Skip to content

TEMP: e2e verification for OSAC-3528 hotfix (do not merge) #71

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
eliorerz wants to merge 2 commits into from
Closed

TEMP: e2e verification for OSAC-3528 hotfix (do not merge) #71

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3560259
OSAC-3523: Deploy PR's own osac-installer for mono-repo-resident comp…
eliorerz Aug 1, 2026
932b356
TEMP: point bmaas e2e at test-infra hotfix branch for verification
eliorerz Aug 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion .github/workflows/e2e-bmaas-full-install.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,10 +67,17 @@ jobs:
e2e-bmaas-full-install:
needs: changes
if: needs.changes.outputs.should-run == 'true'
uses: osac-project/osac-test-infra/.github/workflows/e2e-bmaas-full-install.yml@main
uses: eliorerz/osac-test-infra/.github/workflows/e2e-bmaas-full-install.yml@osac-3528-drop-dead-osac-ui-followup

@coderabbitai coderabbitai Bot Aug 1, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

sha="$(
  git ls-remote --exit-code \
    https://github.com/eliorerz/osac-test-infra.git \
    refs/heads/osac-3528-drop-dead-osac-ui-followup |
    awk 'NR == 1 { print $1 }'
)"

[[ "$sha" =~ ^[0-9a-f]{40}$ ]]
printf '%s\n' "$sha"

Repository: osac-project/osac

Length of output: 196

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

echo "== workflow snippet =="
sed -n '1,120p' .github/workflows/e2e-bmaas-full-install.yml

echo
echo "== all uses in workflow =="
rg -n "uses:|GITHUB_TOKEN|permissions:|pull_request_target|checkout|pull-request" .github/workflows/e2e-bmaas-full-install.yml

Repository: osac-project/osac

Length of output: 6029

Pin the reusable workflow to an immutable commit.

eliorerz/osac-test-infra is referenced with the mutable branch osac-3528-drop-dead-osac-ui-followup at line 70. Use the full 40-character commit SHA for this ref or switch the branch to a pinned SHA before merging.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/e2e-bmaas-full-install.yml at line 70, Update the reusable
workflow reference in the uses declaration to replace the mutable
osac-3528-drop-dead-osac-ui-followup ref with the full 40-character immutable
commit SHA, preserving the existing workflow path and organization.

Source: Path instructions

with:
test-suite: ${{ inputs.test-suite || 'bmaas' }}
test-filter: ${{ inputs.test-filter || '' }}
# osac-installer now lives as a subdirectory of this same monorepo checkout
# (its Chart.yaml deps resolve fulfillment-service/osac-operator/osac-aap/BMF
# as ../../../<name> siblings within it), so a PR touching those components
# must deploy from this PR's own fork/ref, not the reusable workflow's
# standalone-repo default.
installer-repo: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
installer-ref: ${{ github.event.pull_request.head.ref || github.ref_name }}

@coderabbitai coderabbitai Bot Aug 1, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Use immutable installer revisions in all three callers.

Each installer-ref uses a mutable repository ref. Use github.event.pull_request.head.sha for pull request events and github.sha for non-PR events in all three workflows.

  • .github/workflows/e2e-bmaas-full-install.yml#L80
  • .github/workflows/e2e-caas-full-install.yml#L87
  • .github/workflows/e2e-vmaas-full-install.yml#L87
📍 Affects 3 files
  • .github/workflows/e2e-bmaas-full-install.yml#L80-L80 (this comment)
  • .github/workflows/e2e-caas-full-install.yml#L87-L87
  • .github/workflows/e2e-vmaas-full-install.yml#L87-L87
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/e2e-bmaas-full-install.yml at line 80, Replace the mutable
installer-ref expression with the pull request head SHA for PR events and
github.sha otherwise in all three callers:
.github/workflows/e2e-bmaas-full-install.yml:80,
.github/workflows/e2e-caas-full-install.yml:87, and
.github/workflows/e2e-vmaas-full-install.yml:87. Keep the installer-ref key
unchanged while ensuring each workflow uses immutable revisions.

# Build all component images from the PR's fork/branch (same monorepo checkout)
components: '[{"repo":"${{ github.event.pull_request.head.repo.full_name || github.repository }}","ref":"${{ github.event.pull_request.head.ref || github.ref_name }}","containerfile":"fulfillment-service/Containerfile","imageKey":"service.images.service"},{"repo":"${{ github.event.pull_request.head.repo.full_name || github.repository }}","ref":"${{ github.event.pull_request.head.ref || github.ref_name }}","containerfile":"osac-operator/Containerfile","imageKey":"operator.image.repository"},{"repo":"${{ github.event.pull_request.head.repo.full_name || github.repository }}","ref":"${{ github.event.pull_request.head.ref || github.ref_name }}","containerfile":"osac-aap/execution-environment/execution-environment.yaml","imageKey":"aap.bootstrap.image","buildType":"ansible-builder"},{"repo":"${{ github.event.pull_request.head.repo.full_name || github.repository }}","ref":"${{ github.event.pull_request.head.ref || github.ref_name }}","containerfile":"bare-metal-fulfillment-operator/Containerfile","imageKey":"bmf.image.repository"}]'
# Pass author_association for fork PR authorization (empty for non-fork PRs)
Expand Down
13 changes: 10 additions & 3 deletions .github/workflows/e2e-caas-full-install.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,6 +78,13 @@ jobs:
with:
test-suite: ${{ inputs.test-suite || 'caas' }}
test-filter: ${{ inputs.test-filter || '' }}
# osac-installer now lives as a subdirectory of this same monorepo checkout
# (its Chart.yaml deps resolve fulfillment-service/osac-operator/osac-aap/BMF
# as ../../../<name> siblings within it), so a PR touching those components
# must deploy from this PR's own fork/ref, not the reusable workflow's
# standalone-repo default.
installer-repo: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
installer-ref: ${{ github.event.pull_request.head.ref || github.ref_name }}
# Build all component images from the PR's fork/branch (same monorepo checkout)
components: '[{"repo":"${{ github.event.pull_request.head.repo.full_name || github.repository }}","ref":"${{ github.event.pull_request.head.ref || github.ref_name }}","containerfile":"fulfillment-service/Containerfile","imageKey":"service.images.service"},{"repo":"${{ github.event.pull_request.head.repo.full_name || github.repository }}","ref":"${{ github.event.pull_request.head.ref || github.ref_name }}","containerfile":"osac-operator/Containerfile","imageKey":"operator.image.repository"},{"repo":"${{ github.event.pull_request.head.repo.full_name || github.repository }}","ref":"${{ github.event.pull_request.head.ref || github.ref_name }}","containerfile":"bare-metal-fulfillment-operator/Containerfile","imageKey":"bmf.image.repository"}]'
# Pass author_association for fork PR authorization (empty for non-fork PRs)
Expand All @@ -88,9 +95,9 @@ jobs:
test-infra-repository: osac-project/osac-test-infra
test-infra-ref: ${{ inputs.test-infra-ref || 'main' }}
# CaaS-specific inputs (cluster-template, caas-domain, flavor-image,
# flavor-name, namespace, installer-repo/ref, etc.) are left at the
# reusable workflow's own defaults -- none are required and this
# caller has no need to override them today.
# flavor-name, namespace, etc.) are left at the reusable workflow's own
# defaults -- none are required and this caller has no need to override
# them today.

e2e:
if: always()
Expand Down
7 changes: 7 additions & 0 deletions .github/workflows/e2e-vmaas-full-install.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,6 +78,13 @@ jobs:
with:
test-suite: ${{ inputs.test-suite || 'vmaas' }}
test-filter: ${{ inputs.test-filter || '' }}
# osac-installer now lives as a subdirectory of this same monorepo checkout
# (its Chart.yaml deps resolve fulfillment-service/osac-operator/osac-aap/BMF
# as ../../../<name> siblings within it), so a PR touching those components
# must deploy from this PR's own fork/ref, not the reusable workflow's
# standalone-repo default.
installer-repo: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
installer-ref: ${{ github.event.pull_request.head.ref || github.ref_name }}
# Build all component images from the PR's fork/branch (same monorepo checkout)
components: '[{"repo":"${{ github.event.pull_request.head.repo.full_name || github.repository }}","ref":"${{ github.event.pull_request.head.ref || github.ref_name }}","containerfile":"fulfillment-service/Containerfile","imageKey":"service.images.service"},{"repo":"${{ github.event.pull_request.head.repo.full_name || github.repository }}","ref":"${{ github.event.pull_request.head.ref || github.ref_name }}","containerfile":"osac-operator/Containerfile","imageKey":"operator.image.repository"},{"repo":"${{ github.event.pull_request.head.repo.full_name || github.repository }}","ref":"${{ github.event.pull_request.head.ref || github.ref_name }}","containerfile":"osac-aap/execution-environment/execution-environment.yaml","imageKey":"aap.bootstrap.image","buildType":"ansible-builder"},{"repo":"${{ github.event.pull_request.head.repo.full_name || github.repository }}","ref":"${{ github.event.pull_request.head.ref || github.ref_name }}","containerfile":"bare-metal-fulfillment-operator/Containerfile","imageKey":"bmf.image.repository"}]'
# Pass author_association for fork PR authorization (empty for non-fork PRs)
Expand Down
46 changes: 0 additions & 46 deletions osac-installer/.github/workflows/e2e-bmaas-full-install.yml
View file
Open in desktop

This file was deleted.

49 changes: 0 additions & 49 deletions osac-installer/.github/workflows/e2e-vmaas-full-install.yml
View file
Open in desktop

This file was deleted.

Loading