[openshift-eng/oape-ai-e2e] Re-use gh-token-minter in workflow job#80233
Conversation
openshift-ci
Bot
added
the
needs-rebase
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (1)
WalkthroughUpdates the run-workflow e2e job's ChangesAI E2E Test Workflow Configuration
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
@swghosh, Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
openshift-ci
Bot
added
the
approved
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
ci-operator/config/openshift-eng/oape-ai-e2e/openshift-eng-oape-ai-e2e-main.yaml (1)
38-40: 💤 Low valueConsider removing the
catto avoid potential log exposure.If
params.envever contains sensitive values (e.g., API endpoints with tokens, internal URLs), they will appear in CI logs. Thecpalready confirms successful extraction.Suggested fix
commands: | cp /params.env "${SHARED_DIR}/params.env" - cat "${SHARED_DIR}/params.env"Based on coding guidelines: "Never
echoor print passwords, tokens, API keys, cluster URLs, or kubeconfig contents" in step registry scripts.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ci-operator/config/openshift-eng/oape-ai-e2e/openshift-eng-oape-ai-e2e-main.yaml` around lines 38 - 40, The commands block currently copies then prints params.env (the lines with cp /params.env "${SHARED_DIR}/params.env" and cat "${SHARED_DIR}/params.env"); remove the cat "${SHARED_DIR}/params.env" to avoid exposing sensitive values in CI logs and keep only the cp step (or, if you need verification, replace the print with a non-sensitive existence check such as testing the file presence via [ -s ] or ls) while leaving the cp and SHARED_DIR usage unchanged.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In
`@ci-operator/config/openshift-eng/oape-ai-e2e/openshift-eng-oape-ai-e2e-main.yaml`:
- Around line 38-40: The commands block currently copies then prints params.env
(the lines with cp /params.env "${SHARED_DIR}/params.env" and cat
"${SHARED_DIR}/params.env"); remove the cat "${SHARED_DIR}/params.env" to avoid
exposing sensitive values in CI logs and keep only the cp step (or, if you need
verification, replace the print with a non-sensitive existence check such as
testing the file presence via [ -s ] or ls) while leaving the cp and SHARED_DIR
usage unchanged.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 0bb17a25-1085-45a5-9491-26a932fcfc10
⛔ Files ignored due to path filters (2)
ci-operator/jobs/openshift-eng/oape-ai-e2e/openshift-eng-oape-ai-e2e-main-postsubmits.yamlis excluded by!ci-operator/jobs/**ci-operator/jobs/openshift-eng/oape-ai-e2e/openshift-eng-oape-ai-e2e-main-presubmits.yamlis excluded by!ci-operator/jobs/**
📒 Files selected for processing (1)
ci-operator/config/openshift-eng/oape-ai-e2e/openshift-eng-oape-ai-e2e-main.yaml
openshift-ci
Bot
added
do-not-merge/work-in-progress
|
@swghosh, Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
openshift-ci
Bot
removed
the
do-not-merge/work-in-progress
swghosh
changed the title
Replace inline bash/openssl JWT minting with the gh-token-minter image's CLI mode, which handles the same logic via ghpat_server.py. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Swarup Ghosh <swghosh@redhat.com>
swghosh
force-pushed
the
oape-ai-e2e/prow-workflow
branch
from
087b7de to
5806f76
Compare
|
[REHEARSALNOTIFIER]
Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
/pj-rehearse |
|
@swghosh: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse ack The rehearsal run created:
so it is proof that this PR doesn't break the existing workflow behavior. |
|
@swghosh: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
openshift-merge-bot
Bot
added
the
rehearsals-ack
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: shivprakashmuley, swghosh The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
@swghosh: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
2 participants
mint-gh-tokenCI step with thegh-token-minterimage's CLI modefrom: gh-token-minterand callspython /app/ghpat_server.pywhich mints and prints the token to stdout🤖 Generated with Claude Code
Details
Summary by CodeRabbit
This PR updates the OpenShift CI configuration for the openshift-eng/oape-ai-e2e repository to change how the Prow workflow mints GitHub access tokens and to introduce workflow helper images.
What changed (practical impact)
Notes and dependencies