NO-ISSUE: Fix wrong pull secret file path in refresh-after-snapshot.sh script

[ori-amizur]

Summary by CodeRabbit

• Chores
  • Updated script to resolve image pull secret location relative to the current working directory instead of using a fixed absolute path, improving flexibility for different deployment configurations.

[openshift-ci-robot]

@ori-amizur: This pull request explicitly references no jira issue.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Warning

Review limit reached

@ori-amizur, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 28 minutes and 58 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: f3cbe81c-c718-4792-8bde-d744d0ac668c

📥 Commits

Reviewing files that changed from the base of the PR and between 046db24 and 05ce7ac.

📒 Files selected for processing (1)

• scripts/refresh-after-snapshot.sh

Walkthrough

The script refresh-after-snapshot.sh changes how it locates the image pull secret file. Instead of using a hardcoded absolute path under /installer/overlays/, the script now computes the path relative to the current working directory, enabling more flexible execution contexts.

Changes

Pull Secret Path Resolution

Layer / File(s)	Summary
Pull Secret Path Resolution scripts/refresh-after-snapshot.sh	PULL_SECRET now derives the quay-pull-secret.json path using the current working directory ($(pwd -P)) plus the overlays structure, replacing the hardcoded /installer/overlays/... location.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Security & Impact Note: This change shifts from an absolute hardcoded path to a working-directory-relative path. Severity: Medium. Risk: If the script is invoked from an unexpected working directory, the pull secret will not be found, causing image preflight checks and subsequent image pulls to fail—a potential availability impact. Mitigation: Verify that all call sites execute the script from a consistent, expected working directory, or document the required execution context clearly.

Poem

🔐 From /installer we roamed,
Now pwd guides us home,
The secret path grows fleet,
Where working trees and overlays meet. 🗂️

🚥 Pre-merge checks | ✅ 10 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Ai-Attribution	⚠️ Warning	Commit 046db24 adds .ai-bot infrastructure configuration, suggesting AI tool capability. However, commit lacks required Assisted-by/Generated-by attribution trailers if AI was used.	If AI tools assisted this commit, add Assisted-by: or Generated-by: trailer with Red Hat AI tool attribution per Red Hat policy.

✅ Passed checks (10 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically describes the main change: fixing an incorrect pull secret file path in the refresh-after-snapshot.sh script.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No-Hardcoded-Secrets	✅ Passed	No hardcoded secrets found. PULL_SECRET is a file path variable constructed dynamically, not a hardcoded credential value.
No-Weak-Crypto	✅ Passed	PR only changes file path resolution for PULL_SECRET on line 178. No weak crypto algorithms, custom implementations, or insecure secret comparisons are introduced by this change.
No-Injection-Vectors	✅ Passed	No injection vectors detected. PULL_SECRET properly constructed and double-quoted in commands. No eval, exec, unquoted expansion, or dangerous patterns found.
Container-Privileges	✅ Passed	Custom check for container privileges is not applicable—PR modifies only bash script and documentation, no K8s manifests or container configs changed.
No-Sensitive-Data-In-Logs	✅ Passed	PULL_SECRET variable (a file path) is not directly logged. Output is redirected to files and only displayed via tail on error. No credentials or sensitive data directly logged.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/refresh-after-snapshot.sh`:
- Line 178: The PULL_SECRET path is built from the caller CWD
(PULL_SECRET="$(pwd
-P)/overlays/${INSTALLER_KUSTOMIZE_OVERLAY}/files/quay-pull-secret.json") which
breaks when the script is run outside the repo; change it to anchor to the
script's directory: compute the script directory using BASH_SOURCE (e.g. assign
a variable like script_dir by resolving dirname of "${BASH_SOURCE[0]}" and pwd
-P) and then build PULL_SECRET from that script_dir +
"/overlays/${INSTALLER_KUSTOMIZE_OVERLAY}/files/quay-pull-secret.json" so the
lookup is independent of the caller CWD; update any references that use
PULL_SECRET accordingly.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: ac9de490-ffd5-4dd2-9fc2-783b2f6a6f01

📥 Commits

Reviewing files that changed from the base of the PR and between 937d369 and 046db24.

📒 Files selected for processing (1)

• scripts/refresh-after-snapshot.sh

[omer-vishlitzky]

/lgtm
/approve

[omer-vishlitzky]

/lgtm
/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: omer-vishlitzky, ori-amizur

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [omer-vishlitzky]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[omer-vishlitzky]

/retest