Repository navigation
OSAC-2801: Add CaaS Netris full-install E2E workflow - #110
Conversation
|
@danmanor: This pull request references OSAC-2801 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: danmanor The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughAdds a GitHub Actions workflow for scheduled, pull-request, merge-group, and manual Netris CaaS full-install E2E tests. It filters pull-request paths, invokes reusable test infrastructure with build overrides, and reports failed or cancelled jobs. The previous full-install workflow is removed. ChangesNetris CaaS E2E testing
Estimated code review effort: 2 (Simple) | ~10 minutes Sequence Diagram(s)sequenceDiagram
participant GitHub
participant ChangeDetection
participant NetrisE2E
participant TestInfrastructure
participant Status
GitHub->>ChangeDetection: Start workflow and evaluate changed paths
ChangeDetection->>NetrisE2E: Permit or skip E2E execution
NetrisE2E->>TestInfrastructure: Invoke Netris full-install tests
TestInfrastructure-->>NetrisE2E: Return job result
NetrisE2E->>Status: Report execution result
Status-->>GitHub: Fail on failure or cancellation
Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 10 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (10 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/e2e-caas-netris-full-install.yml:
- Around line 53-63: Add pinned SAST and SCA security-gate jobs to the workflow
and include both in the needs list for e2e-caas-netris-full-install so
provisioning cannot start before they pass. If the referenced reusable workflow
builds or publishes artifacts, add Sigstore/cosign signing and verification
gates before deployment, using pinned action or tool versions.
- Around line 18-21: Update the reusable workflow call in
e2e-caas-netris-full-install.yml to forward the test-infra-ref input under with,
using the provided input with main as its fallback so manual dispatch overrides
reach the downstream workflow.
- Line 56: Update the reusable workflow reference in the workflow’s uses
declaration to replace the mutable `@main` ref with the reviewed, immutable full
commit SHA for osac-test-infra. Preserve the existing reusable workflow path and
all surrounding configuration.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: e84b746b-fbfa-41b2-9246-707f8a2fae27
📒 Files selected for processing (1)
.github/workflows/e2e-caas-netris-full-install.yml
| test-infra-ref: | ||
| description: "Branch/ref of osac-test-infra" | ||
| required: false | ||
| default: "main" |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Files:"
git ls-files .github/workflows | sed -n '1,200p'
echo
echo "Target file relevant sections:"
if [ -f .github/workflows/e2e-caas-netris-full-install.yml ]; then
wc -l .github/workflows/e2e-caas-netris-full-install.yml
sed -n '1,140p' .github/workflows/e2e-caas-netris-full-install.yml | cat -n
else
echo "missing target"
fi
echo
echo "Search reusable usages of this workflow and test-infra-ref:"
rg -n "e2e-caas-netris-full-install|test-infra-ref|on:\|inputs:" .github/workflows || trueRepository: osac-project/osac
Length of output: 6134
Forward test-infra-ref to the reusable workflow.
e2e-caas-netris-full-install.yml accepts test-infra-ref via workflow_dispatch, but the reusable workflow call only forwards osac-repo, osac-branch, and image overrides. Add test-infra-ref: ${{ inputs.test-infra-ref || 'main' }} under with so manual dispatch can override the test-infrastructure ref.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/e2e-caas-netris-full-install.yml around lines 18 - 21,
Update the reusable workflow call in e2e-caas-netris-full-install.yml to forward
the test-infra-ref input under with, using the provided input with main as its
fallback so manual dispatch overrides reach the downstream workflow.
| e2e-caas-netris-full-install: | ||
| needs: changes | ||
| if: needs.changes.outputs.should-run == 'true' | ||
| uses: osac-project/osac-test-infra/.github/workflows/e2e-caas-netris-full-install.yml@main | ||
| with: | ||
| osac-repo: ${{ github.event.pull_request.head.repo.clone_url || format('https://github.com/{0}.git', github.repository) }} | ||
| osac-branch: ${{ github.event.pull_request.head.ref || github.ref_name }} | ||
| osac-operator-image: '' | ||
| fulfillment-service-image: '' | ||
| osac-aap-ee-image: '' | ||
|
|
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
Add required supply-chain security gates before E2E provisioning.
The workflow has no visible SAST/SCA job before it provisions infrastructure from a PR ref. Add pinned SAST and SCA jobs, and make e2e-caas-netris-full-install depend on them. If the reusable workflow builds or publishes images or artifacts, require Sigstore/cosign signing and verification before deployment.
As per path instructions, “SAST/SCA steps in pipeline” and “Sign artifacts with Sigstore/cosign” are required.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/e2e-caas-netris-full-install.yml around lines 53 - 63, Add
pinned SAST and SCA security-gate jobs to the workflow and include both in the
needs list for e2e-caas-netris-full-install so provisioning cannot start before
they pass. If the referenced reusable workflow builds or publishes artifacts,
add Sigstore/cosign signing and verification gates before deployment, using
pinned action or tool versions.
Source: Path instructions
| e2e-caas-netris-full-install: | ||
| needs: changes | ||
| if: needs.changes.outputs.should-run == 'true' | ||
| uses: osac-project/osac-test-infra/.github/workflows/e2e-caas-netris-full-install.yml@main |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow snippet =="
if [ -f .github/workflows/e2e-caas-netris-full-install.yml ]; then
nl -ba .github/workflows/e2e-caas-netris-full-install.yml | sed -n '45,65p'
else
echo "workflow file not found"
fi
echo
echo "== all reusable workflow/action pins in .github/workflows =="
rg -n "uses:\s*[^#]*(?:`@tags`|[A-Za-z0-9_/-]+/.github/workflows/[^[:space:]@]+@|/actions/.*@)" .github/workflows || true
echo
echo "== ref resolution probe for referenced reusable workflow pin =="
python3 - <<'PY'
from urllib.request import urlopen
import json
url = "https://api.github.com/repos/osac-project/osac-test-infra/git/ref/heads/main"
try:
with urlopen(url, timeout=15) as r:
data = json.load(r)
print("status={}".format(r.status))
print("ref={}".format(data.get("ref")))
print("type={}".format(data.get("object", {}).get("type")))
print("sha={}".format(data.get("object", {}).get("sha")))
except Exception as e:
print(type(e).__name__ + ": " + str(e))
PYRepository: osac-project/osac
Length of output: 218
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== file exists =="
if [ -f .github/workflows/e2e-caas-netris-full-install.yml ]; then
echo "yes"
else
echo "no"
fi
echo
echo "== workflow snippet =="
if [ -f .github/workflows/e2e-caas-netris-full-install.yml ]; then
awk 'NR>=45 && NR<=65 { printf "%6d\t%s\n", NR, $0 }' .github/workflows/e2e-caas-netris-full-install.yml
fi
echo
echo "== GitHub API ref probe =="
python3 - <<'PY'
from urllib.request import urlopen, Request
import json
url = "https://api.github.com/repos/osac-project/osac-test-infra/git/ref/heads/main"
req = Request(url, headers={"Accept": "application/vnd.github+json", "User-Agent": "review-verify"})
try:
with urlopen(req, timeout=20) as r:
data = json.load(r)
print("status={}".format(r.status))
print("ref={}".format(data.get("ref")))
print("object_type={}".format(data.get("object", {}).get("type")))
print("sha={}".format(data.get("object", {}).get("sha")))
except Exception as e:
print("{}: {}".format(type(e).__name__, e))
PYRepository: osac-project/osac
Length of output: 1466
Pin the reusable workflow to an immutable commit SHA.
This step references osac-project/osac-test-infra/.github/workflows/e2e-caas-netris-full-install.yml@main. Since @main is a mutable branch, update this workflow to use a reviewed full commit SHA for that workflow.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/e2e-caas-netris-full-install.yml at line 56, Update the
reusable workflow reference in the workflow’s uses declaration to replace the
mutable `@main` ref with the reviewed, immutable full commit SHA for
osac-test-infra. Preserve the existing reusable workflow path and all
surrounding configuration.
Source: Path instructions
de56ed6 to
7ac1edb
Compare
7ac1edb to
01a92fe
Compare
|
/hold |
openshift-ci
Bot
added
the
do-not-merge/hold
danmanor
changed the title
01a92fe to
474fe22
Compare
474fe22 to
1c4fd1d
Compare
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
4928ed2 to
1806403
Compare
Adds a presubmit + periodic E2E workflow that provisions an ephemeral EC2 c5n.metal box, deploys the full Netris Spectrum-X simulated lab, restores OCP SNO from snapshot, installs OSAC via Helm, and runs the CaaS test suite. Calls osac-test-infra's e2e-caas-netris-full-install reusable workflow, passing osac-repo/osac-branch so the Netris lab clones and builds from the PR's fork/branch. Triggers: pull_request, merge_group, schedule (10x/day at :53), workflow_dispatch. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1806403 to
4416ff2
Compare
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
fulfillment-service and osac-operator Containerfiles reference go.work from the mono-repo root, so the build context must be "." (repo root), not the containerfile's parent directory. Matches the vmaas/bmaas workflow components configuration. Assisted-by: Claude Code <noreply@anthropic.com> Signed-off-by: Dan Manor <dmanor@redhat.com>
Skip the gate job entirely when docs-only PRs legitimately skip the e2e job via the changes filter, instead of running and passing vacuously. Assisted-by: Claude Code <noreply@anthropic.com> Signed-off-by: Dan Manor <dmanor@redhat.com>
osac-project/osac#110 replaced e2e-caas-full-install.yml with e2e-caas-netris-full-install.yml, so the "e2e-caas-full-install / e2e" required check will never report again -- blocking every future PR on osac's branch protection forever. Point the required check at the new workflow's gating job instead. Signed-off-by: Elior Erez <eerez@redhat.com>
PR osac-project#110 (OSAC-2801) added this suite auto-triggered on every PR. It started failing on every PR (including unrelated ones) with 'gh: Resource not accessible by personal access token (HTTP 403)' when registering the ephemeral EC2 instance as a JIT GitHub Actions runner -- a separate, still-open token/permissions problem, not addressed here. PR osac-project#166 reverted it entirely rather than leave every PR red. Restores the original file (git show 4416ff2) with one substantive change: the changes job's should-run output now also requires github.run_attempt != '1' on pull_request events, so the suite is skipped (not run) on a PR's automatic first check run. schedule/ workflow_dispatch/merge_group are untouched -- always real runs. github.run_attempt is 1 for a workflow's original run and 2+ for each rerun. osac-test-infra's existing shared slash-command-handler.yml (unchanged) already finds an existing PR-triggered run for a given workflow at the PR's head SHA and reruns it on /test <workflow> -- that's exactly attempt 2+. Keeping on: pull_request means there's always a run to find and rerun. No new mechanism, no shared-code changes, no effect on e2e-bmaas/e2e-vmaas/e2e-caas-full-install's own /test commands.
…SAC-3233 OSAC-3233: add organization scope to OIDC login flow
This branch was previously deployed
2 participants
Summary
e2e-caas-full-install.yml(IBM fleet runner) withe2e-caas-netris-full-install.yml(Netris Spectrum-X simulated lab on EC2 c5n.metal)osac-repo/osac-branchTriggers:
pull_request(with path filter),merge_group,schedule(daily at 06:53 UTC),workflow_dispatchDepends on: osac-project/osac-test-infra#303 (components build support for Netris workflow)
Test plan
componentsinput format matches the reusable workflow interface🤖 Generated with Claude Code
Summary by CodeRabbit