CI: add unit test, CodeQL, FIPS, stale, and labeler workflows#17
Open
GowthamShanmugam wants to merge 2 commits into
Open
CI: add unit test, CodeQL, FIPS, stale, and labeler workflows#17GowthamShanmugam wants to merge 2 commits into
GowthamShanmugam wants to merge 2 commits into
Conversation
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: GowthamShanmugam The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
📝 WalkthroughWalkthroughThis pull request introduces six new GitHub Actions workflow files and one labeler configuration file to the Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Security findings
🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 10
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/codeql.yml:
- Line 24: The workflow uses mutable tags like "actions/checkout@v4" and the
various "github/codeql-action/*" step references which are susceptible to
supply-chain attacks; replace each "uses: actions/checkout@vX" and every "uses:
github/codeql-action/..." entry with the corresponding immutable full commit SHA
for that action (i.e., fetch the action's repository commit SHA you want to pin
and update the uses value to "repo@<full-commit-sha>") so that actions/checkout
and all github/codeql-action steps are pinned to specific commits.
- Around line 20-24: Update the workflow job permissions block to include the
missing scopes required by the checkout step and follow least-privilege
guidance: add "contents: read" so actions/checkout@v4 can access repository
files, and add "actions: read" to align with CodeQL starter recommendations;
modify the existing permissions: security-events: write to include these two
read entries in the same permissions mapping.
In @.github/workflows/fips-compliance.yml:
- Around line 53-60: The workflow uploads kube-rbac-proxy-fips.tar on failure
but no step creates that archive; add a short preceding step (e.g., "Package
fips artifacts") that collects the relevant outputs (build logs, binaries, test
artifacts) and creates kube-rbac-proxy-fips.tar (using tar or equivalent) so the
"Upload build artifacts on failure" step actually uploads content; reference the
artifact name kube-rbac-proxy-fips.tar and the upload step name "Upload build
artifacts on failure" when adding the packaging step so it runs before the
upload and only when the files exist.
- Line 18: Replace mutable tag-based action references with immutable commit
SHAs: locate each "uses:" entry (e.g., actions/checkout@v4 and the three other
action references flagged) and change the tag (e.g., `@v4`) to the corresponding
full commit SHA for that action repository (uses:
actions/checkout@<full-commit-sha> etc.), verifying you picked the intended
release commit; update all four occurrences so every workflow action is pinned
to its specific commit SHA.
- Around line 12-15: The fips-compliance job is missing an explicit permissions
block; add a permissions mapping under the fips-compliance job to constrain the
GITHUB_TOKEN to the least-privilege scope required (for example set minimal
rights like contents: read and any specific scopes the job needs), ensuring the
permissions key is present directly under the fips-compliance job definition so
GitHub uses the restricted token for that job.
- Around line 37-40: The workflow clones and builds upstream code without
pinning to an immutable revision; after the git clone of
https://github.com/openshift/check-payload into /tmp/check-payload (or before
running make), add an explicit checkout to a specific commit SHA (e.g., run git
-C /tmp/check-payload checkout <COMMIT_SHA> or cd /tmp/check-payload && git
checkout <COMMIT_SHA>) so the subsequent make operates on a fixed, immutable
commit rather than the branch tip.
In @.github/workflows/labeler.yml:
- Line 14: The workflow uses a mutable tag "actions/labeler@v5" which can be
modified upstream; replace that with the action pinned to its immutable full
commit SHA (the v5 release commit) so the workflow refers to a fixed revision;
locate the step that currently specifies "uses: actions/labeler@v5" and
substitute the tag with the full commit SHA for the v5 release (e.g., "uses:
actions/labeler@<full-commit-sha>") to ensure reproducible behavior.
In @.github/workflows/stale.yml:
- Line 15: Replace the loose tag reference "actions/stale@v9" under the uses:
declaration with a pinned full commit SHA for the actions/stale action; locate
the uses: actions/stale@v9 entry and change it to uses:
actions/stale@<full-commit-sha> (obtain the SHA from the action's GitHub repo
release/commit you want to lock to) so the workflow is pinned to that exact
commit.
In @.github/workflows/unit-tests.yml:
- Around line 19-20: Replace the tag-based GitHub Action references with
immutable commit SHAs to prevent upstream retargeting: locate the usages of
actions/checkout@v4 and actions/setup-go@v5 in the workflow and change each to
the corresponding full commit SHA for that action (e.g.,
actions/checkout@<FULL_SHA> and actions/setup-go@<FULL_SHA>), ensuring you fetch
the verified commit SHAs from the official action repositories and update both
occurrences so the workflow pins to those exact commits.
- Around line 14-17: The unit-tests job currently lacks an explicit permissions
block which grants broader default tokens; update the "unit-tests" job in
.github/workflows/unit-tests.yml to add a job-level permissions entry
restricting the GitHub token to only what checkout needs (e.g., add permissions:
contents: read) so the job uses least-privilege access; place the permissions
block directly under the unit-tests job definition (near
name/runs-on/timeout-minutes) to ensure actions/checkout only gets read access.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Central YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 37483e93-e9e4-478d-a26e-2ab7e49e98ff
📒 Files selected for processing (6)
.github/labeler.yml.github/workflows/codeql.yml.github/workflows/fips-compliance.yml.github/workflows/labeler.yml.github/workflows/stale.yml.github/workflows/unit-tests.yml
GowthamShanmugam
force-pushed
the
RHOAIENG-52034
branch
2 times, most recently
from
a7baf0c to
5d2e9b6
Compare
Remove the inherited upstream build.yml (build/publish handled by Konflux, e2e not needed in GitHub Actions). Replace with focused workflows: - unit-tests: license check, code generation, lint, make test-unit - codeql: Go security scanning on PRs, pushes, and weekly - fips-compliance: FIPS check against Dockerfile.redhat on PRs - stale: auto-close inactive issues/PRs after 180+14 days - labeler: auto-label PRs by files changed (ci, go, tests, etc.) Made-with: Cursor
Made-with: Cursor
GowthamShanmugam
force-pushed
the
RHOAIENG-52034
branch
from
5d2e9b6 to
ec081f0
Compare
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add GitHub Actions workflows to complement the existing Konflux build pipeline:
Issue: https://redhat.atlassian.net/browse/RHOAIENG-52034
Made-with: Cursor
Description
How Has This Been Tested?
Merge criteria:
Summary by CodeRabbit