CNTRLPLANE-3641: ci: replace COMMUNITY_FORK_TOKEN PAT with GitHub App token - #8776
Conversation
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
openshift-ci-robot
added
the
jira/valid-reference
|
@bryan-cox: This pull request references CNTRLPLANE-3641 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
📝 WalkthroughWalkthroughA new reusable GitHub Actions workflow ( Sequence DiagramsequenceDiagram
participant Caller as Calling Workflow
participant Reusable as reusable-claude-on-pr.yaml
participant GitHub as GitHub API
participant GCP as GCP
participant Claude as Claude CLI
Caller->>Reusable: Invoke with command-name, prompt, max-turns, allowed-tools
Reusable->>GitHub: Post status comment with message and run link
Reusable->>GitHub: Fetch PR head ref and repository
Reusable->>GitHub: Conditionally create GitHub App token
Reusable->>GitHub: Checkout PR head using selected token
Reusable->>GCP: Authenticate via OIDC/WIF
Reusable->>Claude: Install Claude Code and dependencies
Reusable->>Claude: Install required plugins
Reusable->>Claude: Execute claude with prompt and configuration
Claude-->>Reusable: Return execution result
Reusable-->>Caller: Complete job
Possibly related PRs
Suggested reviewers
Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error)
✅ Passed checks (10 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: bryan-cox The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
|
/area ai |
openshift-ci
Bot
added
area/ai
3b125a0 to
2531ed1
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/address-review-comments.yaml:
- Around line 55-63: The actions/create-github-app-token action is referenced
using a tag (v2) instead of being pinned to a full commit SHA, which violates
the CI/CD security policy. Replace the `uses` field in the Generate community
fork token step from `actions/create-github-app-token@v2` to
`actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349` to
pin it to the specific commit SHA.
In @.github/workflows/rebase.yaml:
- Around line 55-63: The actions/create-github-app-token action in the "Generate
community fork token" step is referenced by tag (v2) instead of a pinned full
commit SHA, which is a security best practice. Replace the `@v2` tag reference in
the uses field with the full commit SHA of that action version to ensure the
exact version is always used and prevent unexpected changes.
In @.github/workflows/restructure-commits.yaml:
- Around line 55-63: The `actions/create-github-app-token` action is referenced
using the tag `@v2` instead of a pinned commit SHA. Replace the `@v2` tag in the
`uses` line of the `app-token` step with the full commit SHA for the stable
version of this action to follow security best practices and ensure consistent
behavior across workflow runs.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 641e9282-5ed6-406b-b167-9a91450d9eb8
📒 Files selected for processing (3)
.github/workflows/address-review-comments.yaml.github/workflows/rebase.yaml.github/workflows/restructure-commits.yaml
|
/verified later @bryan-cox |
openshift-ci-robot
added
verified-later
verified
|
@bryan-cox: This PR has been marked to be verified later by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
Add two new GitHub Actions workflows triggered by PR comments: - /restructure-commits: invokes the repo's restructure-commits command via Claude to reorganize branch commits by component - /rebase: uses Claude to rebase the PR onto latest main, resolve any conflicts, and force push Both follow the same pattern as the address-review-comments workflow with concurrency grouping, fork token handling, and GCP WIF auth. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2531ed1 to
512b78a
Compare
openshift-ci-robot
removed
verified
|
@bryan-cox: This pull request references CNTRLPLANE-3641 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/verified later @bryan-cox |
|
@bryan-cox: This PR has been marked to be verified later by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci-robot
added
the
verified
|
/lgtm |
|
Pipeline controller notification No second-stage tests were triggered for this PR. This can happen when:
Use |
There was a problem hiding this comment.
🧹 Nitpick comments (2)
.github/workflows/reusable-claude-on-pr.yaml (2)
98-101: 💤 Low valueConsider adding integrity verification for the install script.
The
curl | bashpattern executes remote code without verification. While this is a first-party Anthropic script over HTTPS, adding a checksum verification step would provide defense in depth against supply chain attacks.- name: Install Claude Code run: | - curl -fsSL https://claude.ai/install.sh | bash + curl -fsSL https://claude.ai/install.sh -o /tmp/install.sh + # Optionally verify checksum here if Anthropic publishes one + bash /tmp/install.sh echo "$HOME/.local/bin" >> $GITHUB_PATH🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/reusable-claude-on-pr.yaml around lines 98 - 101, The "Install Claude Code" step executes a remote script directly via curl piped to bash without any integrity verification. Modify this step to download the install script to a temporary file, verify its checksum against a known good value (such as SHA256), and only proceed with execution if the checksum matches. This adds a verification layer against potential supply chain attacks on the remote script download.
65-73: 💤 Low valueGitHub App token inherits full installation permissions.
The static analysis tool correctly notes that the generated token receives all permissions configured on the
hypershift-jira-solve-ciGitHub App installation. This is acceptable given the PR's goal of replacing a long-lived PAT, but verify the app is configured with only the minimum permissions needed (contents:write, pull-requests:write).🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/reusable-claude-on-pr.yaml around lines 65 - 73, The GitHub App token generated by the actions/create-github-app-token action in the "Generate community fork token" step will inherit all permissions configured on the hypershift-jira-solve-ci GitHub App installation. Verify that this GitHub App is configured with only the minimum required permissions of contents:write and pull-requests:write. If the app currently has additional permissions beyond these, remove them to adhere to the principle of least privilege for the token used in this workflow.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/workflows/reusable-claude-on-pr.yaml:
- Around line 98-101: The "Install Claude Code" step executes a remote script
directly via curl piped to bash without any integrity verification. Modify this
step to download the install script to a temporary file, verify its checksum
against a known good value (such as SHA256), and only proceed with execution if
the checksum matches. This adds a verification layer against potential supply
chain attacks on the remote script download.
- Around line 65-73: The GitHub App token generated by the
actions/create-github-app-token action in the "Generate community fork token"
step will inherit all permissions configured on the hypershift-jira-solve-ci
GitHub App installation. Verify that this GitHub App is configured with only the
minimum required permissions of contents:write and pull-requests:write. If the
app currently has additional permissions beyond these, remove them to adhere to
the principle of least privilege for the token used in this workflow.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 4dd77916-f04c-47cf-82bd-789406d48927
📒 Files selected for processing (4)
.github/workflows/address-review-comments.yaml.github/workflows/rebase.yaml.github/workflows/restructure-commits.yaml.github/workflows/reusable-claude-on-pr.yaml
eeae009
into
openshift:main
3 participants
What this PR does / why we need it:
Adds two new Claude-powered GHA workflows (
/restructure-commitsand/rebase), extracts a reusable workflow to eliminate duplication, and replaces the long-livedCOMMUNITY_FORK_TOKENPAT with short-lived GitHub App tokens.New workflows:
/restructure-commits— reorganizes PR commits by HyperShift component/rebase— rebases the PR branch onto latest main and force pushesReusable workflow (
reusable-claude-on-pr.yaml):Security improvements:
COMMUNITY_FORK_TOKENPAT with short-lived tokens from thehypershift-jira-solve-ciGitHub App viaactions/create-github-app-token(SHA-pinned)hypershift-jira-solve-ci[bot]instead of a personal accountBug fixes:
verify-git-cleanhook failures (same fix as CNTRLPLANE-3640)Which issue(s) this PR fixes:
Fixes CNTRLPLANE-3641
Special notes for your reviewer:
JIRA_SOLVE_CI_APP_IDandJIRA_SOLVE_CI_PRIVATE_KEYsecrets have been added to repo settingshypershift-jira-solve-ciapp is already installed onhypershift-communitywith write accessissue_commentworkflows run from the default branch (main), so new workflows can't be tested on this PRCOMMUNITY_FORK_TOKENsecret can be removed from repo settings after this merges and is verified workingChecklist: