OSAC-1733: Split e2e-full-install.yml into 3 independently-runnable workflows by eliorerz · Pull Request #14 · osac-project/osac

eliorerz · 2026-07-31T01:19:01Z

Summary

Splits e2e testing into three separate workflow files -- e2e-bmaas-full-install.yml, e2e-vmaas-full-install.yml, and a new e2e-caas-full-install.yml -- instead of one merged file with multiple jobs. Separate files can be independently re-triggered/re-run in the GitHub Actions UI, which matters because each e2e run reprovisions a whole cluster: with jobs sharing one file there's no way to retest just one failed suite without also re-running the others.

Added the twice-daily schedule: cron: '0 */12 * * *' trigger to all three files (previously only VMaaS had it).
Added the new e2e-caas-full-install.yml, calling osac-project/osac-test-infra/.github/workflows/e2e-caas-full-install.yml@main. CaaS-specific inputs (cluster-template, caas-domain, flavor-image/flavor-name, namespace, installer-repo/installer-ref, etc.) are left at the reusable workflow's own defaults since none are required.
Switched all three callers from the old component-repo/component-ref/component-containerfile/component-image-key/component2-* inputs to the new components JSON-array input shape.
Updated scan-workflow-logs.yml's workflow_run.workflows list to the three workflow names.

This PR depends on osac-project/osac-test-infra#283 merging first (adds the components input this PR uses) -- do not merge before that lands.

Test plan

osac-test-infra#283 merges, adding the components input to the reusable e2e workflows
YAML syntax validated (yaml.safe_load) for all four touched/new files
CI runs green for all three e2e workflows on this PR

Summary by CodeRabbit

Tests
- Added automated end-to-end coverage for full CaaS installations across pull requests, merge queues, scheduled runs, and manual launches.
- Improved full-install testing for BMaaS and VMaaS by consolidating component configuration.
- Added clearer workflow status reporting so failed or cancelled test runs are surfaced reliably.
Chores
- Expanded automated log monitoring to include CaaS full-install test results.

…orkflows

coderabbitai · 2026-07-31T01:19:10Z

Walkthrough

Full-install E2E workflows now use consolidated component JSON inputs. A new CaaS workflow adds scheduled, pull request, merge queue, and manual execution, change filtering, status propagation, and workflow-log scan integration.

Changes

Full-install E2E workflows

Layer / File(s)	Summary
Consolidated component inputs `.github/workflows/e2e-bmaas-full-install.yml`, `.github/workflows/e2e-vmaas-full-install.yml`	BMaaS and VMaaS calls pass both component image definitions through a single `components` JSON input, and BMaaS gains a twice-daily schedule.
CaaS workflow orchestration `.github/workflows/e2e-caas-full-install.yml`, `.github/workflows/scan-workflow-logs.yml`	The new CaaS workflow adds multiple triggers, path filtering, reusable full-install execution, aggregate status handling, and log-scan triggering.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant PullRequest
  participant ChangesJob
  participant ReusableE2EWorkflow
  participant E2EStatusJob
  participant ScanWorkflowLogs
  PullRequest->>ChangesJob: evaluate changed paths
  ChangesJob->>ReusableE2EWorkflow: run when code changes
  ReusableE2EWorkflow->>E2EStatusJob: return execution result
  E2EStatusJob->>PullRequest: report aggregate status
  ReusableE2EWorkflow->>ScanWorkflowLogs: trigger workflow_run log scanning

🚥 Pre-merge checks | ✅ 10 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Ai-Attribution	⚠️ Warning	PR mentions AI-generated content and CodeRabbit, but commit `22dc9a2` has no Assisted-by or Generated-by trailer; no Co-Authored-By trailer was found.	Add a Red Hat-approved Assisted-by or Generated-by trailer to the AI-assisted commit, and do not use Co-Authored-By for the AI tool.

✅ Passed checks (10 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary change: splitting the end-to-end installation workflow into three independently runnable workflows.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No-Hardcoded-Secrets	✅ Passed	PR-added workflow lines contain no API keys, tokens, passwords, private keys, embedded credentials, or blob literals; secret references use GitHub expressions/Vault paths only.
No-Weak-Crypto	✅ Passed	The four changed workflow files add only GitHub Actions/YAML wiring; no MD5, SHA1, DES/3DES, RC4, Blowfish, ECB, custom crypto, or secret/token comparisons were introduced.
No-Injection-Vectors	✅ Passed	Diff scan found no SQL concatenation, shell=True, eval/exec, pickle.loads, unsafe yaml.load, os.system, or dangerouslySetInnerHTML; new run blocks only echo bounded job results.
Container-Privileges	✅ Passed	The PR adds no privileged, hostPID/hostNetwork/hostIPC, SYS_ADMIN, allowPrivilegeEscalation, or root-execution settings; existing manifests use non-root and escalation-disabled contexts.
No-Sensitive-Data-In-Logs	✅ Passed	Added logging only reports upstream job states; component metadata is passed as inputs, not echoed. Existing scanner masks secret IDs and comments only sanitized rule/file/line findings.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

eliorerz · 2026-07-31T01:52:13Z

@coderabbitai review

coderabbitai · 2026-07-31T01:52:20Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

eliorerz · 2026-07-31T01:54:14Z

/ok-to-test

github-actions · 2026-07-31T01:54:31Z

Labeled ok-to-test. No pending or failed runs found for 22dc9a2 — tests will be authorized on next trigger.

eliorerz · 2026-07-31T01:54:46Z

/test all

coderabbitai

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/e2e-caas-full-install.yml:
- Around line 60-63: Add a pinned SAST/SCA security gate to the
e2e-caas-full-install workflow, alongside the e2e-caas-full-install job, so PR
code is scanned for source and dependency vulnerabilities. Configure the
security step to fail the pipeline when findings are detected, and pin the
referenced workflow or action to an immutable version or commit.
- Line 63: Update the reusable workflow reference in the e2e-caas-full-install
workflow from the mutable `@main` ref to the reviewed full commit SHA that
supports the required components contract. Keep the existing workflow path and
invocation unchanged.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 2bd4b55d-1dad-4881-9bda-d16de287b1cf

📥 Commits

Reviewing files that changed from the base of the PR and between c4805ed and 22dc9a2.

📒 Files selected for processing (4)

.github/workflows/e2e-bmaas-full-install.yml
.github/workflows/e2e-caas-full-install.yml
.github/workflows/e2e-vmaas-full-install.yml
.github/workflows/scan-workflow-logs.yml

github-actions · 2026-07-31T01:55:05Z

Triggered: pre-commit, E2E BMaaS Full Install, E2E VMaaS Full Install, E2E CaaS Full Install

eliorerz · 2026-07-31T01:57:22Z

Reviewed both actionable findings from the fresh @coderabbitai review pass against the current file content (not just the diff hunk):

"Add a pinned SAST/SCA security gate" (e2e-caas-full-install.yml): verified there is no SAST/SCA/CodeQL/dependency-scanning workflow anywhere in this repo today — checked all 15 files under .github/workflows/. This is a pre-existing repo-wide gap that predates this PR (the original single e2e-full-install.yml didn't have one either, and its sibling e2e-bmaas-full-install.yml / e2e-vmaas-full-install.yml still don't). Adding a security-scanning gate is out of scope for a pure workflow-split PR; if adopted it should land uniformly across all three files as its own change, not asymmetrically in just the new caas file.
"Pin the reusable workflow to a full commit SHA" (line 63, @main): verified @main is the pre-existing convention, not something this PR introduces — both e2e-bmaas-full-install.yml and e2e-vmaas-full-install.yml already called their reusable workflow via @main before this split (see commit c4805ed). The new caas file just follows the same established pattern for consistency with its two siblings. Changing only the new file to SHA-pin would create inconsistency across the three otherwise-identical callers; if this hardening is wanted, it should be applied uniformly to all three in a separate, deliberate change.

No code changes made — both findings are valid general suggestions but out of scope for this PR's purpose (splitting one workflow into three independently-runnable ones).

coderabbitai · 2026-07-31T01:57:38Z

Tip

For best results, initiate chat on the files or code changes.

@eliorerz Agreed. Both findings identify worthwhile repository-wide hardening opportunities, but neither is a regression introduced by this workflow-split PR:

SAST/SCA should be designed and applied consistently across the repository rather than added only to the new CaaS workflow.
SHA pinning should likewise be a deliberate, uniform migration for all reusable-workflow callers rather than an exception in one sibling workflow.

I’m withdrawing both findings for this PR. If you’d like, I can open a follow-up issue to track the cross-repository hardening work.

✏️ Learnings added

Learnt from: eliorerz
URL: https://github.com/osac-project/osac/pull/14

Timestamp: 2026-07-31T01:57:36.842Z
Learning: In the `.github/workflows` E2E full-install workflow family, reusable workflows are intentionally referenced with `main` as an existing convention; changing this to immutable commit-SHA pinning should be performed uniformly across all sibling callers in a dedicated hardening change, not as an isolated change to one workflow-split PR.

Learnt from: eliorerz
URL: https://github.com/osac-project/osac/pull/14

Timestamp: 2026-07-31T01:57:36.842Z
Learning: The `osac` repository currently has no SAST, SCA, CodeQL, or dependency-scanning workflow. Introducing security scanning is repository-wide cross-cutting work and should be implemented consistently across the E2E workflow family in a separate change, rather than required from an individual workflow-split PR.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.

_{You are interacting with an AI system.}

eliorerz · 2026-07-31T02:07:41Z

/test all

github-actions · 2026-07-31T02:07:58Z

Triggered: pre-commit, E2E BMaaS Full Install, E2E VMaaS Full Install, E2E CaaS Full Install

eliorerz · 2026-07-31T02:12:03Z

@coderabbitai Re-verified both findings against the current file content directly (not just the diff):

Pinned SAST/SCA security gate — no SAST/SCA/CodeQL/dependency-scanning workflow exists anywhere in this repo today (checked all workflow files under .github/workflows/). This predates this PR — the original single e2e-full-install.yml never had one, and its siblings e2e-bmaas-full-install.yml/e2e-vmaas-full-install.yml still don't. Out of scope for a pure workflow-split PR; if adopted, it belongs in its own PR applied uniformly across all three files, not asymmetrically in just caas.
Pin the osac-test-infra reference from @main to a commit SHA — @main is the pre-existing convention here, not something this PR introduces. Both e2e-bmaas-full-install.yml and e2e-vmaas-full-install.yml already referenced their reusable workflow via @main before this split existed (commit c4805ed). The new caas file just matches its two siblings. Pinning only the new file would make the trio inconsistent — a separate, deliberate hardening change if wanted, applied to all three at once.

Not making code changes for either — both are out of scope for this PR's actual purpose (splitting one caller workflow into three independently-runnable ones).

coderabbitai · 2026-07-31T02:12:15Z

Tip

For best results, initiate chat on the files or code changes.

@eliorerz Confirmed. Both items are pre-existing, repository-wide hardening work. They are not regressions from this workflow split.

The findings remain withdrawn for this PR. A future hardening PR can apply each change consistently across all E2E workflow callers.

_{You are interacting with an AI system.}

* WIP adds an architecture section * Apply suggestions from code review * minor improvements from review * more consistent capitalization * adds expanded descriptions of fulfillment components * adds content based on review feedback * replaces "cloudkit" with "O-SAC" --------- Co-authored-by: Lars Kellogg-Stedman <lars@oddbit.com> Co-authored-by: Orran Krieger <okrieg@bu.edu>

OSAC-1733: Split e2e-full-install.yml into 3 independently-runnable w…

22dc9a2

…orkflows

eliorerz mentioned this pull request Jul 31, 2026

OSAC-1733: Merge e2e-bmaas/vmaas caller workflows into one file #10

Closed

github-actions Bot added the ok-to-test label Jul 31, 2026

coderabbitai Bot requested changes Jul 31, 2026

View reviewed changes

Comment thread .github/workflows/e2e-caas-full-install.yml

Comment thread .github/workflows/e2e-caas-full-install.yml

eliorerz had a problem deploying to e2e-test July 31, 2026 01:55 — with GitHub Actions Failure

eliorerz temporarily deployed to e2e-test July 31, 2026 02:08 — with GitHub Actions Inactive

coderabbitai Bot approved these changes Jul 31, 2026

View reviewed changes

eliorerz mentioned this pull request Jul 31, 2026

NO-ISSUE: Pin osac-test-infra refs and add SAST/SCA gates #16

Merged

2 tasks

eliorerz merged commit 5e18ee6 into osac-project:main Jul 31, 2026
16 of 22 checks passed

eliorerz deleted the split-e2e-workflows-with-schedules branch July 31, 2026 03:14

This was referenced Jul 31, 2026

OSAC-3491: Consolidate osac-aap's .github/ into osac mono-repo root #32

Merged

OSAC-3505: Track osac-test-infra's main instead of pinning a SHA #53

Merged

OSAC-3519: Add bare-metal-fulfillment-operator to e2e-vmaas/e2e-caas components arrays #55

Merged

This was referenced Aug 9, 2026

OSAC-3734: rename E2E gate jobs for merge queue compatibility #222

Merged

OSAC-3289: add osac-csi-driver to E2E component builds #219

Merged

Conversation

eliorerz commented Jul 31, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

❌ Failed checks (1 warning)

Uh oh!

eliorerz commented Jul 31, 2026

Uh oh!

coderabbitai Bot commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

eliorerz commented Jul 31, 2026

Uh oh!

github-actions Bot commented Jul 31, 2026

Uh oh!

eliorerz commented Jul 31, 2026

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jul 31, 2026

Uh oh!

eliorerz commented Jul 31, 2026

Uh oh!

coderabbitai Bot commented Jul 31, 2026

Uh oh!

eliorerz commented Jul 31, 2026

Uh oh!

github-actions Bot commented Jul 31, 2026

Uh oh!

eliorerz commented Jul 31, 2026

Uh oh!

coderabbitai Bot commented Jul 31, 2026

Uh oh!

Uh oh!

This branch was previously deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

eliorerz commented Jul 31, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 31, 2026 •

edited

Loading

coderabbitai Bot commented Jul 31, 2026 •

edited

Loading