This repository was archived by the owner on Sep 9, 2026. It is now read-only.
bump submodules - #173
Merged
Merged
bump submodules#173
Conversation
WalkthroughThis PR updates version pinning across the OSAC installer's Kustomize manifests. Git submodules for three OSAC components ( ChangesDependency version updates
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Security & Risk AssessmentRisk Severity: Medium This PR pins multiple container images and submodule commits across production-relevant overlays. Key risk factors:
Mitigation: Verify image provenance (checksums, signatures), audit the commit ranges in each submodule update, and confirm CI/test results for the new versions in all affected environments. Possibly related PRs
Suggested labels
Suggested reviewers
Poem
Caution Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional.
❌ Failed checks (1 error, 1 warning)
✅ Passed checks (9 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@base/kustomization.yaml`:
- Around line 29-35: The image tags in kustomization.yaml referencing
ghcr.io/osac-project/fulfillment-service:sha-2cec20c, osac-aap:sha-0255559 and
ghcr.io/osac-project/osac-operator:sha-72aa363 are not present in GHCR; replace
the unstable "sha-..." tags with verified image digests (sha256:...) that you
confirm via `docker manifest inspect`/`crane manifest` using the same GHCR
credentials your deployment uses, update the corresponding entries for
name/newName/newTag in kustomization.yaml, and re-run vulnerability scans per
image digest (not just fulfillment-service) to ensure each image/digest has been
scanned.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: 1ae5d6c6-1bb5-415f-9fd6-345064b9164f
📒 Files selected for processing (7)
base/kustomization.yamlbase/osac-aapbase/osac-fulfillment-servicebase/osac-operatoroverlays/caas-ci/kustomization.yamloverlays/osac-integration/kustomization.yamloverlays/vmaas-ci/kustomization.yaml
Comment on lines
29
to
+35
| - name: ghcr.io/osac-project/fulfillment-service | ||
| newTag: sha-5be2b1b | ||
| newTag: sha-2cec20c | ||
| - name: osac-aap | ||
| newName: ghcr.io/osac-project/osac-aap | ||
| newTag: sha-a2b8504 | ||
| newTag: sha-0255559 | ||
| - name: ghcr.io/osac-project/osac-operator | ||
| newTag: sha-3171828 | ||
| newTag: sha-72aa363 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify that the new container images exist and are pullable
echo "=== Checking fulfillment-service image ==="
docker manifest inspect ghcr.io/osac-project/fulfillment-service:sha-2cec20c >/dev/null 2>&1
if [ $? -eq 0 ]; then
echo "✓ fulfillment-service:sha-2cec20c exists"
else
echo "✗ fulfillment-service:sha-2cec20c NOT FOUND"
fi
echo -e "\n=== Checking osac-aap image ==="
docker manifest inspect ghcr.io/osac-project/osac-aap:sha-0255559 >/dev/null 2>&1
if [ $? -eq 0 ]; then
echo "✓ osac-aap:sha-0255559 exists"
else
echo "✗ osac-aap:sha-0255559 NOT FOUND"
fi
echo -e "\n=== Checking osac-operator image ==="
docker manifest inspect ghcr.io/osac-project/osac-operator:sha-72aa363 >/dev/null 2>&1
if [ $? -eq 0 ]; then
echo "✓ osac-operator:sha-72aa363 exists"
else
echo "✗ osac-operator:sha-72aa363 NOT FOUND"
fi
echo -e "\n=== Checking for known vulnerabilities ==="
echo "Checking GitHub security advisories for osac-project..."
gh api graphql -f query='
{
repository(owner: "osac-project", name: "fulfillment-service") {
vulnerabilityAlerts(first: 5) {
nodes {
securityAdvisory {
summary
severity
}
vulnerableManifestFilename
}
}
}
}'Repository: osac-project/osac-installer
Length of output: 460
Harden image tag validation: GHCR manifests for the referenced SHAs aren’t available.
docker manifest inspectreturned NOT FOUND forghcr.io/osac-project/fulfillment-service:sha-2cec20c,ghcr.io/osac-project/osac-aap:sha-0255559, andghcr.io/osac-project/osac-operator:sha-72aa363, which would break image pulls and block deployment (Risk severity: High).- The vulnerability check only queried GitHub
vulnerabilityAlertsfor fulfillment-service (and only returns up to 5 alerts); it’s not sufficient to claim the images/digests forosac-aapandosac-operatorare vulnerability-free.
Update the image references to digests that exist/pull from GHCR (and re-check with the same registry credentials your deployment uses); expand vulnerability scanning per image/digest.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@base/kustomization.yaml` around lines 29 - 35, The image tags in
kustomization.yaml referencing
ghcr.io/osac-project/fulfillment-service:sha-2cec20c, osac-aap:sha-0255559 and
ghcr.io/osac-project/osac-operator:sha-72aa363 are not present in GHCR; replace
the unstable "sha-..." tags with verified image digests (sha256:...) that you
confirm via `docker manifest inspect`/`crane manifest` using the same GHCR
credentials your deployment uses, update the corresponding entries for
name/newName/newTag in kustomization.yaml, and re-run vulnerability scans per
image digest (not just fulfillment-service) to ensure each image/digest has been
scanned.
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: akshaynadkarni, omer-vishlitzky The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
This was referenced Jun 3, 2026
Closed
7 tasks
9 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit