fix(ci): update curl pin to pqc-enabled tag so PQC keys are generated - #3579
Conversation
The watch-sh-fix tag predates PQC support in init-temp-keys.sh, so kas-xwing-private.pem and related files were never generated. The pqc-enabled tag points to main HEAD which already runs `go run ./service/cmd/keygen` to produce the PQC key pairs needed by start-additional-kas when pqc-enabled is true. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Dave Mihalcik <dmihalcik@virtru.com>
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request updates the CI pipeline to use a more recent version of key infrastructure scripts. By switching to the 'pqc-enabled' tag, the build process now correctly generates the necessary PQC key pairs required for testing additional KAS configurations. Highlights
New Features🧠 You can now enable Memory (public preview) to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. The scripts were old and lacking grace, / PQC keys had no place. / A tag was swapped, the path is clear, / Now tests run right, without a fear. Footnotes
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThe PR updates two test GitHub Actions: it changes the curl URLs to fetch helper scripts from the ChangesTest action PQC adjustments
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the GitHub Actions workflow to download setup scripts and docker-compose files using the pqc-enabled tag instead of watch-sh-fix. The review feedback recommends adding the -sSfL flags to the curl commands to ensure the step fails immediately if an HTTP error occurs, preventing downstream failures from corrupted or missing files.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@test/start-up-with-containers/action.yaml`:
- Around line 129-131: The three curl downloads (the URLs that write to
otdf-test-platform/.github/scripts/init-temp-keys.sh,
otdf-test-platform/docker-compose.yaml, and
otdf-test-platform/.github/scripts/watch.sh) must include integrity checks:
either pin the URLs to an immutable commit SHA instead of the "pqc-enabled" tag,
or (if tag use is required) fetch a trusted checksum/signature for each file and
verify it before saving/executing; implement a post-download verification step
that computes sha256 (or verifies a GPG signature) and fails the workflow if the
checksum/signature does not match, and ensure the verified files are only
executed later at the existing execution points (the script invocations around
lines where these files are run) after successful verification.
- Around line 129-131: The scripts are being fetched from the hardcoded tag
"pqc-enabled" which can mismatch the checked-out platform ref
(inputs.platform-ref); update the curl download URLs in action.yaml so the three
fetched files (init-temp-keys.sh, docker-compose.yaml, watch.sh) use the same
ref as the platform checkout (inputs.platform-ref) instead of the fixed tag,
ensuring downloads are parameterized to reference inputs.platform-ref so scripts
and platform code remain in sync.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: a4fccfd3-1d3b-4c95-909d-2f2301950b1c
📒 Files selected for processing (1)
test/start-up-with-containers/action.yaml
Benchmark results, click to expandBenchmark authorization.GetDecisions Results:
Benchmark authorization.v2.GetMultiResourceDecision Results:
Benchmark Statistics
Bulk Benchmark Results
TDF3 Benchmark Results:
|
yq does not support if/elif/else expressions; use the idiomatic with(select(...); ...) pattern instead to conditionally append PQC keyring and cryptoProvider entries when pqc-enabled is true. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Dave Mihalcik <dmihalcik@virtru.com>
Benchmark results, click to expandBenchmark authorization.GetDecisions Results:
Benchmark authorization.v2.GetMultiResourceDecision Results:
Benchmark Statistics
Bulk Benchmark Results
TDF3 Benchmark Results:
|
Without -f, a 404 or other HTTP error response body is silently written to the destination file, causing confusing failures in later steps that try to execute or parse the invalid content. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Dave Mihalcik <dmihalcik@virtru.com>
Benchmark results, click to expandBenchmark authorization.GetDecisions Results:
Benchmark authorization.v2.GetMultiResourceDecision Results:
Benchmark Statistics
Bulk Benchmark Results
TDF3 Benchmark Results:
|
|
2 participants
Summary
curlpin intest/start-up-with-containers/action.yamlfromwatch-sh-fixtopqc-enabledtagwatch-sh-fixtag predates PQC support ininit-temp-keys.sh, sokas-xwing-private.pemand related files were never generatedpqc-enabledtag points to main HEAD which runsgo run ./service/cmd/keygento produce the PQC key pairs needed bystart-additional-kaswhenpqc-enabledis trueTest plan
start-additional-kasworks whenpqc-enabled: true🤖 Generated with Claude Code
Summary by CodeRabbit
Chores
Tests