Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds a COPR build job for pull requests, which is a great addition for getting early packaging feedback. However, it introduces a potential command injection vulnerability in the .packit.yaml configuration. The fix-spec-file action uses sed with environment variables that can be influenced by a pull request author, potentially allowing an attacker to inject malicious sed commands and execute arbitrary code in the Packit build environment. Additionally, while the refactoring to deduplicate archive creation into tools/create-archives.sh improves maintainability, the new script could be made more robust by adding argument validation.
The canonical repo now lives in the coreos org. Assisted-by: Claude Opus 4.6
Add a `copr_build` job to build RPMs in COPR on every PR for early packaging feedback. The create-archive action calls `tools/create-archives.sh`, a new shared script that generates source and vendor tarballs from the current tree. `release.py` is updated to use the same script, deduplicating the archive creation logic. While we're here, tweak the vendor-filterer invocation to match bootc (add `--tier 2` and use `*-unknown-linux-gnu` glob). Closes: #59 Assisted-by: Claude Opus 4.6
jlebon
force-pushed
the
issue-59-packit-copr
branch
from
69abbee to
3813ff8
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add a
copr_buildjob to build RPMs in COPR on every PR forearly packaging feedback. The create-archive action calls
tools/create-archives.sh, a new shared script that generates sourceand vendor tarballs from the current tree.
release.pyis updated touse the same script, deduplicating the archive creation logic.
Closes: #59
Assisted-by: Claude Opus 4.6