test: validate tenant OpenBao authorization#106
Conversation
Readiness evidenceReviewed commit:
Security floor: widened/cross-tenant paths, incomplete permissions, duplicate declarations, and identity mismatches now fail before merge. Developer experience: adopters still run the same rename and deploy flow; feedback moves into the existing pull-request/weekly gate with no new input or production step. |
@coderabbitai review |
|
✅ Action performedReview finished.
|
|
Warning Review limit reached
Next review available in: 24 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (3)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/validate-scaffold.yaml (1)
324-336: 🚀 Performance & Scalability | 🟡 Minor | ⚡ Quick winSet this sparse checkout to non-cone mode. This list includes file-level paths, but
actions/checkoutleaves cone mode enabled by default. Addsparse-checkout-cone-mode: false(or switch these entries to directories) to keep the checkout narrow.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/validate-scaffold.yaml around lines 324 - 336, Update the checkout step identified by “Checkout Platform contracts” to set sparse-checkout-cone-mode to false, preserving the existing file-level sparse-checkout entries and narrow checkout scope.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/platform-tenant-envelope.test.sh`:
- Around line 92-121: Anchor role_header to the role command’s trailing
continuation marker, matching the complete declaration rather than a tenant-name
substring. Update both the role_count grep and the role_block awk search around
role_header so only the exact tenant role command is counted and captured, while
preserving the existing role block extraction and validation.
---
Outside diff comments:
In @.github/workflows/validate-scaffold.yaml:
- Around line 324-336: Update the checkout step identified by “Checkout Platform
contracts” to set sparse-checkout-cone-mode to false, preserving the existing
file-level sparse-checkout entries and narrow checkout scope.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: d2a88bb0-91f3-4852-b0a0-4b68d443e08e
📒 Files selected for processing (4)
.github/workflows/validate-scaffold.yamlREADME.mdscripts/platform-tenant-envelope-contract.test.shscripts/platform-tenant-envelope.test.sh
📜 Review details
🧰 Additional context used
🧠 Learnings (1)
📚 Learning: 2026-07-21T19:05:11.308Z
Learnt from: devantler
Repo: devantler-tech/gitops-tenant-template PR: 96
File: scripts/platform-network-floor.test.sh:186-187
Timestamp: 2026-07-21T19:05:11.308Z
Learning: When reviewing this repository’s shell scripts under scripts/, do not flag `yq eval -r` as an unsupported option. The repo uses Mike Farah `yq` v4.53.3, where `-r` is supported as `--unwrapScalar` (e.g., `yq eval -r ...`), and this usage is covered/validated by the Platform Admissibility CI job.
Applied to files:
scripts/platform-tenant-envelope-contract.test.shscripts/platform-tenant-envelope.test.sh
🔇 Additional comments (6)
.github/workflows/validate-scaffold.yaml (1)
18-18: LGTM!Also applies to: 38-39
README.md (1)
77-77: LGTM!scripts/platform-tenant-envelope-contract.test.sh (1)
39-42: LGTM!Also applies to: 67-107, 216-219, 229-231, 243-243
scripts/platform-tenant-envelope.test.sh (3)
132-148: LGTM!Also applies to: 242-242
351-465: LGTM!Also applies to: 580-580
66-71: 🎯 Functional CorrectnessNo issue:
rename-placeholders.shalready anchorsdeploy/to its own directory.> Likely an incorrect or invalid review comment.
Updated readiness evidenceReviewed commit:
|
@coderabbitai review |
|
✅ Action performedReview finished.
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 767e3af06d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Updated readiness evidenceReviewed commit:
|
@coderabbitai review |
@codex review |
|
✅ Action performedReview finished.
|
|
Codex Review: Didn't find any major issues. Breezy! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Promotion gateReviewed commit:
All genuine-readiness conditions are satisfied; promoting this routine-owned draft. |
1 participant
Why
The tenant scaffold could prove its SecretStore shape while missing drift in Platform's actual OpenBao policy and Kubernetes-auth role. That allowed a newly adopted tenant to pass template validation and discover a secret-authorization failure only during reconciliation.
What
Security floor: cross-tenant/widened secret paths, incomplete capabilities, duplicate declarations, and mismatched identities now fail before merge.
Developer experience: the normal rename-and-deploy path is unchanged; adopters get the failure earlier in the existing validation gate.
Fixes #105
Part of #6