Repository navigation
HYPERFLEET-1762 - openshift-hyperfleet: run verify-owners on architecture PRs that touch the ownership source - #86953
Conversation
…h the ownership source Adds a verify-owners presubmit for openshift-hyperfleet/architecture that runs make verify-owners when a PR changes owners.yaml, owners.md, the working agreement, the generator under hack/owners or the Makefile. The target checks the generated area table and the criteria copy are in sync with owners.yaml and that every path's approvers match its area. The build root gains make and python3-pyyaml for it. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
WalkthroughThe HyperFleet architecture CI configuration installs ChangesOwner verification CI
Priority: ⬇️ Low Estimated code review effort: 2 (Simple) | ~5 minutes Change: Feature Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Container-Privileges |  |
The new verify-owners test runs from the src project image. That image is based on UBI and has no USER directive, so the test runs as root by default. The PR adds no non-root user or runtime sec… |
Run the project image as a non-root user, such as by creating or selecting an appropriate user after the package-installation step and adding USER <non-root-uid> to the Dockerfile. Alternatively, provide an explicit, security-reviewed jus… |
-
Check name Status Explanation Docstring Coverage No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Stable And Deterministic Test Names The pull request adds the static CI test name verify-owners. It does not add or change any GinkgoIt,Describe,Context, orWhentitle. No dynamic test-title value is introduced.Test Structure And Quality The pull request changes only CI YAML configuration. It adds the verify-ownerscommand, image packages, and generated presubmit job. It does not add or modify Ginkgo tests, cluster operations, asser…Microshift Test Compatibility The pull request changes only CI configuration and the generated presubmit job. It adds a verify-ownerscommand and build dependencies; it does not add or modify Ginkgo e2e tests. The MicroShift tes…Single Node Openshift (Sno) Test Compatibility The pull request adds CI configuration and a verify-ownerspresubmit only. The authoritative diff contains no new Ginkgo e2e tests or test constructs such asIt(),Describe(),Context(), or `W…Topology-Aware Scheduling Compatibility PASS: The pull request changes only CI configuration and generated presubmit job definitions. It adds build dependencies, a make verify-ownerstest, and a path-based trigger. It does not add or modi…Ote Binary Stdout Contract PASS: The pull request changes only CI YAML and generated presubmit configuration. It adds a make verify-ownersjob and build dependencies. It does not change an OTE binary, suite setup, or any proc…Ipv6 And Disconnected Network Test Compatibility PASS: The pull request changes only CI configuration and a generated presubmit job. It adds a verify-ownerscommand, package installation, and path-based triggering. It does not add Ginkgo e2e tests…No-Weak-Crypto The pull request changes only CI configuration and a generated presubmit job. It adds build packages and a verify-ownerstest; it introduces no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB usage, custom…No-Sensitive-Data-In-Logs The pull request adds a CI command and package dependencies. It does not add logging, secret interpolation, environment dumps, or output of passwords, tokens, API keys, PII, session IDs, hostnames, or… Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title clearly identifies the main change: adding the verify-ownerscheck for OpenShift HyperFleet architecture pull requests that modify ownership sources.
Full details: Container-Privileges
-
Explanation
The new
verify-ownerstest runs from thesrcproject image. That image is based on UBI and has noUSERdirective, so the test runs as root by default. The PR adds no non-root user or runtime security context, and the description does not justify root execution. Noprivileged, host namespace,SYS_ADMIN, orallowPrivilegeEscalationsetting was added.Resolution
Run the project image as a non-root user, such as by creating or selecting an appropriate user after the package-installation step and adding
USER <non-root-uid>to the Dockerfile. Alternatively, provide an explicit, security-reviewed justification for root execution and limit it to the build step where possible.
- Fix all pre-merge checks with AI
✨ Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Create a new PR
-
Comment @coderabbitai help to get the list of available commands.
|
[REHEARSALNOTIFIER]
Prior to this PR being merged, you will need to either run and acknowledge or opt to skip these rehearsals. Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
/pj-rehearse auto-ack |
|
@ciaranRoche: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
openshift-ci
Bot
added
the
approved
openshift-merge-bot
Bot
added
the
rehearsals-ack
|
@ciaranRoche: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
Could you include the related ticket number in the PR title so this follow-up is traceable to the ownership rollout? |
ciaranRoche
changed the title
|
/lgtm |
|
@pnguyen44: changing LGTM is restricted to collaborators DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: ciaranRoche, Mischulee, pnguyen44 The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
…h the ownership source (openshift#86953) Adds a verify-owners presubmit for openshift-hyperfleet/architecture that runs make verify-owners when a PR changes owners.yaml, owners.md, the working agreement, the generator under hack/owners or the Makefile. The target checks the generated area table and the criteria copy are in sync with owners.yaml and that every path's approvers match its area. The build root gains make and python3-pyyaml for it. Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Adds a
verify-ownerspresubmit foropenshift-hyperfleet/architecture. It runsmake verify-ownerswhen a PR changeshyperfleet/docs/owners.yaml,hyperfleet/docs/owners.md,hyperfleet/docs/working-agreement.md, anything underhack/owners/or theMakefile. The target checks the generated area table and the criteria copy are in sync withowners.yamland that every path's approvers and reviewers match its area.The build root gains
makeandpython3-pyyamlso the target can run in the existing image.Follow-up from review on openshift-hyperfleet/architecture#232.
Summary by CodeRabbit
The
openshift-hyperfleet/architectureCI configuration now runsmake verify-ownerswhen a pull request changes theMakefile, files underhack/owners/, or specified ownership documentation. The project image now includesmakeandpython3-pyyaml, which the check requires.