Repository navigation
Revert "OSAC-2801: Add CaaS Netris full-install E2E workflow" - #166
Merged
Merged
Conversation
|
@eliorerz: This pull request references OSAC-2801 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
Contributor
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: eliorerz The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Contributor
WalkthroughThe PR adds a generic CaaS full-install E2E workflow with configurable inputs, change filtering, component image builds, and final status reporting. It removes the Netris-specific full-install workflow. ChangesCaaS full-install E2E
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant GitHub
participant changes
participant full_install
participant e2e
GitHub->>changes: Start workflow and evaluate changed paths
changes-->>full_install: Provide should-run result
full_install->>full_install: Build configured component images
full_install-->>e2e: Return install status
changes-->>e2e: Return filter status
e2e->>e2e: Report failure for failed or cancelled upstream jobs
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 11✅ Passed checks (11 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/e2e-caas-full-install.yml:
- Around line 81-108: The reusable workflow reference in the
e2e-caas-full-install job is unpinned; replace `@main` with the reviewed commit
SHA. Add cosign or Sigstore signing and verification for every image declared in
components, ensuring verification completes before deployment proceeds.
- Around line 81-108: Update the e2e-caas-full-install job to pin the reusable
workflow reference currently set to `@main` to a full commit SHA. Add SAST and SCA
checks to the workflow invocation or its supported inputs so they run for every
entry in the components list, covering all six configured component builds
without omitting either execution-environment build.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: bb597347-3480-4af9-a4c6-8929d68b0c14
📒 Files selected for processing (2)
.github/workflows/e2e-caas-full-install.yml.github/workflows/e2e-caas-netris-full-install.yml
💤 Files with no reviewable changes (1)
- .github/workflows/e2e-caas-netris-full-install.yml
Comment on lines
+81
to
+108
| e2e-caas-full-install: | ||
| needs: changes | ||
| if: needs.changes.outputs.should-run == 'true' | ||
| uses: osac-project/osac-test-infra/.github/workflows/e2e-caas-full-install.yml@main | ||
| with: | ||
| test-suite: ${{ inputs.test-suite || 'caas' }} | ||
| test-filter: ${{ inputs.test-filter || '' }} | ||
| # osac-installer now lives as a subdirectory of this same monorepo checkout | ||
| # (its Chart.yaml deps resolve fulfillment-service/osac-operator/osac-aap/BMF | ||
| # as ../../../<name> siblings within it), so a PR touching those components | ||
| # must deploy from this PR's own fork/ref, not the reusable workflow's | ||
| # standalone-repo default. | ||
| installer-repo: ${{ github.event.pull_request.head.repo.full_name || github.repository }} | ||
| installer-ref: ${{ github.event.pull_request.head.ref || github.ref_name }} | ||
| # Build all component images from the PR's fork/branch (same monorepo checkout). | ||
| # osac-aap's execution-environment is built twice (aap.bootstrap.image and | ||
| # aap.configAsCode.eeImage): the two are logically the same image but the | ||
| # override mechanism keys strictly off imageKey, one build per key, so this | ||
| # is the only way to get both fields covered without changing that mechanism | ||
| # (which lives in osac-test-infra, not here). See OSAC-3546. | ||
| components: '[{"repo":"${{ github.event.pull_request.head.repo.full_name || github.repository }}","ref":"${{ github.event.pull_request.head.ref || github.ref_name }}","containerfile":"fulfillment-service/Containerfile","context":".","imageKey":"service.images.service"},{"repo":"${{ github.event.pull_request.head.repo.full_name || github.repository }}","ref":"${{ github.event.pull_request.head.ref || github.ref_name }}","containerfile":"osac-operator/Containerfile","context":".","imageKey":"operator.image.repository"},{"repo":"${{ github.event.pull_request.head.repo.full_name || github.repository }}","ref":"${{ github.event.pull_request.head.ref || github.ref_name }}","containerfile":"osac-aap/execution-environment/execution-environment.yaml","imageKey":"aap.bootstrap.image","buildType":"ansible-builder"},{"repo":"${{ github.event.pull_request.head.repo.full_name || github.repository }}","ref":"${{ github.event.pull_request.head.ref || github.ref_name }}","containerfile":"osac-aap/execution-environment/execution-environment.yaml","imageKey":"aap.configAsCode.eeImage","buildType":"ansible-builder"},{"repo":"${{ github.event.pull_request.head.repo.full_name || github.repository }}","ref":"${{ github.event.pull_request.head.ref || github.ref_name }}","containerfile":"bare-metal-fulfillment-operator/Containerfile","context":".","imageKey":"bmf.image.repository"},{"repo":"${{ github.event.pull_request.head.repo.full_name || github.repository }}","ref":"${{ github.event.pull_request.head.ref || github.ref_name }}","containerfile":"osac-metering/metering-service/Containerfile","imageKey":"metering.image.repository"}]' | ||
| # Pass author_association for fork PR authorization (empty for non-fork PRs) | ||
| fork-pr-author-association: ${{ github.event.pull_request.head.repo.fork && github.event.pull_request.author_association || '' }} | ||
| fork-pr-author: ${{ github.event.pull_request.head.repo.fork && github.event.pull_request.user.login || '' }} | ||
| pr-number: ${{ github.event.pull_request.number }} | ||
| # Checkout osac-test-infra for tests/Containerfile (not the caller repo) | ||
| test-infra-repository: osac-project/osac-test-infra | ||
| test-infra-ref: ${{ inputs.test-infra-ref || 'main' }} |
Contributor
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
set -eu
url='https://raw.githubusercontent.com/osac-project/osac-test-infra/main/.github/workflows/e2e-caas-full-install.yml'
status=$(curl -L -sS -o /tmp/e2e-caas-full-install.yml -w '%{http_code}' "$url")
printf 'HTTP status: %s\n' "$status"
if [ "$status" = 200 ]; then
rg -n -i 'cosign|sigstore|sign|build-push|push|publish|registry' /tmp/e2e-caas-full-install.yml || true
sed -n '1,260p' /tmp/e2e-caas-full-install.yml
fiRepository: osac-project/osac
Length of output: 10598
🏁 Script executed:
set -eu
sed -n '250,700p' /tmp/e2e-caas-full-install.yml
printf '\nReferenced local actions:\n'
rg -n 'uses: \./|run:|buildah|podman|docker|push|publish|sign|cosign|sigstore' /tmp/e2e-caas-full-install.ymlRepository: osac-project/osac
Length of output: 24713
Security Misconfiguration (CWE-693)
Reachability: External · Exploitability: Moderate
Pin the reusable workflow and sign images. Replace @main with a reviewed commit SHA. Add Sigstore or cosign signing and verification for every component image before deployment.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/e2e-caas-full-install.yml around lines 81 - 108, The
reusable workflow reference in the e2e-caas-full-install job is unpinned;
replace `@main` with the reviewed commit SHA. Add cosign or Sigstore signing and
verification for every image declared in components, ensuring verification
completes before deployment proceeds.
Source: Path instructions
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
set -eu
printf '%s\n' '--- caller reference ---'
sed -n '81,108p' .github/workflows/e2e-caas-full-install.yml
printf '%s\n' '--- called workflow at main ---'
curl -fsSL --max-time 20 \
https://raw.githubusercontent.com/osac-project/osac-test-infra/main/.github/workflows/e2e-caas-full-install.yml |
sed -n '1,260p'
printf '%s\n' '--- called workflow refs and security steps ---'
curl -fsSL --max-time 20 \
https://raw.githubusercontent.com/osac-project/osac-test-infra/main/.github/workflows/e2e-caas-full-install.yml |
rg -n -i 'uses:|sast|sca|semgrep|codeql|trivy|grype|syft|snyk|dependenc|security|scan'Repository: osac-project/osac
Length of output: 14686
🏁 Script executed:
set -eu
tmp=$(mktemp)
curl -fsSL --max-time 20 \
https://raw.githubusercontent.com/osac-project/osac-test-infra/main/.github/workflows/e2e-caas-full-install.yml > "$tmp"
printf '%s\n' '--- component build path ---'
nl -ba "$tmp" | sed -n '250,520p'
printf '%s\n' '--- all build and scan-like commands ---'
rg -n -i 'build|containerfile|ansible-builder|docker|podman|buildah|sast|sca|semgrep|codeql|trivy|grype|syft|snyk|dependency|security|scan' "$tmp"
printf '%s\n' '--- referenced local action metadata ---'
for action in validate-and-bootstrap authorize-fork-pr fetch-and-write-secrets gather-artifacts; do
url="https://raw.githubusercontent.com/osac-project/osac-test-infra/main/.github/actions/$action/action.yml"
printf '\n### %s\n' "$action"
curl -fsSL --max-time 20 "$url" | rg -n -i 'run:|uses:|build|scan|sast|sca|semgrep|codeql|trivy|grype|syft|snyk|dependenc|security'
done
rm -f "$tmp"Repository: osac-project/osac
Length of output: 4815
Security Misconfiguration (CWE-693)
Reachability: External · Exploitability: Moderate
Add SAST and SCA checks for all component builds
The reusable workflow at @main builds the six configured components but has no SAST or SCA step. Pin it to a full commit SHA and add checks that cover every component build.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/e2e-caas-full-install.yml around lines 81 - 108, Update
the e2e-caas-full-install job to pin the reusable workflow reference currently
set to `@main` to a full commit SHA. Add SAST and SCA checks to the workflow
invocation or its supported inputs so they run for every entry in the components
list, covering all six configured component builds without omitting either
execution-environment build.
Source: Path instructions
1 of 3 tasks
eliorerz
added a commit
to eliorerz/osac
that referenced
this pull request
Aug 5, 2026
PR osac-project#110 (OSAC-2801) added this suite auto-triggered on every PR. It started failing on every PR (including unrelated ones) with 'gh: Resource not accessible by personal access token (HTTP 403)' when registering the ephemeral EC2 instance as a JIT GitHub Actions runner -- a separate, still-open token/permissions problem, not addressed here. PR osac-project#166 reverted it entirely rather than leave every PR red. Restores the original file (git show 4416ff2) with one substantive change: the changes job's should-run output now also requires github.run_attempt != '1' on pull_request events, so the suite is skipped (not run) on a PR's automatic first check run. schedule/ workflow_dispatch/merge_group are untouched -- always real runs. github.run_attempt is 1 for a workflow's original run and 2+ for each rerun. osac-test-infra's existing shared slash-command-handler.yml (unchanged) already finds an existing PR-triggered run for a given workflow at the PR's head SHA and reruns it on /test <workflow> -- that's exactly attempt 2+. Keeping on: pull_request means there's always a run to find and rerun. No new mechanism, no shared-code changes, no effect on e2e-bmaas/e2e-vmaas/e2e-caas-full-install's own /test commands.
eliorerz
pushed a commit
that referenced
this pull request
Sep 18, 2026
…tion OSAC-4327: Storage review section and VM detail tier display
This branch had an error being deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Netris Job is still not stable and blocking PRs reverting #110
Summary by CodeRabbit