Red Hat Konflux kflux-prd-rh02 update hyperfleet-sentinel#109
Red Hat Konflux kflux-prd-rh02 update hyperfleet-sentinel#109red-hat-konflux-kflux-prd-rh02[bot] wants to merge 2 commits into
Conversation
Signed-off-by: red-hat-konflux-kflux-prd-rh02 <konflux@no-reply.konflux-ci.dev>
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Hi @red-hat-konflux-kflux-prd-rh02[bot]. Thanks for your PR. I'm waiting for a openshift-hyperfleet member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
📝 WalkthroughSummary by CodeRabbitRelease Notes
WalkthroughThis PR adds two new Tekton Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.tekton/hyperfleet-sentinel-pull-request.yaml:
- Around line 91-93: The parameter "enable-cache-proxy" is missing an explicit
type; add a line "type: string" under the parameter definition so it matches the
style used in push.yaml and other parameters (keep the existing default and
description and ensure indentation matches surrounding parameters); update the
block that currently contains name: enable-cache-proxy to include type: string.
In @.tekton/hyperfleet-sentinel-push.yaml:
- Around line 88-90: The parameter entry for enable-cache-proxy is missing an
explicit type; update the parameter block that contains name: enable-cache-proxy
and default: "false" to include type: string so it matches the other string
parameters and keeps parameter definitions consistent.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Central YAML (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: 785296fb-042a-4b7a-8332-2d80f5c5ad07
📒 Files selected for processing (2)
.tekton/hyperfleet-sentinel-pull-request.yaml.tekton/hyperfleet-sentinel-push.yaml
| - default: "false" | ||
| description: Enable cache proxy configuration | ||
| name: enable-cache-proxy |
There was a problem hiding this comment.
🧹 Nitpick | 🔵 Trivial | 💤 Low value
Missing type: string for enable-cache-proxy parameter (same as push.yaml).
For consistency with the push pipeline and other parameters in this file, add the explicit type declaration.
♻️ Suggested fix
- default: "false"
description: Enable cache proxy configuration
name: enable-cache-proxy
+ type: string📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - default: "false" | |
| description: Enable cache proxy configuration | |
| name: enable-cache-proxy | |
| - default: "false" | |
| description: Enable cache proxy configuration | |
| name: enable-cache-proxy | |
| type: string |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.tekton/hyperfleet-sentinel-pull-request.yaml around lines 91 - 93, The
parameter "enable-cache-proxy" is missing an explicit type; add a line "type:
string" under the parameter definition so it matches the style used in push.yaml
and other parameters (keep the existing default and description and ensure
indentation matches surrounding parameters); update the block that currently
contains name: enable-cache-proxy to include type: string.
| - default: "false" | ||
| description: Enable cache proxy configuration | ||
| name: enable-cache-proxy |
There was a problem hiding this comment.
🧹 Nitpick | 🔵 Trivial | 💤 Low value
Missing type: string for enable-cache-proxy parameter.
This parameter is missing the explicit type declaration that all other string parameters have. While Tekton infers string as the default type, adding it maintains consistency with the rest of the parameter definitions.
♻️ Suggested fix
- default: "false"
description: Enable cache proxy configuration
name: enable-cache-proxy
+ type: string📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - default: "false" | |
| description: Enable cache proxy configuration | |
| name: enable-cache-proxy | |
| - default: "false" | |
| description: Enable cache proxy configuration | |
| name: enable-cache-proxy | |
| type: string |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.tekton/hyperfleet-sentinel-push.yaml around lines 88 - 90, The parameter
entry for enable-cache-proxy is missing an explicit type; update the parameter
block that contains name: enable-cache-proxy and default: "false" to include
type: string so it matches the other string parameters and keeps parameter
definitions consistent.
|
/ok-to-test |
|
/retest |
|
/test validate-commits |
Convert the Konflux pull-request pipeline to a tag pipeline that triggers on RC and release version tags. Prow owns PR validation, so the pull-request pipeline is not needed. - Rename pull-request.yaml to tag.yaml - CEL expression matches v* tags (RC and release) - Add extract-version task to strip refs/tags/v prefix - Inject VERSION build-arg into container build - Remove image expiry (tag images persist) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.tekton/hyperfleet-sentinel-tag.yaml:
- Line 159: The extract-version task step currently uses a mutable image tag
"registry.access.redhat.com/ubi9-minimal:latest"; change that to a digest-pinned
reference (e.g., registry.access.redhat.com/ubi9-minimal@sha256:...) so the
extract-version step image is immutable and reproducible—update the image field
for the extract-version step to use the same digest-pinning pattern used by
other task bundles in this file.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Central YAML (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: 96c2a1b4-866c-4fab-8277-e6af86c7e89f
📒 Files selected for processing (1)
.tekton/hyperfleet-sentinel-tag.yaml
| description: Semantic version extracted from git tag ref | ||
| steps: | ||
| - name: extract | ||
| image: registry.access.redhat.com/ubi9-minimal:latest |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Find mutable :latest image references in Tekton manifests
rg -n --type=yaml '^\s*image:\s*\S+:latest\b' -C2Repository: openshift-hyperfleet/hyperfleet-sentinel
Length of output: 66
🏁 Script executed:
#!/bin/bash
# Read the file around line 159 to see actual content
head -170 .tekton/hyperfleet-sentinel-tag.yaml | tail -20Repository: openshift-hyperfleet/hyperfleet-sentinel
Length of output: 668
🏁 Script executed:
#!/bin/bash
# Find all image references in the tag pipeline file
rg -n 'image:' .tekton/hyperfleet-sentinel-tag.yaml | head -30Repository: openshift-hyperfleet/hyperfleet-sentinel
Length of output: 152
Pin the extract-version step image to a digest instead of :latest.
The extract-version task step at line 159 uses image: registry.access.redhat.com/ubi9-minimal:latest, a mutable tag that makes the pipeline non-reproducible and vulnerable to silent behavior/security changes. Pin this image to a digest (@sha256:...) to match the digest-pinned task bundles elsewhere in this file.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.tekton/hyperfleet-sentinel-tag.yaml at line 159, The extract-version task
step currently uses a mutable image tag
"registry.access.redhat.com/ubi9-minimal:latest"; change that to a digest-pinned
reference (e.g., registry.access.redhat.com/ubi9-minimal@sha256:...) so the
extract-version step image is immutable and reproducible—update the image field
for the extract-version step to use the same digest-pinning pattern used by
other task bundles in this file.
|
/ok-to-test |
1 participant
Pipelines as Code configuration proposal
To start the PipelineRun, add a new comment with content
/ok-to-testFor more detailed information about running a PipelineRun, please refer to Pipelines as Code documentation Running the PipelineRun
To customize the proposed PipelineRuns after merge, please refer to Build Pipeline customization
Please follow the block sequence indentation style introduced by the proprosed PipelineRuns YAMLs, or keep using consistent indentation level through your customized PipelineRuns. When different levels are mixed, it will be changed to the proposed style.