Onboard to distgen generated sources#381
Conversation
Use Jinja2 conditional to handle empty environment_setup properly. When environment_setup is empty (Fedora, C10S, RHEL10), generate 'RUN INSTALL_PKGS=...' instead of 'RUN \n INSTALL_PKGS=...' which caused build failures.
Changed from 'CMD $STI_SCRIPTS_PATH/usage' to 'CMD ["/usr/libexec/s2i/usage"]' to follow Docker best practices and prevent build warnings from breaking image ID extraction in build scripts.
ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (188)
💤 Files with no reviewable changes (125)
📝 WalkthroughWalkthroughThe pull request migrates nginx image generation to distgen, adds multispec-driven Dockerfile templates and runtime scripts, updates generated versioned outputs and documentation, centralizes test assets, and adds CI validation through the distgen-check workflow. ChangesDistgen image generation
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant Contributor
participant Makefile
participant Distgen
participant ImageTree
Contributor->>Makefile: run make generate
Makefile->>Distgen: select manifest and multispec data
Distgen->>ImageTree: render Dockerfiles, runtime files, and links
ImageTree-->>Contributor: generated versioned image directories
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Pull Request validationFailed🔴 Failed or pending statuses:
🔴 Approval - missing or changes were requested Success🟢 Review - Reviewed by a member Triggered by Workflow Run |
|
[test] |
Testing Farm results
|
|
@coderabbitai review |
✅ Action performedReview finished.
|
phracek
left a comment
There was a problem hiding this comment.
Thanks for this pull request. Great.
There is inverted logic.
See here: https://github.com/sclorg/postgresql-container/blob/master/manifest.yml#L47
| # This section is the last one on purpose because the generator.py | ||
| # does not allow dead symlinks. | ||
| SYMLINK_RULES: | ||
| - src: ../1.22/root |
| io.openshift.tags="builder,${NAME},${NAME}-${NGINX_SHORT_VER}" \ | ||
| com.redhat.component="${NAME}-${NGINX_SHORT_VER}-container" \ | ||
| name="{{ spec.org }}/${NAME}-${NGINX_SHORT_VER}-micro" \ | ||
| {% if spec.prod in ["rhel8", "rhel9", "c8s", "c9s"] %} |
There was a problem hiding this comment.
This is not need at all. Please delete it.
| FROM {{ spec.micro_build_base }} AS build | ||
|
|
||
| RUN mkdir -p /mnt/rootfs | ||
| {% if spec.prod == "rhel8" %} |
There was a problem hiding this comment.
Can we somehow make it more readable.
What about to add to multispec.yml more specification and use it there
| INSTALL_PKGS="$MICRO_PKGS nginx-core findutils hostname nss_wrapper-libs gettext " && \ | ||
| dnf install --installroot /mnt/rootfs $INSTALL_PKGS --releasever 36 --setopt install_weak_deps=false --nodocs -y && \ | ||
| INSTALL_PKGS="$MICRO_PKGS {{ spec.micro_pkgs }} " && \ | ||
| dnf --installroot /mnt/rootfs --releasever {{ spec.micro_releasever }} --setopt install_weak_deps=false --nodocs module enable nginx:{{ spec.version }} -y && \ |
There was a problem hiding this comment.
This is repeating. Let's make it easier. More it to multispec.yml
|
|
||
| Usage in OpenShift | ||
| ------------------ | ||
| In this example, we assume that you are using the `ubi9/nginx-{{ spec.short }}` image, available through the `nginx:{{ spec.version }}` imagestream tag in Openshift. |
There was a problem hiding this comment.
This file has hardcoded ubi9 multiple times.
There was a problem hiding this comment.
Actionable comments posted: 10
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/container-tests.yml:
- Around line 7-8: Update the distgen-check reusable workflow reference to use a
reviewed immutable commit SHA instead of `@main`, and add an explicit minimal
permissions block in the workflow configuration so jobs do not inherit default
token permissions. Apply this consistently to the sclorg/ci-actions reusable
workflows in container-tests.yml.
In `@1.20/README.md`:
- Around line 202-204: Update the Dockerfile variant list in the README to
include Dockerfile.rhel9 alongside the existing RHEL, CentOS Stream, and Fedora
entries, keeping the documented list synchronized with the generated Dockerfile
outputs.
In `@1.22-micro/README.md`:
- Around line 68-69: Remove the ./nginx-perl/*.pm documentation entry from
1.22-micro/README.md, since Dockerfile.c9s does not install or configure Perl
module support; do not document payloads unavailable in the micro image.
- Around line 1-4: Update the README description to use the exact user-facing
terms “reverse proxy server” and “Fedora-based,” correcting the current “reverse
server” and “Fedora based” wording while preserving the surrounding content.
In `@README.md`:
- Line 83: Update the “Contributing Guidelines” heading in README.md to use the
repository’s configured setext heading style instead of ATX syntax, preserving
the existing heading text.
In `@src/README.md`:
- Around line 199-204: Update the documentation sentence near the container
image Dockerfile references to replace “Python environment Dockerfiles” with
wording that correctly describes Nginx image Dockerfiles. Preserve the listed
repository, platform names, and Dockerfile filenames unchanged.
- Around line 25-30: Update the test-app repository references in the README
example to use {{ spec.version }}/test/test-app consistently, including the
GitHub link and the related cd command, while preserving the existing oc new-app
context directory.
In `@test/perl-test-app/index.html`:
- Line 1: Add the HTML5 doctype as the first line of
test/perl-test-app/index.html, test/start-hook-test-app/index.html, and
test/start-hook-test-app/index2.html, before each existing html element.
In `@test/perl-test-app/nginx.conf`:
- Around line 59-64: Update the 404 error_page directive and its adjacent
exact-match location so both use the same URI, ensuring 404 responses select
that location; leave the existing 500–504 error handling unchanged.
In `@test/start-hook-test-app/nginx-start/init.sh`:
- Around line 17-19: Align the startup hook’s INDEX_FILE assignment with the
integration test contract by selecting index.html, or update the test
expectation to match index2.html’s “NGINX2 is working” content. Keep the hook
and test consistent so the expected response matches the selected index file.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 6bd3ebe9-1ae2-4a4d-8999-4fc1b5051408
📒 Files selected for processing (188)
.github/workflows/container-tests.yml1.20/.exclude-c9s1.20/.exclude-fedora1.20/.exclude-rhel81.20/Dockerfile.c9s1.20/Dockerfile.fedora1.20/Dockerfile.rhel81.20/Dockerfile.rhel91.20/README.md1.20/root/opt/app-root/etc/generate_container_user1.20/root/opt/app-root/nginxconf-rhscl.sed1.20/s2i/bin/assemble1.20/test1.20/test/__init__.py1.20/test/conftest.py1.20/test/constants.py1.20/test/examples1.20/test/imagestreams1.20/test/run1.20/test/run-openshift-pytest1.20/test/run-openshift-remote-cluster1.20/test/run-pytest1.20/test/test-app1.20/test/test-lib-nginx.sh1.20/test/test-lib-openshift.sh1.20/test/test-lib-remote-openshift.sh1.20/test/test-lib.sh1.20/test/test-openshift.yaml1.20/test/test_container_application.py1.20/test/test_container_basics.py1.20/test/test_container_example_apps.py1.20/test/test_container_sizes.py1.20/test/test_ocp_imagestream_s2i.py1.20/test/test_ocp_imagestreams.py1.20/test/test_ocp_local_example.py1.20/test/test_ocp_remote_example.py1.20/test/test_ocp_shared_helm_imagestreams.py1.20/test/test_ocp_shared_helm_template.py1.20/test/test_ocp_template_example_app.py1.22-micro/.exclude-fedora1.22-micro/Dockerfile.c9s1.22-micro/Dockerfile.rhel81.22-micro/README.md1.22-micro/core-scripts1.22-micro/root1.22-micro/s2i1.22-micro/test1.22/.exclude-c9s1.22/.exclude-fedora1.22/Dockerfile.c9s1.22/Dockerfile.fedora1.22/Dockerfile.rhel81.22/Dockerfile.rhel91.22/README.md1.22/root/opt/app-root/etc/generate_container_user1.22/test1.22/test/__init__.py1.22/test/conftest.py1.22/test/examples1.22/test/imagestreams1.22/test/perl-test-app/index.html1.22/test/perl-test-app/nginx-perl/Version.pm1.22/test/perl-test-app/nginx.conf1.22/test/run1.22/test/run-openshift-pytest1.22/test/run-openshift-remote-cluster1.22/test/run-pytest1.22/test/start-hook-test-app/index.html1.22/test/start-hook-test-app/index2.html1.22/test/start-hook-test-app/nginx-cfg/default.conf1.22/test/start-hook-test-app/nginx-start/init.sh1.22/test/test-app1.22/test/test-lib-nginx.sh1.22/test/test-lib-openshift.sh1.22/test/test-lib-remote-openshift.sh1.22/test/test-lib.sh1.22/test/test-openshift.yaml1.22/test/test_container_application.py1.22/test/test_container_basics.py1.22/test/test_container_example_apps.py1.22/test/test_container_sizes.py1.22/test/test_ocp_imagestream_s2i.py1.22/test/test_ocp_imagestreams.py1.22/test/test_ocp_local_example.py1.22/test/test_ocp_remote_example.py1.22/test/test_ocp_shared_helm_imagestreams.py1.22/test/test_ocp_shared_helm_template.py1.22/test/test_ocp_template_example_app.py1.24/.exclude-c8s1.24/.exclude-fedora1.24/Dockerfile.c9s1.24/Dockerfile.rhel81.24/README.md1.24/root/opt/app-root/etc/generate_container_user1.24/test1.24/test/__init__.py1.24/test/conftest.py1.24/test/constants.py1.24/test/examples1.24/test/imagestreams1.24/test/perl-test-app/index.html1.24/test/perl-test-app/nginx-perl/Version.pm1.24/test/perl-test-app/nginx.conf1.24/test/run1.24/test/run-openshift-pytest1.24/test/run-openshift-remote-cluster1.24/test/run-pytest1.24/test/start-hook-test-app/index.html1.24/test/start-hook-test-app/index2.html1.24/test/start-hook-test-app/nginx-cfg/default.conf1.24/test/start-hook-test-app/nginx-start/init.sh1.24/test/test-app1.24/test/test-lib.sh1.24/test/test_container_application.py1.24/test/test_container_basics.py1.24/test/test_container_example_apps.py1.24/test/test_container_sizes.py1.24/test/test_ocp_imagestream_s2i.py1.24/test/test_ocp_imagestreams.py1.24/test/test_ocp_local_example.py1.24/test/test_ocp_remote_example.py1.24/test/test_ocp_shared_helm_imagestreams.py1.24/test/test_ocp_shared_helm_template.py1.24/test/test_ocp_template_example_app.py1.26/.exclude-rhel81.26/Dockerfile.c10s1.26/Dockerfile.c9s1.26/Dockerfile.fedora1.26/Dockerfile.rhel101.26/Dockerfile.rhel81.26/root/opt/app-root/etc/generate_container_user1.26/test1.26/test/__init__.py1.26/test/conftest.py1.26/test/examples1.26/test/imagestreams1.26/test/perl-test-app/index.html1.26/test/perl-test-app/nginx-perl/Version.pm1.26/test/perl-test-app/nginx.conf1.26/test/run1.26/test/run-openshift-remote-cluster1.26/test/run-pytest1.26/test/start-hook-test-app/index.html1.26/test/start-hook-test-app/index2.html1.26/test/start-hook-test-app/nginx-cfg/default.conf1.26/test/start-hook-test-app/nginx-start/init.sh1.26/test/test-app1.26/test/test-lib-nginx.sh1.26/test/test-lib-openshift.sh1.26/test/test-lib-remote-openshift.sh1.26/test/test-lib.sh1.26/test/test-openshift.yaml1.26/test/test_container_application.py1.26/test/test_container_basics.py1.26/test/test_container_example_apps.py1.26/test/test_container_sizes.py1.26/test/test_ocp_imagestream_s2i.py1.26/test/test_ocp_imagestreams.py1.26/test/test_ocp_local_example.py1.26/test/test_ocp_remote_example.py1.26/test/test_ocp_shared_helm_imagestreams.py1.26/test/test_ocp_shared_helm_template.py1.26/test/test_ocp_template_example_app.pyMakefileREADME.mdmanifest-micro.ymlmanifest.ymlspecs/multispec.ymlsrc/Dockerfilesrc/Dockerfile.fedorasrc/Dockerfile.microsrc/README.mdsrc/root/opt/app-root/etc/generate_container_usersrc/root/opt/app-root/etc/passwd.templatesrc/root/opt/app-root/nginxconf-rhscl.sedsrc/root/opt/app-root/nginxconf.sedsrc/root/usr/share/container-scripts/nginx/common.shsrc/s2i/bin/assemblesrc/s2i/bin/runsrc/s2i/bin/usagetest/perl-test-app/index.htmltest/perl-test-app/nginx-perl/Version.pmtest/perl-test-app/nginx.conftest/start-hook-test-app/index.htmltest/start-hook-test-app/index2.htmltest/start-hook-test-app/nginx-cfg/default.conftest/start-hook-test-app/nginx-start/init.shtest/test-app
💤 Files with no reviewable changes (125)
- 1.20/test/test_ocp_shared_helm_imagestreams.py
- 1.24/test/test_container_sizes.py
- 1.26/test/test_ocp_shared_helm_imagestreams.py
- 1.20/test/examples
- 1.22/test/test-lib-nginx.sh
- 1.24/test/test_ocp_local_example.py
- 1.24/test/test_container_basics.py
- 1.24/test/test_ocp_imagestream_s2i.py
- 1.24/test/test_ocp_imagestreams.py
- 1.26/test/perl-test-app/nginx.conf
- 1.24/test/test_ocp_shared_helm_imagestreams.py
- 1.20/test/imagestreams
- 1.26/test/perl-test-app/index.html
- 1.26/test/examples
- 1.20/test/test_ocp_local_example.py
- 1.20/test/test_container_application.py
- 1.20/test/run-openshift-remote-cluster
- 1.24/test/run-openshift-remote-cluster
- 1.26/test/test_ocp_shared_helm_template.py
- 1.26/test/start-hook-test-app/index2.html
- 1.24/test/imagestreams
- 1.24/test/run
- 1.26/test/run-pytest
- 1.20/Dockerfile.fedora
- 1.20/test/test_ocp_template_example_app.py
- 1.22/test/test_ocp_shared_helm_imagestreams.py
- 1.20/test/test_container_sizes.py
- 1.20/test/conftest.py
- 1.26/test/test_ocp_remote_example.py
- 1.22/test/test_ocp_template_example_app.py
- 1.20/test/test_ocp_shared_helm_template.py
- 1.20/test/test-openshift.yaml
- 1.26/test/init.py
- 1.26/test/test_ocp_template_example_app.py
- 1.22/test/test_container_basics.py
- 1.24/test/test_ocp_remote_example.py
- 1.20/test/init.py
- 1.22/test/perl-test-app/nginx.conf
- 1.24/test/run-openshift-pytest
- 1.24/test/init.py
- 1.22/test/start-hook-test-app/index.html
- 1.20/test/test-lib.sh
- 1.22/test/imagestreams
- 1.26/test/test-lib-nginx.sh
- 1.26/test/test-app
- 1.26/test/test-openshift.yaml
- 1.26/test/test_container_sizes.py
- 1.24/test/test_ocp_shared_helm_template.py
- 1.20/test/test_ocp_remote_example.py
- 1.26/test/test-lib-openshift.sh
- 1.22/test/run-openshift-pytest
- 1.24/test/test_ocp_template_example_app.py
- 1.24/test/examples
- 1.26/test/start-hook-test-app/nginx-start/init.sh
- 1.26/test/start-hook-test-app/index.html
- 1.22/test/perl-test-app/nginx-perl/Version.pm
- 1.26/test/conftest.py
- 1.24/test/perl-test-app/nginx-perl/Version.pm
- 1.20/test/test_ocp_imagestream_s2i.py
- 1.24/test/run-pytest
- 1.22/test/run-openshift-remote-cluster
- 1.24/test/start-hook-test-app/index2.html
- 1.24/test/perl-test-app/nginx.conf
- 1.24/test/start-hook-test-app/nginx-cfg/default.conf
- 1.22/test/perl-test-app/index.html
- 1.22/test/run
- 1.22/test/start-hook-test-app/nginx-cfg/default.conf
- 1.26/test/test_container_example_apps.py
- 1.26/test/test_ocp_imagestream_s2i.py
- 1.22/test/start-hook-test-app/index2.html
- 1.26/test/run
- 1.22/Dockerfile.rhel9
- 1.24/test/start-hook-test-app/index.html
- 1.20/test/test_ocp_imagestreams.py
- 1.24/test/test_container_application.py
- 1.22/test/run-pytest
- 1.22/test/test_container_sizes.py
- 1.24/test/conftest.py
- 1.24/test/test-lib.sh
- 1.26/test/start-hook-test-app/nginx-cfg/default.conf
- 1.22/test/test-lib-openshift.sh
- 1.20/test/test-lib-nginx.sh
- 1.26/test/perl-test-app/nginx-perl/Version.pm
- 1.20/test/test-app
- 1.22/test/start-hook-test-app/nginx-start/init.sh
- 1.20/test/run
- 1.26/test/test_ocp_imagestreams.py
- 1.24/test/test_container_example_apps.py
- 1.20/test/test-lib-remote-openshift.sh
- 1.20/test/constants.py
- 1.22/Dockerfile.fedora
- 1.22/test/test_ocp_local_example.py
- 1.22/test/test_ocp_remote_example.py
- 1.20/test/test-lib-openshift.sh
- 1.20/test/run-openshift-pytest
- 1.26/test/test_container_basics.py
- 1.24/test/perl-test-app/index.html
- 1.20/test/test_container_example_apps.py
- 1.22/test/test-app
- 1.24/test/start-hook-test-app/nginx-start/init.sh
- 1.26/test/test-lib-remote-openshift.sh
- 1.24/test/constants.py
- 1.26/Dockerfile.rhel8
- 1.20/test/run-pytest
- 1.20/test/test_container_basics.py
- 1.22/test/test_ocp_shared_helm_template.py
- 1.22/test/test_container_application.py
- 1.22/test/test_container_example_apps.py
- 1.22/test/test-openshift.yaml
- 1.26/test/test_container_application.py
- 1.26/test/test_ocp_local_example.py
- 1.26/test/run-openshift-remote-cluster
- 1.22/test/test_ocp_imagestreams.py
- 1.26/test/test-lib.sh
- 1.22/test/conftest.py
- 1.22/test/init.py
- 1.22/test/examples
- 1.22/Dockerfile.c9s
- 1.24/test/test-app
- 1.20/Dockerfile.c9s
- 1.26/test/imagestreams
- 1.22/test/test-lib-remote-openshift.sh
- 1.22/test/test_ocp_imagestream_s2i.py
- 1.22/test/test-lib.sh
- 1.22-micro/Dockerfile.rhel8
There was a problem hiding this comment.
Caution
Inline review comments failed to post. This is likely due to GitHub's internal server error or limits when posting large numbers of comments. If you are seeing this consistently it is likely a permissions issue. Please check "Moderation" -> "Code review limits" under your organization settings.
Actionable comments posted: 10
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/container-tests.yml:
- Around line 7-8: Update the distgen-check reusable workflow reference to use a
reviewed immutable commit SHA instead of `@main`, and add an explicit minimal
permissions block in the workflow configuration so jobs do not inherit default
token permissions. Apply this consistently to the sclorg/ci-actions reusable
workflows in container-tests.yml.
In `@1.20/README.md`:
- Around line 202-204: Update the Dockerfile variant list in the README to
include Dockerfile.rhel9 alongside the existing RHEL, CentOS Stream, and Fedora
entries, keeping the documented list synchronized with the generated Dockerfile
outputs.
In `@1.22-micro/README.md`:
- Around line 68-69: Remove the ./nginx-perl/*.pm documentation entry from
1.22-micro/README.md, since Dockerfile.c9s does not install or configure Perl
module support; do not document payloads unavailable in the micro image.
- Around line 1-4: Update the README description to use the exact user-facing
terms “reverse proxy server” and “Fedora-based,” correcting the current “reverse
server” and “Fedora based” wording while preserving the surrounding content.
In `@README.md`:
- Line 83: Update the “Contributing Guidelines” heading in README.md to use the
repository’s configured setext heading style instead of ATX syntax, preserving
the existing heading text.
In `@src/README.md`:
- Around line 199-204: Update the documentation sentence near the container
image Dockerfile references to replace “Python environment Dockerfiles” with
wording that correctly describes Nginx image Dockerfiles. Preserve the listed
repository, platform names, and Dockerfile filenames unchanged.
- Around line 25-30: Update the test-app repository references in the README
example to use {{ spec.version }}/test/test-app consistently, including the
GitHub link and the related cd command, while preserving the existing oc new-app
context directory.
In `@test/perl-test-app/index.html`:
- Line 1: Add the HTML5 doctype as the first line of
test/perl-test-app/index.html, test/start-hook-test-app/index.html, and
test/start-hook-test-app/index2.html, before each existing html element.
In `@test/perl-test-app/nginx.conf`:
- Around line 59-64: Update the 404 error_page directive and its adjacent
exact-match location so both use the same URI, ensuring 404 responses select
that location; leave the existing 500–504 error handling unchanged.
In `@test/start-hook-test-app/nginx-start/init.sh`:
- Around line 17-19: Align the startup hook’s INDEX_FILE assignment with the
integration test contract by selecting index.html, or update the test
expectation to match index2.html’s “NGINX2 is working” content. Keep the hook
and test consistent so the expected response matches the selected index file.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 6bd3ebe9-1ae2-4a4d-8999-4fc1b5051408
📒 Files selected for processing (188)
.github/workflows/container-tests.yml1.20/.exclude-c9s1.20/.exclude-fedora1.20/.exclude-rhel81.20/Dockerfile.c9s1.20/Dockerfile.fedora1.20/Dockerfile.rhel81.20/Dockerfile.rhel91.20/README.md1.20/root/opt/app-root/etc/generate_container_user1.20/root/opt/app-root/nginxconf-rhscl.sed1.20/s2i/bin/assemble1.20/test1.20/test/__init__.py1.20/test/conftest.py1.20/test/constants.py1.20/test/examples1.20/test/imagestreams1.20/test/run1.20/test/run-openshift-pytest1.20/test/run-openshift-remote-cluster1.20/test/run-pytest1.20/test/test-app1.20/test/test-lib-nginx.sh1.20/test/test-lib-openshift.sh1.20/test/test-lib-remote-openshift.sh1.20/test/test-lib.sh1.20/test/test-openshift.yaml1.20/test/test_container_application.py1.20/test/test_container_basics.py1.20/test/test_container_example_apps.py1.20/test/test_container_sizes.py1.20/test/test_ocp_imagestream_s2i.py1.20/test/test_ocp_imagestreams.py1.20/test/test_ocp_local_example.py1.20/test/test_ocp_remote_example.py1.20/test/test_ocp_shared_helm_imagestreams.py1.20/test/test_ocp_shared_helm_template.py1.20/test/test_ocp_template_example_app.py1.22-micro/.exclude-fedora1.22-micro/Dockerfile.c9s1.22-micro/Dockerfile.rhel81.22-micro/README.md1.22-micro/core-scripts1.22-micro/root1.22-micro/s2i1.22-micro/test1.22/.exclude-c9s1.22/.exclude-fedora1.22/Dockerfile.c9s1.22/Dockerfile.fedora1.22/Dockerfile.rhel81.22/Dockerfile.rhel91.22/README.md1.22/root/opt/app-root/etc/generate_container_user1.22/test1.22/test/__init__.py1.22/test/conftest.py1.22/test/examples1.22/test/imagestreams1.22/test/perl-test-app/index.html1.22/test/perl-test-app/nginx-perl/Version.pm1.22/test/perl-test-app/nginx.conf1.22/test/run1.22/test/run-openshift-pytest1.22/test/run-openshift-remote-cluster1.22/test/run-pytest1.22/test/start-hook-test-app/index.html1.22/test/start-hook-test-app/index2.html1.22/test/start-hook-test-app/nginx-cfg/default.conf1.22/test/start-hook-test-app/nginx-start/init.sh1.22/test/test-app1.22/test/test-lib-nginx.sh1.22/test/test-lib-openshift.sh1.22/test/test-lib-remote-openshift.sh1.22/test/test-lib.sh1.22/test/test-openshift.yaml1.22/test/test_container_application.py1.22/test/test_container_basics.py1.22/test/test_container_example_apps.py1.22/test/test_container_sizes.py1.22/test/test_ocp_imagestream_s2i.py1.22/test/test_ocp_imagestreams.py1.22/test/test_ocp_local_example.py1.22/test/test_ocp_remote_example.py1.22/test/test_ocp_shared_helm_imagestreams.py1.22/test/test_ocp_shared_helm_template.py1.22/test/test_ocp_template_example_app.py1.24/.exclude-c8s1.24/.exclude-fedora1.24/Dockerfile.c9s1.24/Dockerfile.rhel81.24/README.md1.24/root/opt/app-root/etc/generate_container_user1.24/test1.24/test/__init__.py1.24/test/conftest.py1.24/test/constants.py1.24/test/examples1.24/test/imagestreams1.24/test/perl-test-app/index.html1.24/test/perl-test-app/nginx-perl/Version.pm1.24/test/perl-test-app/nginx.conf1.24/test/run1.24/test/run-openshift-pytest1.24/test/run-openshift-remote-cluster1.24/test/run-pytest1.24/test/start-hook-test-app/index.html1.24/test/start-hook-test-app/index2.html1.24/test/start-hook-test-app/nginx-cfg/default.conf1.24/test/start-hook-test-app/nginx-start/init.sh1.24/test/test-app1.24/test/test-lib.sh1.24/test/test_container_application.py1.24/test/test_container_basics.py1.24/test/test_container_example_apps.py1.24/test/test_container_sizes.py1.24/test/test_ocp_imagestream_s2i.py1.24/test/test_ocp_imagestreams.py1.24/test/test_ocp_local_example.py1.24/test/test_ocp_remote_example.py1.24/test/test_ocp_shared_helm_imagestreams.py1.24/test/test_ocp_shared_helm_template.py1.24/test/test_ocp_template_example_app.py1.26/.exclude-rhel81.26/Dockerfile.c10s1.26/Dockerfile.c9s1.26/Dockerfile.fedora1.26/Dockerfile.rhel101.26/Dockerfile.rhel81.26/root/opt/app-root/etc/generate_container_user1.26/test1.26/test/__init__.py1.26/test/conftest.py1.26/test/examples1.26/test/imagestreams1.26/test/perl-test-app/index.html1.26/test/perl-test-app/nginx-perl/Version.pm1.26/test/perl-test-app/nginx.conf1.26/test/run1.26/test/run-openshift-remote-cluster1.26/test/run-pytest1.26/test/start-hook-test-app/index.html1.26/test/start-hook-test-app/index2.html1.26/test/start-hook-test-app/nginx-cfg/default.conf1.26/test/start-hook-test-app/nginx-start/init.sh1.26/test/test-app1.26/test/test-lib-nginx.sh1.26/test/test-lib-openshift.sh1.26/test/test-lib-remote-openshift.sh1.26/test/test-lib.sh1.26/test/test-openshift.yaml1.26/test/test_container_application.py1.26/test/test_container_basics.py1.26/test/test_container_example_apps.py1.26/test/test_container_sizes.py1.26/test/test_ocp_imagestream_s2i.py1.26/test/test_ocp_imagestreams.py1.26/test/test_ocp_local_example.py1.26/test/test_ocp_remote_example.py1.26/test/test_ocp_shared_helm_imagestreams.py1.26/test/test_ocp_shared_helm_template.py1.26/test/test_ocp_template_example_app.pyMakefileREADME.mdmanifest-micro.ymlmanifest.ymlspecs/multispec.ymlsrc/Dockerfilesrc/Dockerfile.fedorasrc/Dockerfile.microsrc/README.mdsrc/root/opt/app-root/etc/generate_container_usersrc/root/opt/app-root/etc/passwd.templatesrc/root/opt/app-root/nginxconf-rhscl.sedsrc/root/opt/app-root/nginxconf.sedsrc/root/usr/share/container-scripts/nginx/common.shsrc/s2i/bin/assemblesrc/s2i/bin/runsrc/s2i/bin/usagetest/perl-test-app/index.htmltest/perl-test-app/nginx-perl/Version.pmtest/perl-test-app/nginx.conftest/start-hook-test-app/index.htmltest/start-hook-test-app/index2.htmltest/start-hook-test-app/nginx-cfg/default.conftest/start-hook-test-app/nginx-start/init.shtest/test-app
💤 Files with no reviewable changes (125)
- 1.20/test/test_ocp_shared_helm_imagestreams.py
- 1.24/test/test_container_sizes.py
- 1.26/test/test_ocp_shared_helm_imagestreams.py
- 1.20/test/examples
- 1.22/test/test-lib-nginx.sh
- 1.24/test/test_ocp_local_example.py
- 1.24/test/test_container_basics.py
- 1.24/test/test_ocp_imagestream_s2i.py
- 1.24/test/test_ocp_imagestreams.py
- 1.26/test/perl-test-app/nginx.conf
- 1.24/test/test_ocp_shared_helm_imagestreams.py
- 1.20/test/imagestreams
- 1.26/test/perl-test-app/index.html
- 1.26/test/examples
- 1.20/test/test_ocp_local_example.py
- 1.20/test/test_container_application.py
- 1.20/test/run-openshift-remote-cluster
- 1.24/test/run-openshift-remote-cluster
- 1.26/test/test_ocp_shared_helm_template.py
- 1.26/test/start-hook-test-app/index2.html
- 1.24/test/imagestreams
- 1.24/test/run
- 1.26/test/run-pytest
- 1.20/Dockerfile.fedora
- 1.20/test/test_ocp_template_example_app.py
- 1.22/test/test_ocp_shared_helm_imagestreams.py
- 1.20/test/test_container_sizes.py
- 1.20/test/conftest.py
- 1.26/test/test_ocp_remote_example.py
- 1.22/test/test_ocp_template_example_app.py
- 1.20/test/test_ocp_shared_helm_template.py
- 1.20/test/test-openshift.yaml
- 1.26/test/init.py
- 1.26/test/test_ocp_template_example_app.py
- 1.22/test/test_container_basics.py
- 1.24/test/test_ocp_remote_example.py
- 1.20/test/init.py
- 1.22/test/perl-test-app/nginx.conf
- 1.24/test/run-openshift-pytest
- 1.24/test/init.py
- 1.22/test/start-hook-test-app/index.html
- 1.20/test/test-lib.sh
- 1.22/test/imagestreams
- 1.26/test/test-lib-nginx.sh
- 1.26/test/test-app
- 1.26/test/test-openshift.yaml
- 1.26/test/test_container_sizes.py
- 1.24/test/test_ocp_shared_helm_template.py
- 1.20/test/test_ocp_remote_example.py
- 1.26/test/test-lib-openshift.sh
- 1.22/test/run-openshift-pytest
- 1.24/test/test_ocp_template_example_app.py
- 1.24/test/examples
- 1.26/test/start-hook-test-app/nginx-start/init.sh
- 1.26/test/start-hook-test-app/index.html
- 1.22/test/perl-test-app/nginx-perl/Version.pm
- 1.26/test/conftest.py
- 1.24/test/perl-test-app/nginx-perl/Version.pm
- 1.20/test/test_ocp_imagestream_s2i.py
- 1.24/test/run-pytest
- 1.22/test/run-openshift-remote-cluster
- 1.24/test/start-hook-test-app/index2.html
- 1.24/test/perl-test-app/nginx.conf
- 1.24/test/start-hook-test-app/nginx-cfg/default.conf
- 1.22/test/perl-test-app/index.html
- 1.22/test/run
- 1.22/test/start-hook-test-app/nginx-cfg/default.conf
- 1.26/test/test_container_example_apps.py
- 1.26/test/test_ocp_imagestream_s2i.py
- 1.22/test/start-hook-test-app/index2.html
- 1.26/test/run
- 1.22/Dockerfile.rhel9
- 1.24/test/start-hook-test-app/index.html
- 1.20/test/test_ocp_imagestreams.py
- 1.24/test/test_container_application.py
- 1.22/test/run-pytest
- 1.22/test/test_container_sizes.py
- 1.24/test/conftest.py
- 1.24/test/test-lib.sh
- 1.26/test/start-hook-test-app/nginx-cfg/default.conf
- 1.22/test/test-lib-openshift.sh
- 1.20/test/test-lib-nginx.sh
- 1.26/test/perl-test-app/nginx-perl/Version.pm
- 1.20/test/test-app
- 1.22/test/start-hook-test-app/nginx-start/init.sh
- 1.20/test/run
- 1.26/test/test_ocp_imagestreams.py
- 1.24/test/test_container_example_apps.py
- 1.20/test/test-lib-remote-openshift.sh
- 1.20/test/constants.py
- 1.22/Dockerfile.fedora
- 1.22/test/test_ocp_local_example.py
- 1.22/test/test_ocp_remote_example.py
- 1.20/test/test-lib-openshift.sh
- 1.20/test/run-openshift-pytest
- 1.26/test/test_container_basics.py
- 1.24/test/perl-test-app/index.html
- 1.20/test/test_container_example_apps.py
- 1.22/test/test-app
- 1.24/test/start-hook-test-app/nginx-start/init.sh
- 1.26/test/test-lib-remote-openshift.sh
- 1.24/test/constants.py
- 1.26/Dockerfile.rhel8
- 1.20/test/run-pytest
- 1.20/test/test_container_basics.py
- 1.22/test/test_ocp_shared_helm_template.py
- 1.22/test/test_container_application.py
- 1.22/test/test_container_example_apps.py
- 1.22/test/test-openshift.yaml
- 1.26/test/test_container_application.py
- 1.26/test/test_ocp_local_example.py
- 1.26/test/run-openshift-remote-cluster
- 1.22/test/test_ocp_imagestreams.py
- 1.26/test/test-lib.sh
- 1.22/test/conftest.py
- 1.22/test/init.py
- 1.22/test/examples
- 1.22/Dockerfile.c9s
- 1.24/test/test-app
- 1.20/Dockerfile.c9s
- 1.26/test/imagestreams
- 1.22/test/test-lib-remote-openshift.sh
- 1.22/test/test_ocp_imagestream_s2i.py
- 1.22/test/test-lib.sh
- 1.22-micro/Dockerfile.rhel8
🛑 Comments failed to post (10)
.github/workflows/container-tests.yml (1)
7-8: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash set -euo pipefail echo '--- .github/workflows/container-tests.yml ---' cat -n .github/workflows/container-tests.yml echo echo '--- workflows referencing distgen-check or permissions ---' rg -n --hidden --glob '.github/workflows/*.yml' --glob '.github/workflows/*.yaml' 'distgen-check|permissions:' .github/workflows || true echo echo '--- top-level GitHub Actions files ---' git ls-files '.github/workflows/*'Repository: sclorg/nginx-container
Length of output: 1652
🏁 Script executed:
#!/bin/bash set -euo pipefail for f in .github/workflows/pr-metadata.yml .github/workflows/auto-merge.yml .github/workflows/auto-merge-on-demand.yml .github/workflows/build-and-push.yml; do echo "=== $f ===" cat -n "$f" echo doneRepository: sclorg/nginx-container
Length of output: 8556
🌐 Web query:
sclorg/ci-actions distgen-check.yml permissions GITHUB_TOKEN reusable workflow💡 Result:
The distgen-check.yml file in the sclorg/ci-actions repository is a reusable workflow commonly integrated into SCLOrg container repositories [1][2][3][4][5]. When utilizing this or any reusable workflow in GitHub Actions, the management of the GITHUB_TOKEN and its permissions is governed by standard GitHub Actions security and configuration rules [6][7]: 1. Default Permissions: If you do not explicitly define a permissions block for the job calling the reusable workflow, the called workflow inherits the default GITHUB_TOKEN permissions [6][7]. 2. Permission Constraints: The GITHUB_TOKEN permissions passed from the caller to the reusable workflow can be downgraded, but they cannot be elevated [6][8][7]. This means you can restrict the token's capabilities in your calling job, but you cannot grant it broader permissions than what it already possesses [6][7]. 3. Configuration: As a security best practice, you should define the minimum required permissions at the job level in your calling workflow file (e.g.,.github/workflows/container-tests.yml) [9]. Example configuration for a calling job: jobs: distgen-check: permissions: contents: read uses: sclorg/ci-actions/.github/workflows/distgen-check.yml@main If the workflow requires more than the default permissions to perform its tasks, ensure the calling job explicitly grants those specific permissions (e.g., contents: read) [9]. The reusable workflow will automatically have access to the GITHUB_TOKEN provided by the caller [6][7].
Citations:
- 1: https://github.com/sclorg/nginx-container/blob/a36fc022a94d576375f7d5eec41f1e0f37df9122/.github/workflows/container-tests.yml
- 2: #382
- 3: https://github.com/sclorg/mysql-container/blob/fa8878fab8a457f7fc5e1110ac27ccaa4969b382/.github/workflows/container-tests.yml
- 4: https://github.com/sclorg/mariadb-container/blob/75fc9b6b8d777ebd90bbe356927263516c5e0848/.github/workflows/container-tests.yml
- 5: https://github.com/sclorg/postgresql-container/blob/master/.github/workflows/container-tests.yml
- 6: https://docs.github.com/en/actions/reference/workflows-and-actions/reusing-workflow-configurations
- 7: https://docs.github.com/en/enterprise-server@3.13/actions/reference/reusable-workflows-reference
- 8: https://github.com/github/docs/blob/main/content/actions/how-tos/reuse-automations/reuse-workflows.md
- 9: https://docs.github.com/actions/reference/authentication-in-a-workflow
Pin the shared reusable workflows and set explicit token permissions in
.github/workflows/container-tests.yml.@mainleaves these jobs open to upstream changes; use reviewed commit SHAs for thesclorg/ci-actionsworkflows here and add a minimalpermissionsblock instead of inheriting defaults.🧰 Tools
🪛 zizmor (1.26.1)
[warning] 7-8: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block
(excessive-permissions)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/container-tests.yml around lines 7 - 8, Update the distgen-check reusable workflow reference to use a reviewed immutable commit SHA instead of `@main`, and add an explicit minimal permissions block in the workflow configuration so jobs do not inherit default token permissions. Apply this consistently to the sclorg/ci-actions reusable workflows in container-tests.yml.Source: Linters/SAST tools
1.20/README.md (1)
202-204: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Restore the RHEL9 Dockerfile reference.
1.20/Dockerfile.rhel9exists, but the updated list omitsDockerfile.rhel9while advertising other variants. Keep this list synchronized with the generated outputs.Proposed fix
-for RHEL8 it's `Dockerfile.rhel8`, Dockerfile for RHEL10 is called `Dockerfile.rhel10`, +for RHEL8 it's `Dockerfile.rhel8`, Dockerfile for RHEL9 is called `Dockerfile.rhel9`,🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@1.20/README.md` around lines 202 - 204, Update the Dockerfile variant list in the README to include Dockerfile.rhel9 alongside the existing RHEL, CentOS Stream, and Fedora entries, keeping the documented list synchronized with the generated Dockerfile outputs.1.22-micro/README.md (2)
1-4: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Fix the generated description wording.
Use “reverse proxy server” and “Fedora-based” in this user-facing text.
Proposed fix
-This container image includes Nginx 1.22 server and a reverse server for OpenShift and general usage. -Users can choose between RHEL, CentOS Stream and Fedora based images. +This container image includes Nginx 1.22 server and a reverse proxy server for OpenShift and general usage. +Users can choose between RHEL, CentOS Stream and Fedora-based images.📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.Nginx 1.22 server and a reverse proxy server container image ============================================================ This container image includes Nginx 1.22 server and a reverse proxy server for OpenShift and general usage. Users can choose between RHEL, CentOS Stream and Fedora-based images.🧰 Tools
🪛 LanguageTool
[grammar] ~4-~4: Use a hyphen to join words.
Context: ...e between RHEL, CentOS Stream and Fedora based images. The RHEL images are availa...(QB_NEW_EN_HYPHEN)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@1.22-micro/README.md` around lines 1 - 4, Update the README description to use the exact user-facing terms “reverse proxy server” and “Fedora-based,” correcting the current “reverse server” and “Fedora based” wording while preserving the surrounding content.Source: Linters/SAST tools
68-69: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Do not document Perl modules unless the micro image supports them.
1.22-micro/Dockerfile.c9sdoes not install the nginx Perl module or defineNGINX_PERL_MODULE_PATH, so this documented./nginx-perl/*.pmpayload cannot be installed. Remove the entry or add the required package and environment support.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@1.22-micro/README.md` around lines 68 - 69, Remove the ./nginx-perl/*.pm documentation entry from 1.22-micro/README.md, since Dockerfile.c9s does not install or configure Perl module support; do not document payloads unavailable in the micro image.README.md (1)
83-83: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Use the configured setext heading style.
This added ATX heading triggers markdownlint MD003.
Proposed fix
-## Contributing Guidelines +Contributing Guidelines +----------------------📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.Contributing Guidelines ----------------------🧰 Tools
🪛 markdownlint-cli2 (0.23.0)
[warning] 83-83: Heading style
Expected: setext; Actual: atx(MD003, heading-style)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@README.md` at line 83, Update the “Contributing Guidelines” heading in README.md to use the repository’s configured setext heading style instead of ATX syntax, preserving the existing heading text.Source: Linters/SAST tools
src/README.md (2)
25-30: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Update the stale test-app paths.
The repository layout used by
src/s2i/bin/usageis{{ spec.version }}/test/test-app, notexamples/{{ spec.version }}/test-app; both the link andcdcommand currently lead users to a nonexistent location.Proposed fix
- To build a simple [test-app](https://github.com/sclorg/nginx-container/tree/master/examples/{{ spec.version }}/test-app) application in Openshift: + To build a simple [test-app](https://github.com/sclorg/nginx-container/tree/master/{{ spec.version }}/test/test-app) application in Openshift: ... - cd nginx-container/examples/{{ spec.version }}/ + cd nginx-container/{{ spec.version }}/test/Also applies to: 90-95
🧰 Tools
🪛 markdownlint-cli2 (0.23.0)
[warning] 28-28: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/README.md` around lines 25 - 30, Update the test-app repository references in the README example to use {{ spec.version }}/test/test-app consistently, including the GitHub link and the related cd command, while preserving the existing oc new-app context directory.
199-204: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Correct the stale Python reference.
This is Nginx documentation, but it says “Python environment Dockerfiles.” Replace it with Nginx image wording.
🧰 Tools
🪛 LanguageTool
[grammar] ~201-~201: Ensure spelling is correct
Context: ...r. In that repository you also can find another versions of Python environment Dockerfi...(QB_NEW_EN_ORTHOGRAPHY_ERROR_IDS_1)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/README.md` around lines 199 - 204, Update the documentation sentence near the container image Dockerfile references to replace “Python environment Dockerfiles” with wording that correctly describes Nginx image Dockerfiles. Preserve the listed repository, platform names, and Dockerfile filenames unchanged.Source: Linters/SAST tools
test/perl-test-app/index.html (1)
1-1: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Add the HTML5 doctype to all fixtures.
HTMLHint reports standards-mode violations in each page. Prepend
<!DOCTYPE html>at Line 1 of every listed file.🧰 Tools
🪛 HTMLHint (1.9.2)
[error] 1-1: Doctype must be declared before any non-comment content.
(doctype-first)
📍 Affects 3 files
test/perl-test-app/index.html#L1-L1(this comment)test/start-hook-test-app/index.html#L1-L1test/start-hook-test-app/index2.html#L1-L1🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/perl-test-app/index.html` at line 1, Add the HTML5 doctype as the first line of test/perl-test-app/index.html, test/start-hook-test-app/index.html, and test/start-hook-test-app/index2.html, before each existing html element.Source: Linters/SAST tools
test/perl-test-app/nginx.conf (1)
59-64: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Make the 404 target and location match.
error_page 404 /404.htmlredirects to/404.html, but the only exact location is/40x.html; that location is never selected for these 404 responses. Use the same URI in both directives.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/perl-test-app/nginx.conf` around lines 59 - 64, Update the 404 error_page directive and its adjacent exact-match location so both use the same URI, ensuring 404 responses select that location; leave the existing 500–504 error handling unchanged.test/start-hook-test-app/nginx-start/init.sh (1)
17-19: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Align the selected index with the integration test.
This startup hook selects
index2.html, whose body says “NGINX2 is working”, buttest/test_container_example_apps.pyexpects “NGINX is working”. Update the expected output or selectindex.html; otherwise the integration contract is broken.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/start-hook-test-app/nginx-start/init.sh` around lines 17 - 19, Align the startup hook’s INDEX_FILE assignment with the integration test contract by selecting index.html, or update the test expectation to match index2.html’s “NGINX2 is working” content. Keep the hook and test consistent so the expected response matches the selected index file.
Summary by CodeRabbit
New Features
Documentation
Tests