Initial CI automation on test for GitOps operator support for xKS#1188
Initial CI automation on test for GitOps operator support for xKS#1188anandrkskd wants to merge 6 commits into
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughSummary by CodeRabbit
WalkthroughA pull-request workflow is added to build a local image, load it into kind, install and deploy the operator, and verify controller-manager availability. The webhook certificate secret volume is also marked optional. ChangesDeploy-test CI Workflow
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Caution Failed to replace (edit) comment. This is likely due to insufficient permissions or the comment being deleted. Error details |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/deploy-test.yaml:
- Line 17: Replace the floating version tags on the GitHub Actions uses
statements at lines 17, 20, 25, and 40 with their corresponding immutable commit
SHAs. Instead of using `@v4`, `@v5`, `@v3`, and `@v1` tags for actions/checkout,
actions/setup-node, and other actions in this workflow, pin each to a specific
commit SHA by looking up the actual commit hash for each version tag and
replacing the tag portion with the full SHA reference (e.g., uses:
actions/checkout@abc123def456... format).
- Around line 54-57: The kubectl wait command in the deploy-test workflow is
targeting the wrong Deployment and namespace. The make deploy command creates a
controller named argocd-operator-controller-manager in the
argocd-operator-system namespace, but the current kubectl wait command is
looking for openshift-gitops-operator-controller-manager in
openshift-gitops-operator namespace. Update the deployment name from
openshift-gitops-operator-controller-manager to
argocd-operator-controller-manager and change the namespace from
openshift-gitops-operator to argocd-operator-system to match what is actually
deployed by make deploy.
- Around line 16-17: The actions/checkout action is using default credential
persistence settings, which stores the GitHub token in the git config for
subsequent steps. Disable credential persistence by adding the
persist-credentials parameter set to false in the actions/checkout@v4 step to
reduce credential exposure risk and remove the unnecessary token storage since
it is not needed for this workflow's subsequent steps.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 4dbab3dd-9103-47f8-a5a5-97285e3bd659
📒 Files selected for processing (1)
.github/workflows/deploy-test.yaml
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
argoproj-labs/argocd-operator(manual)
| - name: Checkout code | ||
| uses: actions/checkout@v4 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Disable credential persistence in checkout step
Line 17 uses actions/checkout with default credential persistence. That leaves the GitHub token in local git config for subsequent steps, which is unnecessary for this workflow and expands credential exposure risk.
Suggested fix
- name: Checkout code
uses: actions/checkout@v4
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 16-17: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 17-17: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/deploy-test.yaml around lines 16 - 17, The
actions/checkout action is using default credential persistence settings, which
stores the GitHub token in the git config for subsequent steps. Disable
credential persistence by adding the persist-credentials parameter set to false
in the actions/checkout@v4 step to reduce credential exposure risk and remove
the unnecessary token storage since it is not needed for this workflow's
subsequent steps.
Source: Linters/SAST tools
| kubectl wait --for=condition=available --timeout=120s \ | ||
| deployment/openshift-gitops-operator-controller-manager \ | ||
| -n openshift-gitops-operator | ||
| kubectl get pods -n openshift-gitops-operator |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Controller verification targets the wrong Deployment/namespace
Line 54–57 waits for deployment/openshift-gitops-operator-controller-manager in openshift-gitops-operator, but make deploy applies config/default, which resolves to the controller in argocd-operator-system (argocd-operator-controller-manager). This will make the CI check fail even when deploy succeeds.
Suggested fix
- name: Verify Controller Manager deployment is available
run: |
kubectl wait --for=condition=available --timeout=120s \
- deployment/openshift-gitops-operator-controller-manager \
- -n openshift-gitops-operator
- kubectl get pods -n openshift-gitops-operator
+ deployment/argocd-operator-controller-manager \
+ -n argocd-operator-system
+ kubectl get pods -n argocd-operator-system📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| kubectl wait --for=condition=available --timeout=120s \ | |
| deployment/openshift-gitops-operator-controller-manager \ | |
| -n openshift-gitops-operator | |
| kubectl get pods -n openshift-gitops-operator | |
| kubectl wait --for=condition=available --timeout=120s \ | |
| deployment/argocd-operator-controller-manager \ | |
| -n argocd-operator-system | |
| kubectl get pods -n argocd-operator-system |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/deploy-test.yaml around lines 54 - 57, The kubectl wait
command in the deploy-test workflow is targeting the wrong Deployment and
namespace. The make deploy command creates a controller named
argocd-operator-controller-manager in the argocd-operator-system namespace, but
the current kubectl wait command is looking for
openshift-gitops-operator-controller-manager in openshift-gitops-operator
namespace. Update the deployment name from
openshift-gitops-operator-controller-manager to
argocd-operator-controller-manager and change the namespace from
openshift-gitops-operator to argocd-operator-system to match what is actually
deployed by make deploy.
Source: Linked repositories
There was a problem hiding this comment.
♻️ Duplicate comments (2)
.github/workflows/deploy-test.yaml (2)
17-17: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winPin all GitHub Actions to immutable SHAs.
Lines 17, 20, and 25 use floating tags (
@v4,@v5,@v1), which weakens supply-chain integrity under strict CI policy.Suggested pattern
- uses: actions/checkout@v4 + uses: actions/checkout@<full-commit-sha> - uses: actions/setup-go@v5 + uses: actions/setup-go@<full-commit-sha> - uses: helm/kind-action@v1 + uses: helm/kind-action@<full-commit-sha>#!/bin/bash # Verify unpinned GitHub Action refs in workflow files (expects matches for floating tags) rg -nP '^\s*uses:\s*[^@]+@v[0-9]+(\.[0-9]+)?\s*$' .github/workflowsAlso applies to: 20-20, 25-25
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/deploy-test.yaml at line 17, The GitHub Actions in the deploy-test.yaml workflow file are specified with floating version tags (`@v4`, `@v5`, `@v1`) instead of immutable commit SHAs, which weakens supply-chain security. For each of the three uses statements on lines 17, 20, and 25, replace the floating version tag (the `@vX` portion) with the full commit SHA of that specific action version. This ensures that the exact version of the action is always used and cannot be changed unexpectedly by upstream maintainers.Source: Linters/SAST tools
16-17: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winDisable checkout credential persistence.
Line 17 uses default token persistence in
actions/checkout, which is unnecessary for this workflow and broadens token exposure across subsequent steps.Suggested patch
- name: Checkout code uses: actions/checkout@v4 + with: + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/deploy-test.yaml around lines 16 - 17, The Checkout code step uses actions/checkout@v4 with default token persistence enabled, which unnecessarily exposes the authentication token across subsequent workflow steps. Add the persist-credentials parameter set to false in the actions/checkout@v4 step configuration to disable credential persistence and reduce the token exposure surface.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In @.github/workflows/deploy-test.yaml:
- Line 17: The GitHub Actions in the deploy-test.yaml workflow file are
specified with floating version tags (`@v4`, `@v5`, `@v1`) instead of immutable commit
SHAs, which weakens supply-chain security. For each of the three uses statements
on lines 17, 20, and 25, replace the floating version tag (the `@vX` portion) with
the full commit SHA of that specific action version. This ensures that the exact
version of the action is always used and cannot be changed unexpectedly by
upstream maintainers.
- Around line 16-17: The Checkout code step uses actions/checkout@v4 with
default token persistence enabled, which unnecessarily exposes the
authentication token across subsequent workflow steps. Add the
persist-credentials parameter set to false in the actions/checkout@v4 step
configuration to disable credential persistence and reduce the token exposure
surface.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: 8c590d01-a18c-43d1-842a-c520e43b8b13
📒 Files selected for processing (1)
.github/workflows/deploy-test.yaml
assisted-by: ClaudeCode Signed-off-by: Anand Kumar Singh <anandrkskd@gmail.com>
assisted-by: ClaudeCode Signed-off-by: Anand Kumar Singh <anandrkskd@gmail.com>
Signed-off-by: Anand Kumar Singh <anandrkskd@gmail.com>
Signed-off-by: Anand Kumar Singh <anandrkskd@gmail.com>
Signed-off-by: Anand Kumar Singh <anandrkskd@gmail.com>
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@config/default/manager_webhook_patch.yaml`:
- Around line 21-24: The webhook patch update in manager_webhook_patch.yaml is
not covered by deploy-test because the workflow disables that patch before
deployment. Update the deploy-test path in .github/workflows/deploy-test.yaml so
this manifest change is exercised, either by keeping the webhook patch enabled
in a dedicated kind-only flow or by adding a separate job that deploys with
webhooks enabled. Use the existing manager_webhook_patch.yaml and deploy-test
workflow symbols to locate the affected paths.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 8445f928-3853-47c6-bca1-c7735b2fcb75
📒 Files selected for processing (2)
.github/workflows/deploy-test.yamlconfig/default/manager_webhook_patch.yaml
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
argoproj-labs/argocd-operator(manual)
| secret: | ||
| defaultMode: 420 | ||
| secretName: webhook-server-cert | ||
| optional: true |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== deploy-test workflow disables the webhook patch =="
sed -n '25,40p' .github/workflows/deploy-test.yaml | nl -ba
echo
echo "== default kustomization still includes the webhook patch =="
sed -n '35,45p' config/default/kustomization.yaml | nl -ba
echo
echo "== changed patch content =="
sed -n '15,30p' config/default/manager_webhook_patch.yaml | nl -baRepository: redhat-developer/gitops-operator
Length of output: 264
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== deploy-test workflow =="
sed -n '1,120p' .github/workflows/deploy-test.yaml | cat -n
echo
echo "== default kustomization =="
sed -n '1,120p' config/default/kustomization.yaml | cat -n
echo
echo "== manager_webhook_patch =="
sed -n '1,80p' config/default/manager_webhook_patch.yaml | cat -nRepository: redhat-developer/gitops-operator
Length of output: 6356
Cover the webhook patch change in deploy-test config/default/manager_webhook_patch.yaml:21-24 is only exercised when manager_webhook_patch.yaml stays enabled, but .github/workflows/deploy-test.yaml comments that patch out before make deploy. Either move this change behind the same kind-only path or add a workflow job that deploys with webhooks enabled so this manifest change doesn't drift untested.
🧰 Tools
🪛 Checkov (3.3.1)
[medium] 1-24: Containers should not run with allowPrivilegeEscalation
(CKV_K8S_20)
[medium] 1-24: Minimize the admission of root containers
(CKV_K8S_23)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@config/default/manager_webhook_patch.yaml` around lines 21 - 24, The webhook
patch update in manager_webhook_patch.yaml is not covered by deploy-test because
the workflow disables that patch before deployment. Update the deploy-test path
in .github/workflows/deploy-test.yaml so this manifest change is exercised,
either by keeping the webhook patch enabled in a dedicated kind-only flow or by
adding a separate job that deploys with webhooks enabled. Use the existing
manager_webhook_patch.yaml and deploy-test workflow symbols to locate the
affected paths.
1 participant
assisted-by: ClaudeCode
What type of PR is this?
/kind enhancement
What does this PR do / why we need it:
This PR adds CI automation to deploy gitops-operator on xKS(
kind) cluster. This CI pipelineHave you updated the necessary documentation?
Which issue(s) this PR fixes:
Fixes 9841
Test acceptance criteria:
How to test changes / Special notes to the reviewer: