Repository navigation
Add build workflow for metering-test-adapter image - #171
Merged
omer-vishlitzky merged 1 commit intoAug 6, 2026
Merged
omer-vishlitzky merged 1 commit into
omer-vishlitzky merged 1 commit into
Conversation
The metering-test-adapter Containerfile, source code, and Helm chart integration all exist, but no CI workflow builds and publishes the container image. This causes every VMaaS E2E run to fail at "Install OSAC" with ImagePullBackOff on ghcr.io/osac-project/metering-test-adapter:latest (403 Forbidden). - Add build-metering-test-adapter-image.yaml mirroring the existing metering-service build workflow but targeting Containerfile.test-adapter - Add the test-adapter to the E2E VMaaS components array so PR builds also build and load it onto the test cluster Assisted-by: Claude Code <noreply@anthropic.com> Signed-off-by: omer-vishlitzky <omer.vishlitzky@gmail.com>
Contributor
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: omer-vishlitzky The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
omer-vishlitzky
temporarily deployed
to
e2e-test
August 6, 2026 02:07 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
omer-vishlitzky
temporarily deployed
to
e2e-test
August 6, 2026 02:07 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
omer-vishlitzky
temporarily deployed
to
e2e-test
August 6, 2026 02:07 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
Contributor
WalkthroughThe PR adds a GitHub Actions workflow to build and conditionally publish the metering test-adapter image. It also adds this image to the VMaaS full-install component build list. ChangesMetering test-adapter image
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant GitHubActions
participant DockerMetadata
participant GHCR
GitHubActions->>DockerMetadata: Generate image tags and version metadata
DockerMetadata-->>GitHubActions: Return Docker metadata
GitHubActions->>GHCR: Push the built image for eligible events
Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 11✅ Passed checks (11 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/build-metering-test-adapter-image.yaml:
- Around line 70-77: Update the publishing job containing the “Build and push
Docker image” step to grant `id-token: write` in its permissions, limited to
that job. Expose the build digest via the action step’s `id` and add a
subsequent step that runs only when `push` is enabled, signing
`steps.build.outputs.digest` with the repository’s established Sigstore/cosign
tooling.
- Around line 31-32: Update the “Checkout repository” step using
actions/checkout@v7 to set persist-credentials to false in its with
configuration, while leaving the existing checkout behavior unchanged.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 851938dc-918a-4940-92db-6c855db502d7
📒 Files selected for processing (2)
.github/workflows/build-metering-test-adapter-image.yaml.github/workflows/e2e-vmaas-full-install.yml
Comment on lines
+31
to
+32
| - name: Checkout repository | ||
| uses: actions/checkout@v7 |
Contributor
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
file=".github/workflows/build-metering-test-adapter-image.yaml"
echo "== file exists =="
test -f "$file" && echo yes || echo no
echo "== workflow excerpts =="
if test -f "$file"; then
nl -ba "$file" | sed -n '1,220p'
fi
echo "== checkout occurrences in workflow =="
rg -n "actions/checkout|persist-credentials|GITHUB_TOKEN|docker login|podman login|GHCR|ghcr|registry" "$file" || trueRepository: osac-project/osac
Length of output: 242
🏁 Script executed:
#!/bin/bash
set -euo pipefail
file=".github/workflows/build-metering-test-adapter-image.yaml"
echo "== workflow excerpts =="
awk '{printf "%6u %s\n", NR, $0}' "$file" | sed -n '1,220p'
echo
echo "== checkout occurrences in workflow =="
grep -nE "actions/checkout|persist-credentials|GITHUB_TOKEN|docker login|podman login|GHCR|ghcr|registry" "$file" || trueRepository: osac-project/osac
Length of output: 3788
Sensitive Data Exposure (CWE-522): Insufficiently Protected Credentials
Disable checkout credential persistence.
actions/checkout@v7 stores GITHUB_TOKEN in local Git config by default. No later step performs Git operations; registry push credentials come from the separate login step, so no other credential is required. Set with: persist-credentials: false.
🧰 Tools
🪛 zizmor (1.29.0)
[warning] 31-32: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/build-metering-test-adapter-image.yaml around lines 31 -
32, Update the “Checkout repository” step using actions/checkout@v7 to set
persist-credentials to false in its with configuration, while leaving the
existing checkout behavior unchanged.
Source: Linters/SAST tools
Comment on lines
+70
to
+77
| - name: Build and push Docker image | ||
| uses: docker/build-push-action@v7 | ||
| with: | ||
| context: osac-metering/metering-service | ||
| file: osac-metering/metering-service/Containerfile.test-adapter | ||
| push: ${{ github.event_name != 'pull_request' }} | ||
| tags: ${{ steps.meta.outputs.tags }} | ||
| labels: ${{ steps.meta.outputs.labels }} |
Contributor
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow header and relevant sections =="
cat -n .github/workflows/build-metering-test-adapter-image.yaml | sed -n '1,140p'
echo
echo "== occurrences of github-token permissions, id-token, cosign/Sigstore, docker/build-push and push outputs =="
rg -n "permissions:|id-token:|GITHUB_TOKEN|cosign|sigstore|docker/build-push-action|docker/build-push-action@|build:|outputs:|digest|ghcr|push:" .github/workflows/build-metering-test-adapter-image.yamlRepository: osac-project/osac
Length of output: 3815
Security Misconfiguration (CWE-345)
Reachability: External
Sign each published image digest.
This workflow publishes GHCR images without a Sigstore or cosign signature. Add a push-only signing step for steps.build.outputs.digest, and grant id-token: write only to the publishing job.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/build-metering-test-adapter-image.yaml around lines 70 -
77, Update the publishing job containing the “Build and push Docker image” step
to grant `id-token: write` in its permissions, limited to that job. Expose the
build digest via the action step’s `id` and add a subsequent step that runs only
when `push` is enabled, signing `steps.build.outputs.digest` with the
repository’s established Sigstore/cosign tooling.
Source: Path instructions
This was referenced Aug 6, 2026
eliorerz
pushed a commit
that referenced
this pull request
Sep 18, 2026
OSAC-4085: Align main navigation with latest UX
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
build-metering-test-adapter-image.yaml— builds and publishesghcr.io/osac-project/metering-test-adapteron push to main and semver tags, mirroring the existing metering-service workflowcomponentsarray so PR builds also build and load it onto the test clusterProblem
The metering-test-adapter has source code (
osac-metering/metering-service/cmd/test-adapter), a Containerfile (Containerfile.test-adapter), and full Helm chart integration — but no CI workflow to build the image. VMaaS CI values enablemetering.testAdapter.enabled: true, sohelm install --waitblocks indefinitely onImagePullBackOffforghcr.io/osac-project/metering-test-adapter:latest(403 — image doesn't exist).Every VMaaS full-install E2E run has been failing at "Install OSAC" since the metering test-adapter was enabled in CI values. BMaaS and CaaS are unaffected (test-adapter not enabled in their values).
Test plan
ghcr.io/osac-project/metering-test-adapter:latestexists in GHCR🤖 Generated with Claude Code
Summary by CodeRabbit