Initial CI automation on test for GitOps operator support for xKS#1188
Initial CI automation on test for GitOps operator support for xKS#1188anandrkskd wants to merge 2 commits into
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
📝 WalkthroughSummary by CodeRabbit
WalkthroughA new GitHub Actions workflow is added that triggers on pull requests for all branches. The workflow builds a Docker image locally tagged ChangesDeploy-test CI Workflow
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Caution Failed to replace (edit) comment. This is likely due to insufficient permissions or the comment being deleted. Error details |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/deploy-test.yaml:
- Line 17: Replace the floating version tags on the GitHub Actions uses
statements at lines 17, 20, 25, and 40 with their corresponding immutable commit
SHAs. Instead of using `@v4`, `@v5`, `@v3`, and `@v1` tags for actions/checkout,
actions/setup-node, and other actions in this workflow, pin each to a specific
commit SHA by looking up the actual commit hash for each version tag and
replacing the tag portion with the full SHA reference (e.g., uses:
actions/checkout@abc123def456... format).
- Around line 54-57: The kubectl wait command in the deploy-test workflow is
targeting the wrong Deployment and namespace. The make deploy command creates a
controller named argocd-operator-controller-manager in the
argocd-operator-system namespace, but the current kubectl wait command is
looking for openshift-gitops-operator-controller-manager in
openshift-gitops-operator namespace. Update the deployment name from
openshift-gitops-operator-controller-manager to
argocd-operator-controller-manager and change the namespace from
openshift-gitops-operator to argocd-operator-system to match what is actually
deployed by make deploy.
- Around line 16-17: The actions/checkout action is using default credential
persistence settings, which stores the GitHub token in the git config for
subsequent steps. Disable credential persistence by adding the
persist-credentials parameter set to false in the actions/checkout@v4 step to
reduce credential exposure risk and remove the unnecessary token storage since
it is not needed for this workflow's subsequent steps.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 4dbab3dd-9103-47f8-a5a5-97285e3bd659
📒 Files selected for processing (1)
.github/workflows/deploy-test.yaml
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
argoproj-labs/argocd-operator(manual)
| - name: Checkout code | ||
| uses: actions/checkout@v4 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Disable credential persistence in checkout step
Line 17 uses actions/checkout with default credential persistence. That leaves the GitHub token in local git config for subsequent steps, which is unnecessary for this workflow and expands credential exposure risk.
Suggested fix
- name: Checkout code
uses: actions/checkout@v4
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 16-17: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 17-17: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/deploy-test.yaml around lines 16 - 17, The
actions/checkout action is using default credential persistence settings, which
stores the GitHub token in the git config for subsequent steps. Disable
credential persistence by adding the persist-credentials parameter set to false
in the actions/checkout@v4 step to reduce credential exposure risk and remove
the unnecessary token storage since it is not needed for this workflow's
subsequent steps.
Source: Linters/SAST tools
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v4 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Pin GitHub Actions to immutable commit SHAs
Lines 17, 20, 25, and 40 use floating tags (@v4, @v5, @v3, @v1). Per the reported policy, this is non-compliant and increases supply-chain risk from upstream retags.
Suggested fix pattern
- - name: Checkout code
- uses: actions/checkout@v4
+ - name: Checkout code
+ uses: actions/checkout@<full-commit-sha>
- - name: Setup Go
- uses: actions/setup-go@v5
+ - name: Setup Go
+ uses: actions/setup-go@<full-commit-sha>
- - name: Log in to Quay.io
- uses: docker/login-action@v3
+ - name: Log in to Quay.io
+ uses: docker/login-action@<full-commit-sha>
- - name: Create kind cluster
- uses: helm/kind-action@v1
+ - name: Create kind cluster
+ uses: helm/kind-action@<full-commit-sha>Also applies to: 20-20, 25-25, 40-40
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 16-17: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 17-17: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/deploy-test.yaml at line 17, Replace the floating version
tags on the GitHub Actions uses statements at lines 17, 20, 25, and 40 with
their corresponding immutable commit SHAs. Instead of using `@v4`, `@v5`, `@v3`, and
`@v1` tags for actions/checkout, actions/setup-node, and other actions in this
workflow, pin each to a specific commit SHA by looking up the actual commit hash
for each version tag and replacing the tag portion with the full SHA reference
(e.g., uses: actions/checkout@abc123def456... format).
Source: Linters/SAST tools
| kubectl wait --for=condition=available --timeout=120s \ | ||
| deployment/openshift-gitops-operator-controller-manager \ | ||
| -n openshift-gitops-operator | ||
| kubectl get pods -n openshift-gitops-operator |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Controller verification targets the wrong Deployment/namespace
Line 54–57 waits for deployment/openshift-gitops-operator-controller-manager in openshift-gitops-operator, but make deploy applies config/default, which resolves to the controller in argocd-operator-system (argocd-operator-controller-manager). This will make the CI check fail even when deploy succeeds.
Suggested fix
- name: Verify Controller Manager deployment is available
run: |
kubectl wait --for=condition=available --timeout=120s \
- deployment/openshift-gitops-operator-controller-manager \
- -n openshift-gitops-operator
- kubectl get pods -n openshift-gitops-operator
+ deployment/argocd-operator-controller-manager \
+ -n argocd-operator-system
+ kubectl get pods -n argocd-operator-system📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| kubectl wait --for=condition=available --timeout=120s \ | |
| deployment/openshift-gitops-operator-controller-manager \ | |
| -n openshift-gitops-operator | |
| kubectl get pods -n openshift-gitops-operator | |
| kubectl wait --for=condition=available --timeout=120s \ | |
| deployment/argocd-operator-controller-manager \ | |
| -n argocd-operator-system | |
| kubectl get pods -n argocd-operator-system |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/deploy-test.yaml around lines 54 - 57, The kubectl wait
command in the deploy-test workflow is targeting the wrong Deployment and
namespace. The make deploy command creates a controller named
argocd-operator-controller-manager in the argocd-operator-system namespace, but
the current kubectl wait command is looking for
openshift-gitops-operator-controller-manager in openshift-gitops-operator
namespace. Update the deployment name from
openshift-gitops-operator-controller-manager to
argocd-operator-controller-manager and change the namespace from
openshift-gitops-operator to argocd-operator-system to match what is actually
deployed by make deploy.
Source: Linked repositories
assisted-by: ClaudeCode Signed-off-by: Anand Kumar Singh <anandrkskd@gmail.com>
assisted-by: ClaudeCode Signed-off-by: Anand Kumar Singh <anandrkskd@gmail.com>
There was a problem hiding this comment.
♻️ Duplicate comments (2)
.github/workflows/deploy-test.yaml (2)
17-17: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winPin all GitHub Actions to immutable SHAs.
Lines 17, 20, and 25 use floating tags (
@v4,@v5,@v1), which weakens supply-chain integrity under strict CI policy.Suggested pattern
- uses: actions/checkout@v4 + uses: actions/checkout@<full-commit-sha> - uses: actions/setup-go@v5 + uses: actions/setup-go@<full-commit-sha> - uses: helm/kind-action@v1 + uses: helm/kind-action@<full-commit-sha>#!/bin/bash # Verify unpinned GitHub Action refs in workflow files (expects matches for floating tags) rg -nP '^\s*uses:\s*[^@]+@v[0-9]+(\.[0-9]+)?\s*$' .github/workflowsAlso applies to: 20-20, 25-25
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/deploy-test.yaml at line 17, The GitHub Actions in the deploy-test.yaml workflow file are specified with floating version tags (`@v4`, `@v5`, `@v1`) instead of immutable commit SHAs, which weakens supply-chain security. For each of the three uses statements on lines 17, 20, and 25, replace the floating version tag (the `@vX` portion) with the full commit SHA of that specific action version. This ensures that the exact version of the action is always used and cannot be changed unexpectedly by upstream maintainers.Source: Linters/SAST tools
16-17: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winDisable checkout credential persistence.
Line 17 uses default token persistence in
actions/checkout, which is unnecessary for this workflow and broadens token exposure across subsequent steps.Suggested patch
- name: Checkout code uses: actions/checkout@v4 + with: + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/deploy-test.yaml around lines 16 - 17, The Checkout code step uses actions/checkout@v4 with default token persistence enabled, which unnecessarily exposes the authentication token across subsequent workflow steps. Add the persist-credentials parameter set to false in the actions/checkout@v4 step configuration to disable credential persistence and reduce the token exposure surface.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In @.github/workflows/deploy-test.yaml:
- Line 17: The GitHub Actions in the deploy-test.yaml workflow file are
specified with floating version tags (`@v4`, `@v5`, `@v1`) instead of immutable commit
SHAs, which weakens supply-chain security. For each of the three uses statements
on lines 17, 20, and 25, replace the floating version tag (the `@vX` portion) with
the full commit SHA of that specific action version. This ensures that the exact
version of the action is always used and cannot be changed unexpectedly by
upstream maintainers.
- Around line 16-17: The Checkout code step uses actions/checkout@v4 with
default token persistence enabled, which unnecessarily exposes the
authentication token across subsequent workflow steps. Add the
persist-credentials parameter set to false in the actions/checkout@v4 step
configuration to disable credential persistence and reduce the token exposure
surface.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: 8c590d01-a18c-43d1-842a-c520e43b8b13
📒 Files selected for processing (1)
.github/workflows/deploy-test.yaml
|
@anandrkskd: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
1 participant
assisted-by: ClaudeCode
What type of PR is this?
/kind enhancement
What does this PR do / why we need it:
This PR adds CI automation to deploy gitops-operator on xKS(
kind) cluster. This CI pipelineHave you updated the necessary documentation?
Which issue(s) this PR fixes:
Fixes 9841
Test acceptance criteria:
How to test changes / Special notes to the reviewer: