do not merge: just for testing#80473
Conversation
|
Skipping CI for Draft Pull Request. |
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
/pj-rehearse |
|
@psturc: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
WalkthroughA shell cleanup script is updated to fetch its deletion routine from an alternative GitHub repository branch. The curl command now points to a fork at ChangesMAPT Cleanup Script Source Update
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes 🚥 Pre-merge checks | ✅ 13 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (13 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: psturc The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
|
[REHEARSALNOTIFIER]
Prior to this PR being merged, you will need to either run and acknowledge or opt to skip these rehearsals. Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@ci-operator/step-registry/konflux-ci/mapt-cleanup/konflux-ci-mapt-cleanup-commands.sh`:
- Line 14: The pipeline currently pipes a mutable personal-fork script directly
into bash via the `curl ... | bash` invocation for `delete-mapt-clusters.sh`,
exposing AWS creds to a supply-chain risk; change this to fetch an immutable
commit/tag URL (or release tarball), save the script to disk (do not pipe),
verify its integrity via checksum or GPG signature, and only then execute it;
additionally run the verified script in a separate least-privileged step or
environment (remove direct execution in the same process where AWS credentials
are exported) to eliminate credential exposure.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 944681ba-0142-4aa7-941e-ba0165566c43
📒 Files selected for processing (1)
ci-operator/step-registry/konflux-ci/mapt-cleanup/konflux-ci-mapt-cleanup-commands.sh
|
|
||
| cd "$(mktemp -d)" | ||
| curl -sSL https://raw.githubusercontent.com/konflux-ci/tekton-integration-catalog/main/scripts/mapt/delete-mapt-clusters.sh | bash | ||
| curl -sSL https://raw.githubusercontent.com/psturc/tekton-integration-catalog/fix-mapt-deletion-script/scripts/mapt/delete-mapt-clusters.sh | bash |
There was a problem hiding this comment.
Pin and verify the fetched script before execution.
Line 14 executes code directly from a mutable personal fork branch (curl ... | bash) while AWS credentials are exported in the same process. This creates a critical supply-chain path for credential exfiltration if that branch changes or is compromised. Use an immutable commit URL, download to disk, verify checksum/signature, then execute.
Suggested hardening
-curl -sSL https://raw.githubusercontent.com/psturc/tekton-integration-catalog/fix-mapt-deletion-script/scripts/mapt/delete-mapt-clusters.sh | bash
+SCRIPT_URL="https://raw.githubusercontent.com/psturc/tekton-integration-catalog/<PINNED_COMMIT_SHA>/scripts/mapt/delete-mapt-clusters.sh"
+SCRIPT_PATH="$(mktemp)"
+SCRIPT_SHA256="<EXPECTED_SHA256>"
+
+curl --fail --silent --show-error --location "${SCRIPT_URL}" -o "${SCRIPT_PATH}"
+echo "${SCRIPT_SHA256} ${SCRIPT_PATH}" | sha256sum -c -
+bash "${SCRIPT_PATH}"As per coding guidelines: “Protect sensitive information in step-registry command scripts … never echo passwords, tokens, API keys … to logs.” A mutable unpinned remote script in this credentialed context breaks that guarantee boundary.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@ci-operator/step-registry/konflux-ci/mapt-cleanup/konflux-ci-mapt-cleanup-commands.sh`
at line 14, The pipeline currently pipes a mutable personal-fork script directly
into bash via the `curl ... | bash` invocation for `delete-mapt-clusters.sh`,
exposing AWS creds to a supply-chain risk; change this to fetch an immutable
commit/tag URL (or release tarball), save the script to disk (do not pipe),
verify its integrity via checksum or GPG signature, and only then execute it;
additionally run the verified script in a separate least-privileged step or
environment (remove direct execution in the same process where AWS credentials
are exported) to eliminate credential exposure.
Source: Coding guidelines
|
/pj-rehearse periodic-ci-konflux-ci-e2e-tests-main-mapt-clusters-resources-cleanup |
|
@psturc: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
@psturc: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
1 participant
Summary by CodeRabbit
This PR modifies the MAPT cluster cleanup step in the OpenShift CI infrastructure to test a different version of the cleanup script. Specifically, it changes the script source URL in the
konflux-ci-mapt-cleanup-commands.shfile from:to:
This directs the Konflux CI cleanup job to fetch and execute the delete script from a fork (
psturc/tekton-integration-catalog) on a feature branch (fix-mapt-deletion-script) rather than the official upstream repository. All other functionality remains unchanged—the script still sets up strict bash error handling, loads AWS credentials, creates a temporary directory, and executes the fetched cleanup script.As indicated by the draft status and PR title, this is a test PR and is not intended for merging.