git /tmp/ai-helpers | |
| mkdir -p "$HOME/.claude/plugins" | |
| printf '%s\n' '{"enabledPlugins":{"hello-world@ai-helpers":true,"jira@ai-helpers":true,"ci@ai-helpers":true}}' > "$HOME/.claude/settings.json" | |
| printf '%s\n' '{"ai-helpers":{"source":{"source":"directory","path":"/tmp/ai-helpers"},"installLocation":"/tmp/ai-helpers","lastUpdated":"2025-10-27T12:00:00.000Z"}}' > "$HOME/.claude/plugins/known_marketplaces.json" | |
| - name: Set up ai-helpers plugins | |
| run: | | |
| claude plugin marketplace add openshift-eng/ai-helpers | |
| claude plugin install hello-world@ai-helpers | |
| claude plugin install jira@ai-helpers | |
| claude plugin install ci@ai-helpers |
csrwng
added
the
area/ai
csrwng
added
lgtm
|
Pipeline controller notification No second-stage tests were triggered for this PR. This can happen when:
Use |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/claude-wif-test.yaml:
- Line 56: The workflow currently clones openshift-eng/ai-helpers without
pinning to an immutable revision; add an input/env variable AI_HELPERS_SHA,
clone the repo into /tmp/ai-helpers, then explicitly fetch and checkout that SHA
(use git fetch + git checkout of AI_HELPERS_SHA or clone the specific commit)
before any plugin setup or usage; ensure the workflow errors if AI_HELPERS_SHA
is unset or the checkout fails so CI never runs against an unpinned tip.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 8abe3238-e1c0-4f19-9a59-433a699b341d
📒 Files selected for processing (1)
.github/workflows/claude-wif-test.yaml
|
|
||
| - name: Set up ai-helpers plugins | ||
| run: | | ||
| git clone --depth 1 https://github.com/openshift-eng/ai-helpers.git /tmp/ai-helpers |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== clone command =="
rg -n -C2 'git clone .*openshift-eng/ai-helpers' .github/workflows/claude-wif-test.yaml
echo
echo "== pinning evidence (should match after fix) =="
rg -n -C2 'AI_HELPERS_SHA|git -C /tmp/ai-helpers (fetch|checkout).*' .github/workflows/claude-wif-test.yaml || trueRepository: openshift/hypershift
Length of output: 493
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== clone command =="
rg -n -C2 'git clone .*openshift-eng/ai-helpers' .github/workflows/claude-wif-test.yaml
echo
echo "== pinning evidence (should match after fix) =="
rg -n -C2 'AI_HELPERS_SHA|git -C /tmp/ai-helpers (fetch|checkout).*' .github/workflows/claude-wif-test.yaml || trueRepository: openshift/hypershift
Length of output: 493
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== clone command =="
rg -n -C2 'git clone .*openshift-eng/ai-helpers' .github/workflows/claude-wif-test.yaml
echo
echo "== pinning evidence (should match after fix) =="
rg -n -C2 'AI_HELPERS_SHA|git -C /tmp/ai-helpers (fetch|checkout).*' .github/workflows/claude-wif-test.yaml || trueRepository: openshift/hypershift
Length of output: 493
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== clone command =="
rg -n -C2 'git clone .*openshift-eng/ai-helpers' .github/workflows/claude-wif-test.yaml
echo
echo "== pinning evidence (should match after fix) =="
rg -n -C2 'AI_HELPERS_SHA|git -C /tmp/ai-helpers (fetch|checkout).*' .github/workflows/claude-wif-test.yaml || trueRepository: openshift/hypershift
Length of output: 493
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== clone command =="
rg -n -C2 'git clone .*openshift-eng/ai-helpers' .github/workflows/claude-wif-test.yaml
echo
echo "== pinning evidence (should match after fix) =="
rg -n -C2 'AI_HELPERS_SHA|git -C /tmp/ai-helpers (fetch|checkout).*' .github/workflows/claude-wif-test.yaml || trueRepository: openshift/hypershift
Length of output: 493
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== clone command =="
rg -n -C2 'git clone .*openshift-eng/ai-helpers' .github/workflows/claude-wif-test.yaml
echo
echo "== pinning evidence (should match after fix) =="
rg -n -C2 'AI_HELPERS_SHA|git -C /tmp/ai-helpers (fetch|checkout).*' .github/workflows/claude-wif-test.yaml || trueRepository: openshift/hypershift
Length of output: 493
🏁 Script executed:
#!/bin/bash
set -euo pipefail
rg -n -C2 'git clone .*openshift-eng/ai-helpers' .github/workflows/claude-wif-test.yaml
rg -n -C2 'AI_HELPERS_SHA|git -C /tmp/ai-helpers (fetch|checkout).*' .github/workflows/claude-wif-test.yaml || trueRepository: openshift/hypershift
Length of output: 424
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== clone command =="
rg -n -C2 'git clone .*openshift-eng/ai-helpers' .github/workflows/claude-wif-test.yaml
echo
echo "== pinning evidence (should match after fix) =="
rg -n -C2 'AI_HELPERS_SHA|git -C /tmp/ai-helpers (fetch|checkout).*' .github/workflows/claude-wif-test.yaml || trueRepository: openshift/hypershift
Length of output: 493
Pin openshift-eng/ai-helpers to an immutable commit SHA before using it in CI (line 56)
.github/workflows/claude-wif-test.yaml clones https://github.com/openshift-eng/ai-helpers.git at runtime (--depth 1) without any commit SHA pinning, and there is no subsequent fetch/checkout to an immutable revision before plugin setup. Pin to a reviewed commit SHA (e.g., via an AI_HELPERS_SHA variable) and fetch+checkout that SHA.
🔒 Suggested hardening diff
- name: Set up ai-helpers plugins
run: |
- git clone --depth 1 https://github.com/openshift-eng/ai-helpers.git /tmp/ai-helpers
+ AI_HELPERS_SHA="REPLACE_WITH_REVIEWED_COMMIT_SHA"
+ git clone --depth 1 https://github.com/openshift-eng/ai-helpers.git /tmp/ai-helpers
+ git -C /tmp/ai-helpers fetch --depth 1 origin "$AI_HELPERS_SHA"
+ git -C /tmp/ai-helpers checkout --detach "$AI_HELPERS_SHA"
mkdir -p "$HOME/.claude/plugins"
cat > "$HOME/.claude/settings.json" << 'SETTINGS'🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/claude-wif-test.yaml at line 56, The workflow currently
clones openshift-eng/ai-helpers without pinning to an immutable revision; add an
input/env variable AI_HELPERS_SHA, clone the repo into /tmp/ai-helpers, then
explicitly fetch and checkout that SHA (use git fetch + git checkout of
AI_HELPERS_SHA or clone the specific commit) before any plugin setup or usage;
ensure the workflow errors if AI_HELPERS_SHA is unset or the checkout fails so
CI never runs against an unpinned tip.
|
@bryan-cox: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/test-wif |
4 participants
Summary
container:block from Claude WIF test workflow — ARC runners don't support container mode withoutanyuidSCC and a long-running entrypointsettings.json,known_marketplaces.json) pointing at the cloned ai-helpers pathTest plan
/test-wifon any PR to trigger the workflow🤖 Generated with Claude Code
Summary by CodeRabbit