ci: combine kind test and image publish into single workflow#18
Conversation
Replace separate publish-images.yml with unified test-kind.yml that runs kind-based e2e tests on PRs and pushes, then conditionally publishes images. Pins all actions to commit hashes. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
Warning Review limit reached
More reviews will be available in 49 minutes and 14 seconds. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits. 🚦 How do rate limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe standalone ChangesConsolidated CI Workflow
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Strip the e2e test down to a basic smoke test (deploy operator, create Claw CR, wait for Ready) that works against main without the diagnostics feature branch. OTel-specific validation belongs in the feature PR. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/test-kind.yml:
- Around line 79-96: The operator readiness check in the "Wait for operator pod"
step currently only verifies the pod phase is "Running" but does not check if
the pod has actually reached a Ready state, and the script does not fail if the
pod never becomes ready within the timeout window. Modify the readiness check to
verify the pod's Ready condition (check the
.status.conditions[?(@.type=="Ready")].status field) in addition to or instead
of just checking the Running phase, and add an explicit failure after the for
loop completes without finding a ready pod by adding a check that exits with a
non-zero status code if the POD variable remains empty after 60 iterations.
- Around line 50-55: The Kind binary downloaded in the Install Kind step lacks
cryptographic verification, creating a supply-chain security gap. After the curl
command that downloads the Kind binary to ./kind, add a second curl command to
fetch the SHA256 checksum from
https://kind.sigs.k8s.io/dl/v0.32.0/kind-linux-amd64.sha256sum and pipe it to
sha256sum -c to verify the downloaded binary's integrity before proceeding with
chmod and installation.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: 1ae1feb9-eb26-46b9-aab6-b36dc7d87902
📒 Files selected for processing (2)
.github/workflows/publish-images.yml.github/workflows/test-kind.yml
💤 Files with no reviewable changes (1)
- .github/workflows/publish-images.yml
| - name: Install Kind | ||
| run: | | ||
| curl -Lo ./kind https://kind.sigs.k8s.io/dl/v0.32.0/kind-linux-amd64 | ||
| chmod +x ./kind | ||
| sudo mv ./kind /usr/local/bin/kind | ||
| kind version |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat -n .github/workflows/test-kind.yml | head -160Repository: redhat-et/claw-operator
Length of output: 6052
Verify downloaded artifacts and use digest-pinned images to close supply-chain gaps.
Three external artifacts lack cryptographic verification:
-
Line 52: Kind binary downloaded without checksum. Add SHA256 verification:
curl -Lo ./kind https://kind.sigs.k8s.io/dl/v0.32.0/kind-linux-amd64 curl -L https://kind.sigs.k8s.io/dl/v0.32.0/kind-linux-amd64.sha256sum | sha256sum -c -
Line 68: cert-manager manifest applied without verification. Fetch and verify the manifest hash from the release before applying.
-
Line 139: OTel collector image uses tag-only reference. Replace with digest:
image: mirror.gcr.io/otel/opentelemetry-collector@sha256:<digest>
This hardens the CI supply chain by ensuring only verified artifacts run in the test environment.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/test-kind.yml around lines 50 - 55, The Kind binary
downloaded in the Install Kind step lacks cryptographic verification, creating a
supply-chain security gap. After the curl command that downloads the Kind binary
to ./kind, add a second curl command to fetch the SHA256 checksum from
https://kind.sigs.k8s.io/dl/v0.32.0/kind-linux-amd64.sha256sum and pipe it to
sha256sum -c to verify the downloaded binary's integrity before proceeding with
chmod and installation.
Add checksum verification for the Kind binary download to close a supply-chain gap. Replace the manual polling loop for the operator pod with kubectl wait. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
@pavelanni can I get a review here? |
Merges ci/unified-workflow (PR #18) into this branch: replaces publish-images.yml with test-kind.yml that combines Kind e2e and conditional image publishing. Extends the kind test job with three new steps: - Build and load the skill OCI image into Kind - Apply a Claw CR with skills.content, skills.images, and skills.configMaps - Assert all three delivery mechanisms: ConfigMap keys (_skill_greeting, _skill_sales-playbook, _skill_onboarding) and ImageVolume shape (reference, mountPath, readOnly) Depends on PR #18 merging first. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Incorporates PR #18 (ci/unified-workflow): replaces publish-images.yml with test-kind.yml that combines Kind e2e testing with conditional image publishing. Pins all GitHub Actions to commit hashes for supply chain security. Extends the kind test job with skill-specific steps: - Builds a minimal FROM-scratch OCI skill image and loads it into Kind with pullPolicy: IfNotPresent (avoids pull from non-existent registry) - Applies a Claw CR with all three skill types from the start (content, images, configMaps) using a K8s 1.35 node for full ImageVolume support - Validates all three delivery mechanisms by exec-ing into the running gateway pod and checking skill files on disk Also adds main branch to push/PR triggers on the existing workflows (Kubebuilder scaffolding defaulted to master only). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2 participants
Summary
publish-images.ymlwith unifiedtest-kind.ymlthat runs kind-based e2e tests on PRs and pushes, then conditionally publishes imagesTest plan
QUAY_PUBLISH_ENABLEDis set)workflow_dispatchinputs work correctly🤖 Generated with Claude Code
Summary by CodeRabbit