[rhoai-2.25] restore codeserver to last ppc64le-known-good build#2522
[rhoai-2.25] restore codeserver to last ppc64le-known-good build#2522ysok wants to merge 2 commits into
Conversation
Restore codeserver/ubi9-python-3.12 to commit c985e11 (2026-05-29), the last Konflux push that successfully published a ppc64le image for odh-workbench-codeserver-datascience-cpu-py312-rhel9. This intentionally rolls back later codeserver-only changes (Gateway API nginx proxy updates, Code Server / extension bumps, pylock refreshes) until a new multi-arch build succeeds on ppc64le. Co-authored-by: Cursor <cursoragent@cursor.com>
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Warning Review limit reached
Next review available in: 49 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughUpdates the UBI9 Python 3.12 code-server image builds, dependency and extension versions, nginx routing and logging configuration, startup scripts, and Python environment selection. ChangesCode-server image build and runtime routing
Estimated code review effort: 4 (Complex) | ~60 minutes Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
/build-codeserver |
|
@ysok — This PR is from a fork. Recommended: Push your branch to the main repo for full CI: Then open a new PR from that branch. No push access? A maintainer will cherry-pick and test your changes. See CONTRIBUTING.md for details. |
…/label Update PaC annotations on the codeserver pull-request PipelineRun so /build-konflux, /build-codeserver, and kfbuild-* labels can trigger the build for validating the known-good restore on PR red-hat-data-services#2522. Co-authored-by: Cursor <cursoragent@cursor.com>
|
/build-codeserver |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (2)
codeserver/ubi9-python-3.12/run-nginx.sh (1)
21-21: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winUnquoted
$NB_PREFIXand$NOTEBOOK_ARGSrisk word splitting;exportmasks pipeline failures.With
set -eactive, ifgrep -Po 'hub_host":\K.*?(?=")'fails to match in$NOTEBOOK_ARGS, the failure is masked by theexport BASE_URL=$(...)assignment, leavingBASE_URLempty or partially set without aborting. Quoting the variables and separating the assignment fromexportwould make failures visible.♻️ Proposed refactor
-export BASE_URL=$(echo $NB_PREFIX | awk -F/ '{ print $4"-"$3 }')$(echo $NOTEBOOK_ARGS | grep -Po 'hub_host":"\K.*?(?=")' | awk -F/ '{ print $3 }' | awk -F. '{for (i=2; i<=NF; i++) printf ".%s", $i}') +BASE_URL="$(echo "$NB_PREFIX" | awk -F/ '{ print $4"-"$3 }')" +BASE_URL="${BASE_URL}$(echo "$NOTEBOOK_ARGS" | grep -Po 'hub_host":"\K.*?(?=")' | awk -F/ '{ print $3 }' | awk -F. '{for (i=2; i<=NF; i++) printf ".%s", $i}')" +export BASE_URL🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@codeserver/ubi9-python-3.12/run-nginx.sh` at line 21, Update the BASE_URL construction in run-nginx.sh to quote NB_PREFIX and NOTEBOOK_ARGS wherever they are expanded, and split command substitution assignment from export so pipeline or grep failures are not masked by export. Preserve the existing BASE_URL value-building behavior while ensuring unmatched hub_host extraction causes the script to fail under set -e.codeserver/ubi9-python-3.12/pylock.toml (1)
181-184: 🔒 Security & Privacy | 🔵 TrivialRestored lockfile reintroduces packages with known HIGH-severity CVEs — track separately rather than fixing in this rollback.
OSV Scanner flags
click==8.3.1,protobuf==6.33.3(JSON recursion depth bypass),pyjwt==2.10.1(several GHSAs including JWKS SSRF/DoS and algorithm allow-list bypass issues),starlette==1.2.0(form-limit DoS, host-header poisoning), andurllib3==2.6.3(decompression-bomb bypass, cross-origin header leak) in this restored lockfile.Since this PR intentionally restores the exact dependency state of a previously-working Konflux commit, patching these here would work against that goal and risks reintroducing the ppc64le build failures the rollback is meant to fix. Recommend tracking these in a dedicated CVE-remediation follow-up once the rollback is verified stable.
Based on learnings, "do not regenerate or update per-image pylock.toml files as part of CVE-fix PRs ... lock regeneration should be handled by CI/maintainers instead."
Also applies to: 1612-1625, 1854-1857, 2410-2413, 2498-2501
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@codeserver/ubi9-python-3.12/pylock.toml` around lines 181 - 184, Keep the restored dependency versions in the per-image pylock.toml files unchanged; do not regenerate or update these lockfiles to remediate the listed CVEs in this rollback. Track click, protobuf, pyjwt, starlette, and urllib3 vulnerabilities separately for a dedicated follow-up, with lock regeneration deferred to CI or maintainers.Sources: Learnings, Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@codeserver/ubi9-python-3.12/pylock.toml`:
- Around line 181-184: Keep the restored dependency versions in the per-image
pylock.toml files unchanged; do not regenerate or update these lockfiles to
remediate the listed CVEs in this rollback. Track click, protobuf, pyjwt,
starlette, and urllib3 vulnerabilities separately for a dedicated follow-up,
with lock regeneration deferred to CI or maintainers.
In `@codeserver/ubi9-python-3.12/run-nginx.sh`:
- Line 21: Update the BASE_URL construction in run-nginx.sh to quote NB_PREFIX
and NOTEBOOK_ARGS wherever they are expanded, and split command substitution
assignment from export so pipeline or grep failures are not masked by export.
Preserve the existing BASE_URL value-building behavior while ensuring unmatched
hub_host extraction causes the script to fail under set -e.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: ff55e18d-e7ac-419a-9c5a-e6481a4165bb
📒 Files selected for processing (14)
codeserver/ubi9-python-3.12/Dockerfile.cpucodeserver/ubi9-python-3.12/Dockerfile.konflux.cpucodeserver/ubi9-python-3.12/get_code_server_rpm.shcodeserver/ubi9-python-3.12/nginx/httpconf/http.confcodeserver/ubi9-python-3.12/nginx/serverconf/proxy.conf.templatecodeserver/ubi9-python-3.12/nginx/serverconf/proxy.conf.template_nbprefixcodeserver/ubi9-python-3.12/pylock.tomlcodeserver/ubi9-python-3.12/pyproject.tomlcodeserver/ubi9-python-3.12/run-code-server.shcodeserver/ubi9-python-3.12/run-nginx.shcodeserver/ubi9-python-3.12/utils/ms-python.python-2025.14.0.vsixcodeserver/ubi9-python-3.12/utils/ms-python.python-2026.4.0.vsixcodeserver/ubi9-python-3.12/utils/ms-toolsai.jupyter-2025.8.0.vsixcodeserver/ubi9-python-3.12/utils/ms-toolsai.jupyter-2025.9.1.vsix
💤 Files with no reviewable changes (3)
- codeserver/ubi9-python-3.12/utils/ms-toolsai.jupyter-2025.9.1.vsix
- codeserver/ubi9-python-3.12/utils/ms-python.python-2026.4.0.vsix
- codeserver/ubi9-python-3.12/run-code-server.sh
|
PR needs rebase. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
1 participant
Summary
codeserver/ubi9-python-3.12onrhoai-2.25to commitc985e1117cea(2026-05-29), the last Konflux build that successfully published a ppc64le image forodh-workbench-codeserver-datascience-cpu-py312-rhel9.rhoai-2.25-linux-ppc64lestill points at that commit (Created: 2026-05-29T19:27:43Z,vcs-ref: c985e1117cea...). No newer commit tag contains an updated ppc64le layer; Konflux codeserveron-pushhas been failing since then.What this rolls back (intentionally)
Relative to current
rhoai-2.25, this undoes codeserver-only changes landed after the last good build, including:proxy_passupdatespylock.toml/pyproject.tomlrefreshesrun-nginx.sh/run-code-server.shchangesTest plan
odh-workbench-codeserver-datascience-cpu-py312-v2-25-on-pushsucceeds on this PR/mergerhoai-2.25-linux-ppc64le, withvcs-refmatching this changeMade with Cursor
Summary by CodeRabbit
New Features
Bug Fixes
Updates