[eliorerz]

Summary

• Add inputs to the e2e-vmaas-full-install reusable workflow for building a component image from source
• The image is built with podman on the self-hosted runner and loaded directly onto the cluster node via podman save | ssh sudo podman load
• No registry push needed — CRI-O and root podman share storage on RHCOS

New inputs

Input	Description
component-repo	GitHub repo to build (e.g. osac-project/fulfillment-service)
component-ref	Git ref to build
component-image-key	Helm value path (e.g. service.images.service)
component-containerfile	Path to Containerfile (default: Containerfile)

How component repos use it

jobs:
  e2e-full-install:
    uses: osac-project/osac-test-infra/.github/workflows/e2e-vmaas-full-install.yml@main
    with:
      component-repo: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
      component-ref: ${{ github.event.pull_request.head.ref || github.ref_name }}
      component-image-key: service.images.service

Test plan

• Merge this PR
• Create caller workflows in fulfillment-service (OSAC-1679), osac-operator (OSAC-1680), osac-aap (OSAC-1681)
• Verify PR-triggered e2e tests build and deploy the PR's component image

Summary by CodeRabbit

• New Features
  • E2E installation workflows can now build a component image from a specified repository and reference.
  • Added support for overriding the deployed image through Helm values, including automatic merging of the built image into deployment settings.
  • New workflow inputs let you customize the component source, image mapping key, and container build file.

[openshift-ci-robot]

@eliorerz: This pull request references OSAC-1675 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

• Add inputs to the e2e-vmaas-full-install reusable workflow for building a component image from source
• The image is built with podman on the self-hosted runner and loaded directly onto the cluster node via podman save | ssh sudo podman load
• No registry push needed — CRI-O and root podman share storage on RHCOS

New inputs

Input	Description
component-repo	GitHub repo to build (e.g. osac-project/fulfillment-service)
component-ref	Git ref to build
component-image-key	Helm value path (e.g. service.images.service)
component-containerfile	Path to Containerfile (default: Containerfile)

How component repos use it

jobs:
 e2e-full-install:
   uses: osac-project/osac-test-infra/.github/workflows/e2e-vmaas-full-install.yml@main
   with:
     component-repo: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
     component-ref: ${{ github.event.pull_request.head.ref || github.ref_name }}
     component-image-key: service.images.service

Test plan

• Merge this PR
• Create caller workflows in fulfillment-service (OSAC-1679), osac-operator (OSAC-1680), osac-aap (OSAC-1681)
• Verify PR-triggered e2e tests build and deploy the PR's component image

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: eliorerz

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [eliorerz]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Warning

Review limit reached

@eliorerz, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 12 minutes and 41 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: 75693b68-6f4a-4b12-b1da-886e8465d588

📥 Commits

Reviewing files that changed from the base of the PR and between be9e801 and 57eb338.

📒 Files selected for processing (2)

• .github/scripts/teardown.sh
• .github/workflows/e2e-vmaas-full-install.yml

Walkthrough

The e2e-vmaas-full-install.yml reusable workflow gains four new workflow_call inputs for an optional component source repo, ref, Helm value key, and Containerfile path. A new conditional step clones, builds, and loads that component image onto a cluster node via SSH. The Install OSAC step then merges the built image into existing Helm image overrides before deployment.

Changes

Component image build and Helm override injection

Layer / File(s)	Summary
New workflow_call inputs .github/workflows/e2e-vmaas-full-install.yml	Adds component-repo, component-ref, component-image-key, and component-containerfile (default Containerfile) inputs to the workflow_call trigger.
Conditional component image build and cluster load .github/workflows/e2e-vmaas-full-install.yml	New step clones the component repo at the given ref, builds a tagged image (component-pr:$GITHUB_RUN_ID), finds a node internal IP, loads the image via podman save | ssh … sudo podman load, exports COMPONENT_IMAGE, and removes cloned sources.
Helm image override merge in Install OSAC .github/workflows/e2e-vmaas-full-install.yml	Adds COMPONENT_IMAGE_KEY to step env, constructs MERGED_OVERRIDES from IMAGE_OVERRIDES, conditionally injects COMPONENT_IMAGE under COMPONENT_IMAGE_KEY, and iterates MERGED_OVERRIDES for all helm upgrade --set arguments.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• osac-project/osac-test-infra#84: Also modifies how image-overrides are accepted and applied during OSAC Helm deployment in a related reusable workflow.

Suggested reviewers

• akshaynadkarni
• adriengentil

Poem

A component repo, a ref, a key—
Clone it, build it, ship it away! 🚢
SSH tunnels carry the load,
Podman saves walk the cluster road.
Helm merges all, the overrides blend,
E2E tests run — mission: append! 🎯

---

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

• Ignore

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
No-Sensitive-Data-In-Logs	❌ Error	The workflow logs the cluster node InternalIP and every Helm override value (echo ... ${NODE_IP} and echo "--set ${key}=${value}"), which can leak internal infra and caller data.	Stop printing raw node addresses and override values; redact or remove those echoes, and only log fixed messages or sanitized identifiers.

✅ Passed checks (10 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: adding component image build support to the e2e full install workflow.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No-Hardcoded-Secrets	✅ Passed	No hardcoded secrets found: only Vault secret references, file paths, and public URLs; no literal keys/tokens/passwords/private keys or credential URLs were added.
No-Weak-Crypto	✅ Passed	Reviewed the changed workflow; it only uses podman, ssh, jq, helm, and shell logic—no MD5/SHA1/DES/RC4/ECB, custom crypto, or secret compares.
No-Injection-Vectors	✅ Passed	No direct injection sinks found; new workflow inputs are quoted or passed via jq --arg/arrays, with no eval, shell=True, or unsafe deserialization.
Container-Privileges	✅ Passed	No privileged container/K8s settings were added; the workflow only uses shell sudo/podman commands, and no privileged/host* /SYS_ADMIN /allowPrivilegeEscalation fields appear.
Ai-Attribution	✅ Passed	No AI-tool use is mentioned in the PR or commit, and the commit has no Assisted-by/Generated-by/Co-Authored-By trailer.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 4

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/e2e-vmaas-full-install.yml:
- Around line 301-324: The component image created in this workflow is only
removed from the runner source directory, so `component-pr:${GITHUB_RUN_ID}`
will accumulate on both the self-hosted runner and the cluster node across runs.
Update the image build/load flow around `COMPONENT_TAG`, `podman build`, and
`podman save | ssh ... sudo podman load` to ensure the tag is passed into
teardown, then explicitly remove the image from the remote node and clean up the
local image on the runner after tests complete.
- Around line 67-86: The component input set in the workflow should be treated
as all-or-none, since `component-repo` can currently trigger the build while
`component-ref` and `component-image-key` remain empty. Update the input
validation and build path in the workflow sections around the component inputs
so that the job only proceeds when all component-related inputs are provided
together, and otherwise skips or fails fast with a clear message. Apply the same
guard consistently wherever the component build logic is defined, including the
other referenced workflow blocks, using the existing `component-repo`,
`component-ref`, `component-image-key`, and `component-containerfile` inputs as
the control points.
- Around line 292-309: The “Build and load component image” step in the workflow
currently clones and builds a caller-supplied COMPONENT_REPO without any trust
gate, which is unsafe on the self-hosted runner. Add an allowlist or equivalent
validation before the git clone/podman build path, and fail early unless
COMPONENT_REPO matches an approved source; keep the check close to the existing
COMPONENT_REPO/COMPONENT_REF environment setup so it is easy to audit. Ensure
this guard applies before any PR-controlled source is fetched or built,
especially for PR-triggered runs.
- Around line 303-305: The component checkout in the workflow currently uses the
clone-and-branch flow, which only works for branch/tag names and not arbitrary
Git refs like SHAs or refs/pull/*; update the component source setup to fetch
the requested ref and perform a detached checkout instead. Keep the logic around
COMPONENT_REPO and COMPONENT_REF, but replace the git clone --branch usage in
the component-src preparation step so it can resolve any documented ref, or
otherwise tighten the input contract to match the current behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: 06fa4eb0-1047-425d-ac5e-8cf6b7db9208

📥 Commits

Reviewing files that changed from the base of the PR and between 3d32867 and be9e801.

📒 Files selected for processing (1)

• .github/workflows/e2e-vmaas-full-install.yml