Skip to content

NO-JIRA: replace container image with workflow-step plugin setup #8611

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openshift-merge-bot merged 1 commit into from
May 27, 2026
Merged

NO-JIRA: replace container image with workflow-step plugin setup #8611

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 7 additions & 2 deletions .github/workflows/claude-wif-test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,8 +20,6 @@ jobs:
github.event.comment.author_association == 'OWNER' ||
github.event.comment.author_association == 'COLLABORATOR'))
runs-on: arc-runner-set
container:
image: quay.io/rh_ee_brcox/hypershift:ai-helpers-arm64
timeout-minutes: 10
env:
HOME: /tmp
Expand Down Expand Up @@ -53,6 +51,13 @@ jobs:
curl -fsSL https://claude.ai/install.sh | bash
echo "$HOME/.local/bin" >> $GITHUB_PATH

- name: Set up ai-helpers plugins
run: |
git clone --depth 1 https://github.com/openshift-eng/ai-helpers.git /tmp/ai-helpers

@coderabbitai coderabbitai Bot May 27, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== clone command =="
rg -n -C2 'git clone .*openshift-eng/ai-helpers' .github/workflows/claude-wif-test.yaml

echo
echo "== pinning evidence (should match after fix) =="
rg -n -C2 'AI_HELPERS_SHA|git -C /tmp/ai-helpers (fetch|checkout).*' .github/workflows/claude-wif-test.yaml || true

Repository: openshift/hypershift

Length of output: 493

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== clone command =="
rg -n -C2 'git clone .*openshift-eng/ai-helpers' .github/workflows/claude-wif-test.yaml

echo
echo "== pinning evidence (should match after fix) =="
rg -n -C2 'AI_HELPERS_SHA|git -C /tmp/ai-helpers (fetch|checkout).*' .github/workflows/claude-wif-test.yaml || true

Repository: openshift/hypershift

Length of output: 493

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== clone command =="
rg -n -C2 'git clone .*openshift-eng/ai-helpers' .github/workflows/claude-wif-test.yaml

echo
echo "== pinning evidence (should match after fix) =="
rg -n -C2 'AI_HELPERS_SHA|git -C /tmp/ai-helpers (fetch|checkout).*' .github/workflows/claude-wif-test.yaml || true

Repository: openshift/hypershift

Length of output: 493

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== clone command =="
rg -n -C2 'git clone .*openshift-eng/ai-helpers' .github/workflows/claude-wif-test.yaml

echo
echo "== pinning evidence (should match after fix) =="
rg -n -C2 'AI_HELPERS_SHA|git -C /tmp/ai-helpers (fetch|checkout).*' .github/workflows/claude-wif-test.yaml || true

Repository: openshift/hypershift

Length of output: 493

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== clone command =="
rg -n -C2 'git clone .*openshift-eng/ai-helpers' .github/workflows/claude-wif-test.yaml

echo
echo "== pinning evidence (should match after fix) =="
rg -n -C2 'AI_HELPERS_SHA|git -C /tmp/ai-helpers (fetch|checkout).*' .github/workflows/claude-wif-test.yaml || true

Repository: openshift/hypershift

Length of output: 493

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== clone command =="
rg -n -C2 'git clone .*openshift-eng/ai-helpers' .github/workflows/claude-wif-test.yaml

echo
echo "== pinning evidence (should match after fix) =="
rg -n -C2 'AI_HELPERS_SHA|git -C /tmp/ai-helpers (fetch|checkout).*' .github/workflows/claude-wif-test.yaml || true

Repository: openshift/hypershift

Length of output: 493

🏁 Script executed:

#!/bin/bash
set -euo pipefail

rg -n -C2 'git clone .*openshift-eng/ai-helpers' .github/workflows/claude-wif-test.yaml
rg -n -C2 'AI_HELPERS_SHA|git -C /tmp/ai-helpers (fetch|checkout).*' .github/workflows/claude-wif-test.yaml || true

Repository: openshift/hypershift

Length of output: 424

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== clone command =="
rg -n -C2 'git clone .*openshift-eng/ai-helpers' .github/workflows/claude-wif-test.yaml

echo
echo "== pinning evidence (should match after fix) =="
rg -n -C2 'AI_HELPERS_SHA|git -C /tmp/ai-helpers (fetch|checkout).*' .github/workflows/claude-wif-test.yaml || true

Repository: openshift/hypershift

Length of output: 493

Pin openshift-eng/ai-helpers to an immutable commit SHA before using it in CI (line 56)

.github/workflows/claude-wif-test.yaml clones https://github.com/openshift-eng/ai-helpers.git at runtime (--depth 1) without any commit SHA pinning, and there is no subsequent fetch/checkout to an immutable revision before plugin setup. Pin to a reviewed commit SHA (e.g., via an AI_HELPERS_SHA variable) and fetch+checkout that SHA.

🔒 Suggested hardening diff 
       - name: Set up ai-helpers plugins
         run: |
-          git clone --depth 1 https://github.com/openshift-eng/ai-helpers.git /tmp/ai-helpers
+          AI_HELPERS_SHA="REPLACE_WITH_REVIEWED_COMMIT_SHA"
+          git clone --depth 1 https://github.com/openshift-eng/ai-helpers.git /tmp/ai-helpers
+          git -C /tmp/ai-helpers fetch --depth 1 origin "$AI_HELPERS_SHA"
+          git -C /tmp/ai-helpers checkout --detach "$AI_HELPERS_SHA"
           mkdir -p "$HOME/.claude/plugins"
           cat > "$HOME/.claude/settings.json" << 'SETTINGS'
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/claude-wif-test.yaml at line 56, The workflow currently
clones openshift-eng/ai-helpers without pinning to an immutable revision; add an
input/env variable AI_HELPERS_SHA, clone the repo into /tmp/ai-helpers, then
explicitly fetch and checkout that SHA (use git fetch + git checkout of
AI_HELPERS_SHA or clone the specific commit) before any plugin setup or usage;
ensure the workflow errors if AI_HELPERS_SHA is unset or the checkout fails so
CI never runs against an unpinned tip.

mkdir -p "$HOME/.claude/plugins"
printf '%s\n' '{"enabledPlugins":{"hello-world@ai-helpers":true,"jira@ai-helpers":true,"ci@ai-helpers":true}}' > "$HOME/.claude/settings.json"
printf '%s\n' '{"ai-helpers":{"source":{"source":"directory","path":"/tmp/ai-helpers"},"installLocation":"/tmp/ai-helpers","lastUpdated":"2025-10-27T12:00:00.000Z"}}' > "$HOME/.claude/plugins/known_marketplaces.json"

Comment on lines +54 to +60

@cblecker cblecker May 27, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could we use the claude cli command for this?

Suggested change
- name: Set up ai-helpers plugins
run: |
git clone --depth 1 https://github.com/openshift-eng/ai-helpers.git /tmp/ai-helpers
mkdir -p "$HOME/.claude/plugins"
printf '%s\n' '{"enabledPlugins":{"hello-world@ai-helpers":true,"jira@ai-helpers":true,"ci@ai-helpers":true}}' > "$HOME/.claude/settings.json"
printf '%s\n' '{"ai-helpers":{"source":{"source":"directory","path":"/tmp/ai-helpers"},"installLocation":"/tmp/ai-helpers","lastUpdated":"2025-10-27T12:00:00.000Z"}}' > "$HOME/.claude/plugins/known_marketplaces.json"
- name: Set up ai-helpers plugins
run: |
claude plugin marketplace add openshift-eng/ai-helpers
claude plugin install hello-world@ai-helpers
claude plugin install jira@ai-helpers
claude plugin install ci@ai-helpers

- name: Test Claude Code
env:
CLAUDE_CODE_USE_VERTEX: "1"
Expand Down
Loading