d/s merge, fix security in d/s #343
The diff you're trying to view is too large. We only load the first 3000 changed files.
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,222 @@ | ||
| name: performance-report | ||
|
|
||
| on: | ||
| workflow_run: | ||
| workflows: ["e2e-kind"] | ||
| types: | ||
| - completed | ||
|
|
||
| permissions: | ||
| contents: read | ||
| pull-requests: write | ||
| issues: write | ||
| actions: read | ||
|
|
||
| concurrency: | ||
| group: perf-report-${{ github.event.workflow_run.head_branch || github.run_id }} | ||
| cancel-in-progress: true | ||
|
|
||
| jobs: | ||
| process-performance-results: | ||
| name: Process Performance Results | ||
| runs-on: ubuntu-latest | ||
| if: github.event.workflow_run.conclusion == 'success' || github.event.workflow_run.conclusion == 'failure' | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | ||
| with: | ||
| persist-credentials: false | ||
|
|
||
| - name: Set up Python | ||
| uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 | ||
| with: | ||
| python-version: '3.11' | ||
|
|
||
| - name: Install Python dependencies | ||
| run: | | ||
| python -m pip install --upgrade pip | ||
| pip install -r e2e/perf/requirements.txt | ||
|
|
||
| - name: Download performance test data artifacts | ||
| run: | | ||
| e2e/perf/download-artifacts.py \ | ||
| --run-id ${{ github.event.workflow_run.id }} \ | ||
| --filter "performance-test-data" \ | ||
| --output-dir artifact-downloads \ | ||
| --extract | ||
|
|
||
| - name: Organize extracted artifacts and generate JSON data | ||
| run: | | ||
| for dir in artifact-downloads/*performance-test-data*; do | ||
| if [ -d "$dir" ]; then | ||
| workload=$(basename "$dir" | sed 's/-performance-test-data-.*//') | ||
| mkdir -p "reports/${workload}" | ||
|
|
||
| metrics_dir="" | ||
| if [ -d "$dir/perf-data/metrics" ]; then | ||
| metrics_dir="$dir/perf-data/metrics" | ||
| elif [ -d "$dir/metrics" ]; then | ||
| metrics_dir="$dir/metrics" | ||
| fi | ||
|
|
||
| if [ -n "$metrics_dir" ]; then | ||
| echo "Processing workload: $workload (metrics: $metrics_dir)" | ||
| python3 e2e/perf/generate_perf_report.py \ | ||
| --workload "$workload" \ | ||
| --metrics-dir "$metrics_dir" \ | ||
| --json-output "reports/${workload}/performance_data.json" \ | ||
| --output "reports/${workload}/performance_report.md" | ||
| else | ||
| echo "Warning: no metrics directory found under $dir" | ||
| find "$dir" -type f | head -50 || true | ||
| fi | ||
| fi | ||
| done | ||
|
|
||
| echo "=== Generated reports structure ===" | ||
| find reports -type f 2>/dev/null || true | ||
|
|
||
| - name: Get associated PRs | ||
| id: get_prs | ||
| run: | | ||
| PR_NUMBERS=$(e2e/perf/get-pr-info.py \ | ||
| --event-path $GITHUB_EVENT_PATH \ | ||
| --format json) | ||
| echo "pr_numbers=$PR_NUMBERS" >> $GITHUB_OUTPUT | ||
| echo "Found PRs: $PR_NUMBERS" | ||
|
|
||
| - name: Fetch baseline run | ||
| id: get_baseline | ||
| if: steps.get_prs.outputs.pr_numbers != '[]' | ||
| run: | | ||
| # Prefer a successful push run of e2e-kind as the baseline when no | ||
| # scheduled performance lane exists yet. | ||
| BASELINE_INFO=$(e2e/perf/get-baseline-run.py \ | ||
| --workflow kind-e2e.yml \ | ||
| --event push \ | ||
| --output json) || echo "{}" | ||
|
|
||
| BASELINE_ID=$(echo "$BASELINE_INFO" | python3 -c "import sys, json; data=json.load(sys.stdin); print(data.get('id', ''))" 2>/dev/null || echo "") | ||
| BASELINE_URL=$(echo "$BASELINE_INFO" | python3 -c "import sys, json; data=json.load(sys.stdin); print(data.get('url', ''))" 2>/dev/null || echo "") | ||
|
|
||
| echo "baseline_run_id=$BASELINE_ID" >> $GITHUB_OUTPUT | ||
| echo "baseline_run_url=$BASELINE_URL" >> $GITHUB_OUTPUT | ||
|
|
||
| echo "Baseline run ID: $BASELINE_ID" | ||
| echo "Baseline run URL: $BASELINE_URL" | ||
|
|
||
| - name: Download baseline artifacts | ||
| if: steps.get_baseline.outputs.baseline_run_id != '' | ||
| run: | | ||
| e2e/perf/download-artifacts.py \ | ||
| --run-id ${{ steps.get_baseline.outputs.baseline_run_id }} \ | ||
| --filter "performance-test-data" \ | ||
| --output-dir baseline-downloads \ | ||
| --extract | ||
|
|
||
| - name: Organize baseline artifacts and generate JSON data | ||
| if: steps.get_baseline.outputs.baseline_run_id != '' | ||
| run: | | ||
| mkdir -p baseline-reports | ||
| for dir in baseline-downloads/*performance-test-data*; do | ||
| if [ -d "$dir" ]; then | ||
| workload=$(basename "$dir" | sed 's/-performance-test-data-.*//') | ||
| mkdir -p "baseline-reports/${workload}" | ||
|
|
||
| metrics_dir="" | ||
| if [ -d "$dir/perf-data/metrics" ]; then | ||
| metrics_dir="$dir/perf-data/metrics" | ||
| elif [ -d "$dir/metrics" ]; then | ||
| metrics_dir="$dir/metrics" | ||
| fi | ||
|
|
||
| if [ -n "$metrics_dir" ]; then | ||
| echo "Processing baseline workload: $workload" | ||
| python3 e2e/perf/generate_perf_report.py \ | ||
| --workload "$workload" \ | ||
| --metrics-dir "$metrics_dir" \ | ||
| --json-output "baseline-reports/${workload}/performance_data.json" \ | ||
| --output "baseline-reports/${workload}/performance_report.md" | ||
| fi | ||
| fi | ||
| done | ||
|
|
||
| echo "=== Baseline reports structure ===" | ||
| find baseline-reports -type f 2>/dev/null || echo "No baseline reports found" | ||
|
|
||
| - name: Compare reports with baseline | ||
| if: steps.get_prs.outputs.pr_numbers != '[]' | ||
| run: | | ||
| mkdir -p enhanced-reports | ||
|
|
||
| for workload_dir in reports/*/; do | ||
| if [ -d "$workload_dir" ]; then | ||
| workload=$(basename "$workload_dir") | ||
| current_json="$workload_dir/performance_data.json" | ||
| baseline_json="baseline-reports/$workload/performance_data.json" | ||
| enhanced_report="enhanced-reports/$workload/performance_report.md" | ||
|
|
||
| if [ -f "$current_json" ]; then | ||
| echo "Comparing data for workload: $workload" | ||
| mkdir -p "enhanced-reports/$workload" | ||
|
|
||
| if [ -f "$baseline_json" ]; then | ||
| e2e/perf/compare-reports.py \ | ||
| --current "$current_json" \ | ||
| --baseline "$baseline_json" \ | ||
| --baseline-url "${{ steps.get_baseline.outputs.baseline_run_url }}" \ | ||
| --output "$enhanced_report" | ||
| else | ||
| echo "No baseline found for $workload, using current data as-is" | ||
| e2e/perf/compare-reports.py \ | ||
| --current "$current_json" \ | ||
| --output "$enhanced_report" | ||
| fi | ||
| else | ||
| echo "Warning: No JSON data found for $workload" | ||
| fi | ||
| fi | ||
| done | ||
|
|
||
| - name: Post performance report to PRs | ||
| if: steps.get_prs.outputs.pr_numbers != '[]' | ||
| run: | | ||
| PR_NUMBERS=$(echo '${{ steps.get_prs.outputs.pr_numbers }}' | python3 -c "import sys, json; print(' '.join(f'--pr {pr}' for pr in json.load(sys.stdin)))") | ||
|
|
||
| if [ -n "$PR_NUMBERS" ]; then | ||
| e2e/perf/post-pr-comment.py \ | ||
| $PR_NUMBERS \ | ||
| --reports-dir enhanced-reports \ | ||
| --run-id "${{ github.event.workflow_run.id }}" \ | ||
| --run-url "${{ github.event.workflow_run.html_url }}" \ | ||
| --status "${{ github.event.workflow_run.conclusion }}" \ | ||
| --baseline-id "${{ steps.get_baseline.outputs.baseline_run_id }}" \ | ||
| --baseline-url "${{ steps.get_baseline.outputs.baseline_run_url }}" | ||
| fi | ||
|
|
||
| - name: Upload processed artifacts | ||
| if: always() | ||
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 | ||
| with: | ||
| name: processed-performance-data-${{ github.event.workflow_run.id }} | ||
| path: | | ||
| reports/ | ||
| enhanced-reports/ | ||
| baseline-reports/ | ||
| if-no-files-found: warn | ||
| retention-days: 90 | ||
|
|
||
| - name: Summary | ||
| if: always() | ||
| run: | | ||
| echo "## Performance Report Processing Summary" >> $GITHUB_STEP_SUMMARY | ||
| echo "- **Workflow Run ID:** ${{ github.event.workflow_run.id }}" >> $GITHUB_STEP_SUMMARY | ||
| echo "- **Conclusion:** ${{ github.event.workflow_run.conclusion }}" >> $GITHUB_STEP_SUMMARY | ||
| echo "- **Associated PRs:** ${{ steps.get_prs.outputs.pr_numbers }}" >> $GITHUB_STEP_SUMMARY | ||
| echo "" >> $GITHUB_STEP_SUMMARY | ||
| echo "### Artifacts Processed" >> $GITHUB_STEP_SUMMARY | ||
| PERF_TEST_COUNT=$(ls -1d artifact-downloads/*performance-test-data* 2>/dev/null | wc -l | tr -d ' ') | ||
| echo "- Performance test data dirs: **${PERF_TEST_COUNT}**" >> $GITHUB_STEP_SUMMARY | ||
| find reports enhanced-reports -type f 2>/dev/null | sed 's/^/- /' >> $GITHUB_STEP_SUMMARY || true | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -4,12 +4,9 @@ | |
| exclude: | ||
| global: | ||
| - "**/*_test.go" | ||
| # Upstream GitHub Actions performance reporting helpers are not shipped in | ||
| # downstream images; Snyk flags their local artifact paths. | ||
| - e2e/perf/compare-reports.py | ||
| - e2e/perf/download-artifacts.py | ||
| - e2e/perf/generate_perf_report.py | ||
| - e2e/perf/get-pr-info.py | ||
|
Comment on lines
+7
to
+12
Contributor
There was a problem hiding this comment. 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win 🔎 Supported by static analysis🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "Snyk invocations:"
rg -n -C 4 '\bsnyk\b' .github Makefile hack Dockerfile.microshift Dockerfile.openshift images 2>/dev/null || true
echo "Excluded helper invocations:"
rg -n -C 4 'e2e/perf/(compare-reports|download-artifacts|generate_perf_report|get-pr-info)\.py' .github e2e Makefile 2>/dev/null || true
echo "Image/package inclusion:"
rg -n -C 4 'e2e/perf|perf/(compare-reports|download-artifacts|generate_perf_report|get-pr-info)' Dockerfile.microshift Dockerfile.openshift images 2>/dev/null || trueRepository: openshift/multus-cni Length of output: 6869 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "Snyk configuration:"
cat -n .snyk
echo "Performance workflow permissions and helper execution:"
sed -n '1,190p' .github/workflows/performance-report.yml
echo "Excluded helper entry points:"
for f in e2e/perf/compare-reports.py e2e/perf/download-artifacts.py e2e/perf/generate_perf_report.py e2e/perf/get-pr-info.py; do
printf '\n--- %s ---\n' "$f"
sed -n '1,35p' "$f"
doneRepository: openshift/multus-cni Length of output: 13066 🌐 Web query:
💡 Result: To exclude files or directories from Snyk Code CLI scans, you can use the.snyk policy file with an exclude section [1][2]. The global group within this file applies exclusions to Snyk Code as well as other supported Snyk products [1][3]. Configuration Syntax To exclude files or directories using the.snyk file, add an exclude block at the root of the file using YAML syntax [1][2]: # Snyk (https://snyk.io) policy file exclude: global: - path/to/exclude - "*.pattern.ext" - directory_name/ When you use the global group, the specified files and directories are excluded from Snyk Code tests, Snyk Secrets, and other Snyk products that support this configuration [1][3]. If you only want to exclude files from Snyk Code specifically, you can use the code group instead of global [1][2][3]. Alternative Method: Using the CLI You can also exclude files or folders from Snyk Code tests by using the snyk ignore --file-path command [4][5]. This command automatically creates or updates the.snyk file in your repository with the specified path [4]. For example: snyk ignore --file-path='path/to/exclude' --file-path-group='global' Note the following details: - Exclusions via the.snyk file apply to the Snyk Web UI, CLI, and IDE environments [1]. - The.snyk file must be located in the root of your repository, and the patterns should be relative to that root [2][3]. - While the.snyk file is commonly used to ignore vulnerabilities in other Snyk products, its use with Snyk Code is strictly for excluding files and directories from being scanned (import) [6][1][2]. It cannot be used to ignore specific Snyk Code vulnerability findings [6][1]. - The CLI --exclude option (used with other Snyk test types) does not apply to Snyk Code scans [7]. Citations:
Keep executable CI helpers in security analysis. The global 🤖 Prompt for AI AgentsSource: MCP tools |
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Assign the fallback value to
BASELINE_INFO.|| echo "{}"prints to stdout. It does not setBASELINE_INFO. On failure the variable is empty, the followingpython3parse fails, and the log shows a stray{}. Assign the fallback so the intended default applies.🛠️ Proposed fix
📝 Committable suggestion
🤖 Prompt for AI Agents