Skip to content

TEMP: e2e verification round 2 for OSAC-3523 (do not merge) #70

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
eliorerz wants to merge 3 commits into from
Closed

TEMP: e2e verification round 2 for OSAC-3523 (do not merge) #70

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a1fa654
OSAC-3523: Deploy PR's own osac-installer for mono-repo-resident comp…
eliorerz Aug 1, 2026
65143ed
Merge branch 'main' into osac-3523-e2e-mono-repo-installer
eliorerz Aug 1, 2026
a4886a8
TEMP: point bmaas e2e at test-infra fork branch for verification (rou…
eliorerz Aug 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion .github/workflows/e2e-bmaas-full-install.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,10 +67,17 @@ jobs:
e2e-bmaas-full-install:
needs: changes
if: needs.changes.outputs.should-run == 'true'
uses: osac-project/osac-test-infra/.github/workflows/e2e-bmaas-full-install.yml@main
uses: eliorerz/osac-test-infra/.github/workflows/e2e-bmaas-full-install.yml@osac-3523-mono-repo-installer-support

@coderabbitai coderabbitai Bot Aug 1, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Pin the reusable workflow to a commit SHA.

Line 70 references the mutable branch osac-3523-mono-repo-installer-support in an external repository. A branch update can change the workflow code between runs. Pin this reusable workflow to the 40-character commit SHA for the verification revision. Keep the branch name in a comment for traceability.

Suggested pin 
-    uses: eliorerz/osac-test-infra/.github/workflows/e2e-bmaas-full-install.yml@osac-3523-mono-repo-installer-support
+    uses: eliorerz/osac-test-infra/.github/workflows/e2e-bmaas-full-install.yml@<40-character-commit-sha>  # osac-3523-mono-repo-installer-support

As per path instructions, CI/CD actions must be pinned by full SHA, not tag.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/e2e-bmaas-full-install.yml at line 70, Update the reusable
workflow reference in the e2e-bmaas-full-install workflow to use the required
40-character commit SHA instead of the mutable
osac-3523-mono-repo-installer-support branch. Retain that branch name in an
adjacent comment for traceability, and do not alter the workflow invocation
otherwise.

Source: Path instructions

with:
test-suite: ${{ inputs.test-suite || 'bmaas' }}
test-filter: ${{ inputs.test-filter || '' }}
# osac-installer now lives as a subdirectory of this same monorepo checkout
# (its Chart.yaml deps resolve fulfillment-service/osac-operator/osac-aap/BMF
# as ../../../<name> siblings within it), so a PR touching those components
# must deploy from this PR's own fork/ref, not the reusable workflow's
# standalone-repo default.
installer-repo: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
installer-ref: ${{ github.event.pull_request.head.ref || github.ref_name }}
Comment on lines +79 to +80

@coderabbitai coderabbitai Bot Aug 1, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

check_workflow() {
  local repo="$1"
  local ref="$2"
  local file="$3"
  local url="https://raw.githubusercontent.com/${repo}/${ref}/.github/workflows/${file}"

  echo "== ${url} =="
  curl -fsSL "$url" |
    rg -n -C 8 'workflow_call:|installer-(repo|ref)|head\.sha|ls-remote|rev-parse|actions/checkout'
}

check_workflow "eliorerz/osac-test-infra" "osac-3523-mono-repo-installer-support" "e2e-bmaas-full-install.yml"
check_workflow "osac-project/osac-test-infra" "main" "e2e-caas-full-install.yml"

Repository: osac-project/osac

Length of output: 9880

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

echo "== workflow file sizes =="
wc -l .github/workflows/e2e-bmaas-full-install.yml .github/workflows/e2e-caas-full-install.yml

echo
echo "== reusable workflow installer input install blocks =="
for f in .github/workflows/e2e-bmaas-full-install.yml .github/workflows/e2e-caas-full-install.yml; do
  echo "-- $f --"
  sed -n '439,530p' "$f"
done

echo
echo "== all reusable workflows with installer inputs =="
rg -n -C 4 'inputs:|installer-(repo|ref):' .github/workflows || true

echo
echo "== workflow_call usages of target workflows =="
rg -n -C 8 'uses: .*e2e-(bmaas|caas)-full-install|e2e-(bmaas|c|caas)-full-install|\.github/workflows/e2e-(bmaas|caas)-full-install' .github/workflows .github/actions 2>/dev/null || true

Repository: osac-project/osac

Length of output: 19480

Resolve installer-ref to the PR head commit before cloning.

.github/workflows/e2e-bmaas-full-install.yml@osac-3523-mono-repo-installer-support declares and uses installer-repo/installer-ref, but it clones --branch "${installer-ref}"; pull request branch names can move between the caller's clone and the installer clone. Resolve ${{ github.event.pull_request.head.sha }} on the source repo before passing it to the reusable workflow, or resolve it inside the installer deploy script, so both BMaaS and CaaS validate against an immutable commit.

📍 Affects 2 files
  • .github/workflows/e2e-bmaas-full-install.yml#L79-L80 (this comment)
  • .github/workflows/e2e-caas-full-install.yml#L86-L87
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/e2e-bmaas-full-install.yml around lines 79 - 80, Update
installer-ref in both .github/workflows/e2e-bmaas-full-install.yml lines 79-80
and .github/workflows/e2e-caas-full-install.yml lines 86-87 to use the pull
request head SHA when available, while preserving the existing non-PR fallback.
Ensure the reusable workflow receives an immutable commit reference for
installer-repo so cloning and validation cannot follow a moved branch.

# Build all component images from the PR's fork/branch (same monorepo checkout)
components: '[{"repo":"${{ github.event.pull_request.head.repo.full_name || github.repository }}","ref":"${{ github.event.pull_request.head.ref || github.ref_name }}","containerfile":"fulfillment-service/Containerfile","imageKey":"service.images.service"},{"repo":"${{ github.event.pull_request.head.repo.full_name || github.repository }}","ref":"${{ github.event.pull_request.head.ref || github.ref_name }}","containerfile":"osac-operator/Containerfile","imageKey":"operator.image.repository"},{"repo":"${{ github.event.pull_request.head.repo.full_name || github.repository }}","ref":"${{ github.event.pull_request.head.ref || github.ref_name }}","containerfile":"osac-aap/execution-environment/execution-environment.yaml","imageKey":"aap.bootstrap.image","buildType":"ansible-builder"},{"repo":"${{ github.event.pull_request.head.repo.full_name || github.repository }}","ref":"${{ github.event.pull_request.head.ref || github.ref_name }}","containerfile":"bare-metal-fulfillment-operator/Containerfile","imageKey":"bmf.image.repository"}]'
# Pass author_association for fork PR authorization (empty for non-fork PRs)
Expand Down
13 changes: 10 additions & 3 deletions .github/workflows/e2e-caas-full-install.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,6 +78,13 @@ jobs:
with:
test-suite: ${{ inputs.test-suite || 'caas' }}
test-filter: ${{ inputs.test-filter || '' }}
# osac-installer now lives as a subdirectory of this same monorepo checkout
# (its Chart.yaml deps resolve fulfillment-service/osac-operator/osac-aap/BMF
# as ../../../<name> siblings within it), so a PR touching those components
# must deploy from this PR's own fork/ref, not the reusable workflow's
# standalone-repo default.
installer-repo: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
installer-ref: ${{ github.event.pull_request.head.ref || github.ref_name }}
# Build all component images from the PR's fork/branch (same monorepo checkout)
components: '[{"repo":"${{ github.event.pull_request.head.repo.full_name || github.repository }}","ref":"${{ github.event.pull_request.head.ref || github.ref_name }}","containerfile":"fulfillment-service/Containerfile","imageKey":"service.images.service"},{"repo":"${{ github.event.pull_request.head.repo.full_name || github.repository }}","ref":"${{ github.event.pull_request.head.ref || github.ref_name }}","containerfile":"osac-operator/Containerfile","imageKey":"operator.image.repository"},{"repo":"${{ github.event.pull_request.head.repo.full_name || github.repository }}","ref":"${{ github.event.pull_request.head.ref || github.ref_name }}","containerfile":"bare-metal-fulfillment-operator/Containerfile","imageKey":"bmf.image.repository"}]'
# Pass author_association for fork PR authorization (empty for non-fork PRs)
Expand All @@ -88,9 +95,9 @@ jobs:
test-infra-repository: osac-project/osac-test-infra
test-infra-ref: ${{ inputs.test-infra-ref || 'main' }}
# CaaS-specific inputs (cluster-template, caas-domain, flavor-image,
# flavor-name, namespace, installer-repo/ref, etc.) are left at the
# reusable workflow's own defaults -- none are required and this
# caller has no need to override them today.
# flavor-name, namespace, etc.) are left at the reusable workflow's own
# defaults -- none are required and this caller has no need to override
# them today.

e2e:
if: always()
Expand Down
7 changes: 7 additions & 0 deletions .github/workflows/e2e-vmaas-full-install.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,6 +78,13 @@ jobs:
with:
test-suite: ${{ inputs.test-suite || 'vmaas' }}
test-filter: ${{ inputs.test-filter || '' }}
# osac-installer now lives as a subdirectory of this same monorepo checkout
# (its Chart.yaml deps resolve fulfillment-service/osac-operator/osac-aap/BMF
# as ../../../<name> siblings within it), so a PR touching those components
# must deploy from this PR's own fork/ref, not the reusable workflow's
# standalone-repo default.
installer-repo: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
installer-ref: ${{ github.event.pull_request.head.ref || github.ref_name }}
# Build all component images from the PR's fork/branch (same monorepo checkout)
components: '[{"repo":"${{ github.event.pull_request.head.repo.full_name || github.repository }}","ref":"${{ github.event.pull_request.head.ref || github.ref_name }}","containerfile":"fulfillment-service/Containerfile","imageKey":"service.images.service"},{"repo":"${{ github.event.pull_request.head.repo.full_name || github.repository }}","ref":"${{ github.event.pull_request.head.ref || github.ref_name }}","containerfile":"osac-operator/Containerfile","imageKey":"operator.image.repository"},{"repo":"${{ github.event.pull_request.head.repo.full_name || github.repository }}","ref":"${{ github.event.pull_request.head.ref || github.ref_name }}","containerfile":"osac-aap/execution-environment/execution-environment.yaml","imageKey":"aap.bootstrap.image","buildType":"ansible-builder"},{"repo":"${{ github.event.pull_request.head.repo.full_name || github.repository }}","ref":"${{ github.event.pull_request.head.ref || github.ref_name }}","containerfile":"bare-metal-fulfillment-operator/Containerfile","imageKey":"bmf.image.repository"}]'
# Pass author_association for fork PR authorization (empty for non-fork PRs)
Expand Down
46 changes: 0 additions & 46 deletions osac-installer/.github/workflows/e2e-bmaas-full-install.yml
View file
Open in desktop

This file was deleted.

49 changes: 0 additions & 49 deletions osac-installer/.github/workflows/e2e-vmaas-full-install.yml
View file
Open in desktop

This file was deleted.

Loading