OSAC-1535: Add OSAC connected CI job#528
Open
eurijon wants to merge 6 commits into
Open
Conversation
WalkthroughThe PR adds reusable OSAC E2E workflow inputs, a new OSAC caller workflow, AAP license propagation in deployment, and extra CI artifact collection for plugin-related namespaces and pods. ChangesOSAC E2E plugin-chain support
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Suggested labels
Suggested reviewers
Poem
Caution Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional.
❌ Failed checks (1 error, 1 warning)
✅ Passed checks (9 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions
Bot
added
deployment
eurijon
changed the base branch from
integration/osac-plugin
to
fix/osac-profiles-list
eurijon
changed the title
eurijon
force-pushed
the
feature/osac-ci-e2e-reusable
branch
from
1b32ef3 to
5f3247e
Compare
eurijon
changed the title
Contributor
Author
|
@coderabbitai review |
✅ Action performedReview finished.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 6
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/e2e-deployment.yml:
- Around line 395-423: The `contains()` checks for plugin gating use substring
matching which can unintentionally match partial strings (e.g., 'osac' would
match 'myosac'). Update all the conditional statements in the deploy steps
(deploy_trust_manager, deploy_rhbk, deploy_authorino, deploy_aap, deploy_cnv,
deploy_osac) to use delimiter-based matching instead. Wrap the ENABLED_PLUGINS
environment variable and each plugin name with delimiters (such as commas) to
ensure only explicitly enabled plugins in the CSV list are matched, preventing
unintended deployments from substring collisions.
- Around line 157-165: The `inputs.storage-plugin` value is being directly
interpolated into shell commands and the GITHUB_OUTPUT without validation,
creating a critical injection vulnerability where malicious input could break
quoting, corrupt JSON output, or execute arbitrary shell code. Add validation to
ensure the storage-plugin input only contains allowed plugin names (whitelist
approach) before it is used in the PLUGIN assignment and the echo statement that
writes to storage_plugins in GITHUB_OUTPUT. Alternatively, properly escape or
quote the value to prevent shell injection when constructing the JSON output.
In @.github/workflows/e2e-osac.yml:
- Line 48: In the e2e-osac workflow file, replace the `secrets: inherit`
statement with explicit secret mapping to follow the principle of least
privilege. Instead of inheriting all repository secrets, explicitly define which
specific secrets are required for the called workflow by replacing `secrets:
inherit` with a `secrets:` block that lists only the necessary secrets with
their individual mappings. This reduces the blast radius and prevents accidental
exposure of sensitive information as the workflow evolves.
- Around line 23-28: The GitHub Actions workflow trigger configuration in the
e2e-osac.yml file is missing an entry for the lvms plugin in the paths filter.
Add `plugins/lvms/**` to the paths list in both the push trigger section (around
line 23-28) and the pull_request trigger section (around line 44) to ensure E2E
OSAC tests run whenever changes are made to the lvms plugin, which is part of
the OSAC plugin chain.
In `@scripts/deployment/deploy_plugin.sh`:
- Around line 151-156: The osacProfilesList in the heredoc is hardcoded to only
include the 'caas' profile, which overrides the default plugin configuration
that includes both 'caas' and 'vmaas' profiles. Update the osacProfilesList
section in the SSH command that creates the osac.yaml file to include both
'caas' and 'vmaas' profiles instead of just 'caas' to maintain the expected OSAC
capabilities.
- Around line 140-144: After the scp command that copies the AAP license file to
the Landing Zone (the line copying to ${LZ_SSH}:${LZ_AAP_LICENSE}), add a
follow-up ssh command that applies restrictive file permissions (chmod 600 or
similar least-privileged mode) to the copied license file on the remote Landing
Zone to reduce the risk of unauthorized disclosure of this sensitive file.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 09dfb64e-3ad8-4478-a372-ada16c0809a7
📒 Files selected for processing (3)
.github/workflows/e2e-deployment.yml.github/workflows/e2e-osac.ymlscripts/deployment/deploy_plugin.sh
Contributor
Author
|
@coderabbitai approve |
✅ Action performedComments resolved and changes approved. |
Base automatically changed from
fix/osac-profiles-list
to
integration/osac-plugin
June 23, 2026 08:53
Make e2e-deployment.yml callable via workflow_call so other workflows can run E2E with a custom plugin chain. Add e2e-osac.yml as a thin caller that deploys the OSAC stack (lvms, trust-manager, rhbk, authorino, aap, osac) in connected mode. Also adds AAP license file handling to deploy_plugin.sh for CI environments where the license is pre-staged on the runner. Assisted-by: Claude Code <noreply@anthropic.com>
Add explicit deploy-plugin steps for each OSAC addon plugin (trust-manager, rhbk, authorino, aap, cnv, osac) to both connected and disconnected E2E jobs. Each step is conditionally run based on the enabled-plugins input. Replaces the hardcoded example plugin step. Assisted-by: Claude Code <noreply@anthropic.com>
- Use delimiter-based matching for plugin gating to prevent substring collisions (e.g. 'aap' matching 'osac-aap') - Restrict AAP license file permissions (chmod 600) after scp to LZ - Add plugins/lvms/** to e2e-osac.yml path filter since lvms is part of the OSAC plugin chain - Include vmaas in default osacProfilesList to match plugin defaults Assisted-by: Claude Code <noreply@anthropic.com>
…gnostics The CI artifact collection missed CrashLoopBackOff pods because they are technically in Running phase. Add a second pass to capture pods with containers in waiting state or high restart counts, including previous container logs. Also add plugin namespace diagnostics (deployments, pods, events) for addon plugin namespaces when ENABLED_PLUGINS is set. Assisted-by: Claude Code <noreply@anthropic.com>
eurijon
force-pushed
the
feature/osac-ci-e2e-reusable
branch
from
fda5ec1 to
bb0a8f8
Compare
eurijon
force-pushed
the
feature/osac-ci-e2e-reusable
branch
from
bb0a8f8 to
ec9a123
Compare
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/e2e-osac.yml:
- Around line 31-34: The workflow permissions block grants unnecessary GitHub
Checks access. Update the permissions in the e2e-osac workflow so it keeps only
the required read access for contents and removes the checks: write entry, since
this job only calls a reusable workflow and does not use the Checks API.
In `@scripts/verification/collect_ci_artifacts.sh`:
- Around line 840-869: The plugin-to-namespace mapping in
collect_ci_artifacts.sh can leave the namespaces array empty for plugins like
lvms, yet the diagnostics loop still creates output directories and logs
attempts. Update the namespace collection flow around the ENABLED_PLUGINS
parsing and the unique_ns handling to return early when no mapped namespaces
exist, before any mkdir or ssh diagnostics work runs. Use the existing
namespaces and unique_ns logic to detect the empty case and skip the rest of the
plugin-diagnostics collection path.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 0f408fc5-2f0c-4fee-b4fe-badd98741006
📒 Files selected for processing (4)
.github/workflows/e2e-deployment.yml.github/workflows/e2e-osac.ymlscripts/deployment/deploy_plugin.shscripts/verification/collect_ci_artifacts.sh
Remove unnecessary checks:write permission from e2e-osac workflow and add early return for empty plugin namespace list in CI artifact collection. Assisted-by: Claude Code <noreply@anthropic.com>
Contributor
Author
|
@coderabbitai approve |
✅ Action performedComments resolved and changes approved. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
e2e-deployment.ymlcallable as a reusable workflow (workflow_call) with inputs for plugin chain, AAP license file, run mode selection, and cleanup/notification controlse2e-osac.yml— thin caller workflow that deploys the OSAC plugin stack (lvms → trust-manager → rhbk → authorino → aap → osac) in connected modeenabled-pluginsdeploy_plugin.shfor CI environments (copies license to LZ, generatesosac.yamlwithosacProfilesList: [caas])The job calls
make deploy-pluginseparately for each addon because addon plugin installation frombootstrap.shwas temporarily removed in #476.Depends on #525.
Changes to
e2e-deployment.ymlworkflow_calltrigger with inputs mirroringworkflow_dispatchplusenabled-pluginsandaap-license-filecheck-e2e-neededresolvesrun_connected/run_disconnectedfrom caller inputs (needed because theinputscontext is unreliable inworkflow_call)inputsdirectlyENABLED_PLUGINSandAAP_LICENSE_FILEenv vars set from inputsAdding more OSAC CI modes
To add disconnected mode, update
e2e-osac.yml:Or create a separate
e2e-osac-disconnected.ymlcaller for independent triggers.Test plan
yamllintpasses on both workflow filesshellcheckpasses ondeploy_plugin.shenabled-pluginsis empty)E2E OSACworkflow deploys the full plugin chain🤖 Generated with Claude Code
Summary by CodeRabbit
Release Notes
New Features
Improvements
Chores