refactor: simplify mapping schema and add guidance generation to /onboard#108
Merged
jwm4 merged 11 commits intoambient-code:mainfrom Apr 17, 2026
Merged
Conversation
Contributor
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 3 minutes and 49 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
WalkthroughOnboarding and PR automation docs were revised to request repo-specific container image names, generate per-repo Changes
Sequence Diagram(s)sequenceDiagram
participant User
participant OnboardScript as Onboard Script
participant MCP
participant GitHub as GitHub/Git
participant RepoStore as Component Mappings
User->>OnboardScript: provide repo URLs and repo-specific container image names
OnboardScript->>MCP: validate Jira credentials / query MCP (if available)
MCP-->>OnboardScript: validation result (found / 0 results / unavailable)
OnboardScript->>RepoStore: generate updated `repos` array and `.cve-fix/examples.md` files
OnboardScript->>GitHub: create single PR with mapping + examples
GitHub-->>OnboardScript: try create PR with label -> if fails, retry without label
GitHub-->>User: PR created (includes generated files and PR body marker)
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes 🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@workflows/cve-fixer/.claude/commands/onboard.md`:
- Line 244: Replace the hardcoded co-author line "Co-Authored-By: Claude Sonnet
4.6 (1M context) <noreply@anthropic.com>" with a version-agnostic value or
template variable (e.g., CO_AUTHOR or a templated string) so the attribution
doesn't become stale; update the onboarding artifact that emits the string in
workflows/cve-fixer/.claude/commands/onboard.md to use the generic attribution
(for example "Co-Authored-By: Claude Sonnet <noreply@anthropic.com>") or pull
the version from a parameter so future version changes don't require code edits.
- Around line 231-237: The current transformation that builds EXAMPLES_DIR from
REPO_FULL uses tr '/' '-' which can collide (e.g., org/repo-name vs
org-repo/name); change the separator logic that sets EXAMPLES_DIR (the line that
computes EXAMPLES_DIR from REPO_FULL and the use of tr '/' '-') to replace '/'
with a double-underscore (e.g., use a substitution that maps '/' -> '__' so
EXAMPLES_DIR becomes "workflows/cve-fixer/.cve-fix/$(echo \"$REPO_FULL\" |
<replace '/' with '__'>)" ), preserving the rest of the loop (mkdir -p, echo to
examples.md, git add) unchanged.
In `@workflows/cve-fixer/component-repository-mappings.json`:
- Line 7: Several repository entries in component-repository-mappings.json have
"type": "unknown", which breaks routing for the CVE fix workflow; locate each
object with "type": "unknown" and replace it with the correct canonical role
("upstream", "midstream", or "downstream") for that repository, using the repo's
role in your org (or upstream project) as the source of truth; update all
occurrences (e.g., the entry currently showing "type": "unknown") and run the
repository mapping validation step (or add a simple schema check) to ensure no
"unknown" values remain so the workflow can route fixes correctly.
- Around line 1-24: The new schema flattened repositories into
components.*.repos[], so update code and docs that reference the old
container_to_repo_mapping and repositories objects: in
workflows/cve-fixer/.claude/commands/cve.find.md replace the jq query
`$c.container_to_repo_mapping | to_entries[]` and any
`$c.repositories[.value].subcomponent` lookups with queries that iterate over
`$c.components[] .repos[]` and, for each repo, iterate its `.containers[]` to
build container→repo mappings (use `.default_branch`, `.type` or `.repo_type`
field mapping and any `.branch_strategy` now on the repo object); in
workflows/cve-fixer/.claude/commands/cve.fix.md update Step 3.1 and the example
usages that still reference `container_to_repo_mapping`/`repositories` to the
same components[].repos[] traversal; and in workflows/cve-fixer/README.md
replace schema examples and docs (instances of `container_to_repo_mapping`,
`repositories`, `branch_strategy`, `repo_type`) with the new repos array
structure and field names so the commands’ jq queries match the new schema.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: bf4991ab-1bce-4d09-a053-1a6ff42a3897
📒 Files selected for processing (2)
workflows/cve-fixer/.claude/commands/onboard.mdworkflows/cve-fixer/component-repository-mappings.json
Comment on lines
+231
to
+237
| for i in "${!REPO_URLS[@]}"; do | ||
| REPO_FULL=$(echo "${REPO_URLS[$i]}" | sed 's|https://github.com/||') | ||
| EXAMPLES_DIR="workflows/cve-fixer/.cve-fix/$(echo "$REPO_FULL" | tr '/' '-')" | ||
| mkdir -p "$EXAMPLES_DIR" | ||
| echo "${GENERATED_EXAMPLES[$i]}" > "${EXAMPLES_DIR}/examples.md" | ||
| git add "${EXAMPLES_DIR}/examples.md" | ||
| done |
Contributor
There was a problem hiding this comment.
🧹 Nitpick | 🔵 Trivial
Consider alternative separator to avoid potential directory collisions.
Using tr '/' '-' means org/repo-name becomes org-repo-name, but a theoretical repo org-repo/name would produce the same directory. While GitHub naming rules make this unlikely, using __ as separator (e.g., org__repo-name) would be unambiguous.
💡 Optional: Use double-underscore separator
- EXAMPLES_DIR="workflows/cve-fixer/.cve-fix/$(echo "$REPO_FULL" | tr '/' '-')"
+ EXAMPLES_DIR="workflows/cve-fixer/.cve-fix/$(echo "$REPO_FULL" | sed 's|/|__|')"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| for i in "${!REPO_URLS[@]}"; do | |
| REPO_FULL=$(echo "${REPO_URLS[$i]}" | sed 's|https://github.com/||') | |
| EXAMPLES_DIR="workflows/cve-fixer/.cve-fix/$(echo "$REPO_FULL" | tr '/' '-')" | |
| mkdir -p "$EXAMPLES_DIR" | |
| echo "${GENERATED_EXAMPLES[$i]}" > "${EXAMPLES_DIR}/examples.md" | |
| git add "${EXAMPLES_DIR}/examples.md" | |
| done | |
| for i in "${!REPO_URLS[@]}"; do | |
| REPO_FULL=$(echo "${REPO_URLS[$i]}" | sed 's|https://github.com/||') | |
| EXAMPLES_DIR="workflows/cve-fixer/.cve-fix/$(echo "$REPO_FULL" | sed 's|/|__|')" | |
| mkdir -p "$EXAMPLES_DIR" | |
| echo "${GENERATED_EXAMPLES[$i]}" > "${EXAMPLES_DIR}/examples.md" | |
| git add "${EXAMPLES_DIR}/examples.md" | |
| done |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@workflows/cve-fixer/.claude/commands/onboard.md` around lines 231 - 237, The
current transformation that builds EXAMPLES_DIR from REPO_FULL uses tr '/' '-'
which can collide (e.g., org/repo-name vs org-repo/name); change the separator
logic that sets EXAMPLES_DIR (the line that computes EXAMPLES_DIR from REPO_FULL
and the use of tr '/' '-') to replace '/' with a double-underscore (e.g., use a
substitution that maps '/' -> '__' so EXAMPLES_DIR becomes
"workflows/cve-fixer/.cve-fix/$(echo \"$REPO_FULL\" | <replace '/' with '__'>)"
), preserving the rest of the loop (mkdir -p, echo to examples.md, git add)
unchanged.
3 tasks
component-repository-mappings.json: - Flatten schema: components now have a 'repos' array instead of nested 'repositories' object + 'container_to_repo_mapping' object - Containers move onto the repo that builds them (more logical) - Remove prose-only fields: branch_strategy, cve_fix_workflow, protected_branches, repository_type, monorepo_packages - Keep essential fields: url, type, default_branch, active_branches, containers, subcomponent (optional), build_location (optional) - File size reduced from ~30KB to ~20KB onboard.md: - Updated to use new simplified schema when adding components - Added Step 5: generate .cve-fix/examples.md for each repo by analyzing CVE PR history (titles, branches, files, co-upgrades, don'ts) — same approach as /guidance.generate --cve-only - Examples file included in the onboarding PR alongside mapping update Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
…/onboard Instead of asking users to provide container image names manually, query Jira for pscomponent: labels on existing CVE issues and extract the container names automatically. Each Jira CVE ticket has labels like: pscomponent:rhoai/odh-container-rhel9 These are collected, deduplicated, and assigned to the downstream repo in the mapping entry. No manual input needed for containers. If Jira is unavailable or no pscomponent: labels exist, the containers field is omitted and can be added later. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Standalone dashboard (similar style to shepard) that tracks: - Fix PRs opened / merged - Unique CVEs the workflow attempted to fix - Per-component breakdown - Components onboarded Scripts: - scripts/collect-data.js: scans onboarded repos from mapping file, finds fix/cve-* PRs, aggregates metrics, pushes data.json to repo Dashboard (public/index.html): - Overview: stat cards + timeline chart + component/status charts - Fix PRs: full table with status, CVE, component, repo, dates - CVEs: list of unique CVEs with PR counts and component breakdown - Components: per-component stat cards PatternFly + Chart.js, same visual style as shepard dashboard. No dependency on or mixing with any other dashboard. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
…acking component-repository-mappings.json: - Apply simplified schema (repos[] instead of nested repositories/container_to_repo_mapping) - Remove unused components (AI Core Dashboard, Model Serving, Notebooks Images, AI Pipelines, Notebooks Server, Training Kubeflow) - Fix repo types: opendatahub-io=midstream, red-hat-data-services=downstream, others=upstream - Add Observability component (14 stolostron repos with ACM containers) from PR ambient-code#103 converted to new simplified schema cve.fix.md: - Add --label cve-fixer-automated to every gh pr create call with graceful fallback if label doesn't exist in the target repo - Allow both plain and linked Jira issue IDs in PR body (both are fine) - Add note that Jira IDs are required for dashboard tracking Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
vmrh21
force-pushed
the
simplify-mapping-and-onboard
branch
from
10ee961 to
7a62e16
Compare
…without label If --label cve-fixer-automated fails (label doesn't exist in repo), <!-- cve-fixer-workflow --> in the PR body acts as a reliable fallback. The dashboard collector checks branch name, title, label, OR body marker. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Three modes: - Mode A (fully onboarded): ask user if they want to add repos or just regenerate examples.md — skips mapping update if examples only - Mode B (partially onboarded): collect new repos, merge with existing component entry, regenerate examples for all repos - Mode C (new): full onboard flow as before Detects mode by checking component-repository-mappings.json before asking any questions. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
♻️ Duplicate comments (1)
workflows/cve-fixer/.claude/commands/cve.fix.md (1)
98-167:⚠️ Potential issue | 🔴 CriticalOld-schema references in the same file will break under the new mapping.
This PR flattens the mapping to
repos[]with fieldsurl,type,active_branches,containers,subcomponent, but Steps 2–3 in this file still reference the removed keys:
- Line 98:
default_branch, github_url, active_release_branches- Line 99:
Branch strategy and CVE fix workflow- Line 135: lookup in
container_to_repo_mapping- Lines 140–141:
repositoriessection /.repositories[.value].subcomponentsemantics- Lines 156–167: reads
active_release_branchesintoACTIVE_RELEASE_BRANCHES- Lines 1487–1521 (Notes / example JSON): describes the old schema shape (
container_to_repo_mapping,repositories{...},cve_fix_workflow,repo_type).Net effect at runtime:
container_to_repo_mappinglookups always miss (falls back to "all component repos"), andactive_release_branchesresolves empty, soTARGET_BRANCHEScollapses to justdefault_branch— backports acrossactive_branchessilently stop happening. This is a functional regression, not just stale docs.Please update these sections to the new schema (
$c.repos[],.type,.url,.containers[],.active_branches,.subcomponent) and refresh the example JSON in the Notes section to matchcomponent-repository-mappings.json.#!/bin/bash # Confirm old schema identifiers remain in cve.fix.md and related commands/docs. rg -nP '\b(container_to_repo_mapping|active_release_branches|github_url|cve_fix_workflow|repo_type)\b' \ workflows/cve-fixer🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@workflows/cve-fixer/.claude/commands/cve.fix.md` around lines 98 - 167, The document still references the old mapping schema (container_to_repo_mapping, github_url, default_branch, active_release_branches, repositories, cve_fix_workflow, repo_type) causing runtime mismatches; update Steps 2–3 and all lookups to use the new flattened schema $c.repos[] and its fields (.url, .type, .containers[], .subcomponent, .active_branches) — change the container lookup to search each repo's .containers[], derive target branches from .active_branches + the primary branch (e.g., .active_branches + default branch stored on the repo entry), replace references to repositories[...].subcomponent with repo .subcomponent logic, and refresh the example JSON/Notes to reflect the new repos[] shape so TARGET_BRANCHES calculation and container mappings work with the new keys.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@workflows/cve-fixer/.claude/commands/cve.fix.md`:
- Around line 1246-1256: The comment is wrong and stderr is being swallowed;
change the flow to test for the label before attempting the first gh pr create
and stop redirecting stderr: use something like gh label view
"cve-fixer-automated" (or equivalent) to detect if the label exists and then
call gh pr create --base <target-branch> --title "Security: Fix CVE-YYYY-XXXXX
(<package-name>)" --body "$PR_BODY" --label "cve-fixer-automated" when present,
otherwise call gh pr create without --label; remove the 2>/dev/null so real
errors from gh (auth/network/validation) are not masked, and update the inline
note to state that --label causes gh to fail if the label is missing rather than
silently succeeding.
In `@workflows/cve-fixer/.claude/commands/onboard.md`:
- Line 324: The current line writes generated markdown with echo which can
mangle backslashes and leading hyphens; change the writing to a safe method such
as using printf '%s\n' to write "${GENERATED_EXAMPLES[$i]}" into
"${EXAMPLES_DIR}/examples.md" (or use a here-doc) so code fences, regex
backslashes and HTML comments are preserved; update the write operation that
references GENERATED_EXAMPLES and EXAMPLES_DIR in this onboarding script
accordingly.
- Around line 319-326: The onboarding script writes per-repo examples into
WORKFLOWS_DIR via EXAMPLES_DIR="workflows/cve-fixer/.cve-fix/$(echo "$REPO_FULL"
| tr '/' '-')" (variables: REPO_URLS, REPO_FULL, EXAMPLES_DIR,
GENERATED_EXAMPLES) but the fixer expects ${REPO_DIR}/.cve-fix inside each
cloned target repo (cve.fix.md Step 4.5), so pick one fix and apply it
consistently: either (A) change the fixer (Step 4.5) to also check
workflows/cve-fixer/.cve-fix/<sanitized-repo>/ after cloning (add lookup for
that path alongside ${REPO_DIR}/.cve-fix), or (B) change the onboard loop to
create and push examples.md directly into each target repo root at
.cve-fix/examples.md (open PRs against the target repos instead of committing to
the workflows repo) so the files appear at ${REPO_DIR}/.cve-fix when cloned;
implement the chosen option across both scripts and ensure references to
EXAMPLES_DIR/REPO_FULL and lookup for ${REPO_DIR}/.cve-fix are updated to match.
---
Duplicate comments:
In `@workflows/cve-fixer/.claude/commands/cve.fix.md`:
- Around line 98-167: The document still references the old mapping schema
(container_to_repo_mapping, github_url, default_branch, active_release_branches,
repositories, cve_fix_workflow, repo_type) causing runtime mismatches; update
Steps 2–3 and all lookups to use the new flattened schema $c.repos[] and its
fields (.url, .type, .containers[], .subcomponent, .active_branches) — change
the container lookup to search each repo's .containers[], derive target branches
from .active_branches + the primary branch (e.g., .active_branches + default
branch stored on the repo entry), replace references to
repositories[...].subcomponent with repo .subcomponent logic, and refresh the
example JSON/Notes to reflect the new repos[] shape so TARGET_BRANCHES
calculation and container mappings work with the new keys.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 6f245f9e-6d42-4fac-83cb-97cafbb0dded
📒 Files selected for processing (3)
workflows/cve-fixer/.claude/commands/cve.fix.mdworkflows/cve-fixer/.claude/commands/onboard.mdworkflows/cve-fixer/component-repository-mappings.json
Comment on lines
+1246
to
1256
| --base <target-branch> \ | ||
| --title "Security: Fix CVE-YYYY-XXXXX (<package-name>)" \ | ||
| --body "$PR_BODY" \ | ||
| --label "cve-fixer-automated" 2>/dev/null || \ | ||
| gh pr create \ | ||
| --base <target-branch> \ | ||
| --title "Security: Fix CVE-YYYY-XXXXX (<package-name>)" \ | ||
| --body "$PR_BODY") | ||
| # Note: --label silently fails if the label doesn't exist in the repo. | ||
| # The fallback without --label ensures PR is always created. | ||
|
|
Contributor
There was a problem hiding this comment.
Comment contradicts the code path.
The inline note says "--label silently fails if the label doesn't exist," but the whole reason a fallback gh pr create without --label exists is that gh pr create --label <missing> returns non-zero and aborts PR creation. If it truly silently failed, the fallback wouldn't be needed. Also, 2>/dev/null on the first call swallows every stderr (auth errors, network, validation), so the fallback can retry for unrelated reasons and mask real failures.
Suggested wording + stderr handling
- PR_URL=$(gh pr create \
- --base <target-branch> \
- --title "Security: Fix CVE-YYYY-XXXXX (<package-name>)" \
- --body "$PR_BODY" \
- --label "cve-fixer-automated" 2>/dev/null || \
- gh pr create \
- --base <target-branch> \
- --title "Security: Fix CVE-YYYY-XXXXX (<package-name>)" \
- --body "$PR_BODY")
- # Note: --label silently fails if the label doesn't exist in the repo.
- # The fallback without --label ensures PR is always created.
+ # `gh pr create --label <name>` fails (non-zero, no PR created) when the
+ # label does not exist in the repo. Retry once without --label so the PR
+ # is still created. Keep stderr visible so unrelated failures surface.
+ PR_URL=$(gh pr create \
+ --base <target-branch> \
+ --title "Security: Fix CVE-YYYY-XXXXX (<package-name>)" \
+ --body "$PR_BODY" \
+ --label "cve-fixer-automated") \
+ || PR_URL=$(gh pr create \
+ --base <target-branch> \
+ --title "Security: Fix CVE-YYYY-XXXXX (<package-name>)" \
+ --body "$PR_BODY")📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| --base <target-branch> \ | |
| --title "Security: Fix CVE-YYYY-XXXXX (<package-name>)" \ | |
| --body "$PR_BODY" \ | |
| --label "cve-fixer-automated" 2>/dev/null || \ | |
| gh pr create \ | |
| --base <target-branch> \ | |
| --title "Security: Fix CVE-YYYY-XXXXX (<package-name>)" \ | |
| --body "$PR_BODY") | |
| # Note: --label silently fails if the label doesn't exist in the repo. | |
| # The fallback without --label ensures PR is always created. | |
| # `gh pr create --label <name>` fails (non-zero, no PR created) when the | |
| # label does not exist in the repo. Retry once without --label so the PR | |
| # is still created. Keep stderr visible so unrelated failures surface. | |
| PR_URL=$(gh pr create \ | |
| --base <target-branch> \ | |
| --title "Security: Fix CVE-YYYY-XXXXX (<package-name>)" \ | |
| --body "$PR_BODY" \ | |
| --label "cve-fixer-automated") \ | |
| || PR_URL=$(gh pr create \ | |
| --base <target-branch> \ | |
| --title "Security: Fix CVE-YYYY-XXXXX (<package-name>)" \ | |
| --body "$PR_BODY") |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@workflows/cve-fixer/.claude/commands/cve.fix.md` around lines 1246 - 1256,
The comment is wrong and stderr is being swallowed; change the flow to test for
the label before attempting the first gh pr create and stop redirecting stderr:
use something like gh label view "cve-fixer-automated" (or equivalent) to detect
if the label exists and then call gh pr create --base <target-branch> --title
"Security: Fix CVE-YYYY-XXXXX (<package-name>)" --body "$PR_BODY" --label
"cve-fixer-automated" when present, otherwise call gh pr create without --label;
remove the 2>/dev/null so real errors from gh (auth/network/validation) are not
masked, and update the inline note to state that --label causes gh to fail if
the label is missing rather than silently succeeding.
The mapping update PR goes to ambient-code/workflows (correct). The .cve-fix/examples.md files go as separate PRs to each component repo (e.g. stolostron/multicluster-observability-operator), not to the workflows repo. Two separate PRs created per /onboard run: 1. ambient-code/workflows ← mapping update only 2. Each component repo ← .cve-fix/examples.md only Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
cve.find.md: - Update subcomponent jq query for new simplified schema: .repos[].containers instead of container_to_repo_mapping/repositories cve.fix.md: - Fix misleading comment: --label exits non-zero (not silent), fallback exists for that reason; 2>/dev/null only suppresses the label error onboard.md: - Use __ as directory separator (not -) to avoid org/repo-name vs org-repo/name collision ambiguity - Use printf '%s\n' instead of echo for writing generated markdown (echo interprets backslashes, corrupts code fences and regexes) - Make co-author attribution version-agnostic: Claude instead of Claude Sonnet 4.6 (1M context) component-repository-mappings.json: - All repos already have correct types (no unknown values exist) Co-Authored-By: Claude <noreply@anthropic.com>
- Step 3.1: look up container in repos[].containers[] (not container_to_repo_mapping) - Step 3.2: iterate .components[X].repos[] (not repositories object) - Example JSON updated from old nested structure to new flat repos[] array Co-Authored-By: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Simplified
component-repository-mappings.jsonThe old schema had deeply nested objects with lots of prose-only fields that the workflow never actually read. The new schema is flat and focused on what the workflow needs:
Before:
{ "ComponentName": { "container_to_repo_mapping": { "container": "repo" }, "repositories": { "org/repo": { "github_url": "...", "default_branch": "main", "active_release_branches": [...], "branch_strategy": "...", "repo_type": "upstream", "subcomponent": "...", "cve_fix_workflow": { "primary_target": "...", "backport_targets": "..." }, "build_location": "..." } } } }After:
{ "ComponentName": { "repos": [ { "url": "https://github.com/org/repo", "type": "upstream|midstream|downstream", "default_branch": "main", "active_branches": ["rhoai-3.4"], "containers": ["rhoai/odh-container-rhel9"], "subcomponent": "optional" } ] } }Removed fields:
branch_strategy,cve_fix_workflow,protected_branches,repository_type,monorepo_packages— none of these were read by the workflow commands.Containers now live on the repo that builds them instead of a separate top-level mapping.
File size: ~30KB → ~20KB.
/onboardnow generates.cve-fix/examples.mdAdded Step 5 to the onboard command: after collecting repo info, it analyzes recent CVE-related merged PRs in each repo and generates a
.cve-fix/examples.mdfile covering:The guidance file is included in the same onboarding PR alongside the mapping update. Repos with <3 CVE PRs get a placeholder noting they should run
/guidance.updateafter more CVE fixes accumulate.Test plan
/cve.find llm-d— verify it reads new schema correctly/cve.fix— verify it readsrepos[].containersandrepos[].active_branches/onboard— verify it writes new schema format and generates examples.md🤖 Generated with Claude Code