[openshift-eng/oape-ai-e2e] Re-use gh-token-minter in workflow job#80233
[openshift-eng/oape-ai-e2e] Re-use gh-token-minter in workflow job#80233swghosh wants to merge 6 commits into
Conversation
in an ephemeral namespace using the oape-ai-e2e agent Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Swarup Ghosh <swghosh@redhat.com>
…mespace Signed-off-by: Swarup Ghosh <swghosh@redhat.com>
Replace inline bash/openssl JWT minting with the gh-token-minter image's CLI mode, which handles the same logic via ghpat_server.py. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
openshift-ci
Bot
added
the
needs-rebase
WalkthroughThe PR updates the OAPE AI E2E job configuration in CI operator, adding a new build image ( ChangesAI E2E Test Workflow Configuration
Sequence DiagramsequenceDiagram
participant WorkflowInput as workflow-input image
participant TokenMinter as ghpat_server token minter
participant AgentWorkflow as Agent workflow execution
participant SharedDir as Shared parameters
participant GitAuth as Git authentication
participant GCPCreds as GCP credentials
WorkflowInput->>SharedDir: Extract /params.env
SharedDir->>AgentWorkflow: Load SHARED_DIR/params.env
TokenMinter->>AgentWorkflow: Mint GH_TOKEN from GitHub App
AgentWorkflow->>GCPCreds: Mount Google ADC credentials
AgentWorkflow->>GitAuth: gh auth setup-git with GH_TOKEN
GitAuth->>AgentWorkflow: Git authentication ready
AgentWorkflow->>AgentWorkflow: python3.11 main.py with env vars
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error)
✅ Passed checks (14 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
⚔️ Resolve merge conflicts
Comment |
|
@swghosh, Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
openshift-ci
Bot
added
the
approved
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
ci-operator/config/openshift-eng/oape-ai-e2e/openshift-eng-oape-ai-e2e-main.yaml (1)
38-40: 💤 Low valueConsider removing the
catto avoid potential log exposure.If
params.envever contains sensitive values (e.g., API endpoints with tokens, internal URLs), they will appear in CI logs. Thecpalready confirms successful extraction.Suggested fix
commands: | cp /params.env "${SHARED_DIR}/params.env" - cat "${SHARED_DIR}/params.env"Based on coding guidelines: "Never
echoor print passwords, tokens, API keys, cluster URLs, or kubeconfig contents" in step registry scripts.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ci-operator/config/openshift-eng/oape-ai-e2e/openshift-eng-oape-ai-e2e-main.yaml` around lines 38 - 40, The commands block currently copies then prints params.env (the lines with cp /params.env "${SHARED_DIR}/params.env" and cat "${SHARED_DIR}/params.env"); remove the cat "${SHARED_DIR}/params.env" to avoid exposing sensitive values in CI logs and keep only the cp step (or, if you need verification, replace the print with a non-sensitive existence check such as testing the file presence via [ -s ] or ls) while leaving the cp and SHARED_DIR usage unchanged.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In
`@ci-operator/config/openshift-eng/oape-ai-e2e/openshift-eng-oape-ai-e2e-main.yaml`:
- Around line 38-40: The commands block currently copies then prints params.env
(the lines with cp /params.env "${SHARED_DIR}/params.env" and cat
"${SHARED_DIR}/params.env"); remove the cat "${SHARED_DIR}/params.env" to avoid
exposing sensitive values in CI logs and keep only the cp step (or, if you need
verification, replace the print with a non-sensitive existence check such as
testing the file presence via [ -s ] or ls) while leaving the cp and SHARED_DIR
usage unchanged.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 0bb17a25-1085-45a5-9491-26a932fcfc10
⛔ Files ignored due to path filters (2)
ci-operator/jobs/openshift-eng/oape-ai-e2e/openshift-eng-oape-ai-e2e-main-postsubmits.yamlis excluded by!ci-operator/jobs/**ci-operator/jobs/openshift-eng/oape-ai-e2e/openshift-eng-oape-ai-e2e-main-presubmits.yamlis excluded by!ci-operator/jobs/**
📒 Files selected for processing (1)
ci-operator/config/openshift-eng/oape-ai-e2e/openshift-eng-oape-ai-e2e-main.yaml
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
openshift-ci
Bot
removed
the
needs-rebase
|
@swghosh, Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: swghosh The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
openshift-ci
Bot
removed
the
do-not-merge/work-in-progress
swghosh
changed the title
|
@swghosh: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
1 participant
mint-gh-tokenCI step with thegh-token-minterimage's CLI modefrom: gh-token-minterand callspython /app/ghpat_server.pywhich mints and prints the token to stdout🤖 Generated with Claude Code
Details
Summary by CodeRabbit
This PR updates the Prow CI configuration for the
openshift-eng/oape-ai-e2erepository to replace inline JWT token minting with a dedicatedgh-token-mintercontainer image.Changes to
openshift-eng-oape-ai-e2e-main.yaml:New workflow-input image: Added a build definition for
prow-workflow/input.Dockerfile, which provides parameter configuration for the Prow workflow.Updated promotion rules: Modified the promotion configuration to exclude the
workflow-inputimage from being promoted to theoapenamespace, since it's only used internally by the workflow.Multi-step Prow job configuration: Added a
run-workflowtest with three sequential steps:workflow-inputimage to the shared directorygh-token-minterimage's CLI mode, runningpython /app/ghpat_server.pyto mint and output the GitHub tokenImpact: The CI job now delegates GitHub token minting to a specialized containerized service rather than inline scripts, improving maintainability and reducing duplication. The token minting depends on
ghpat_server.pyproviding CLI mode support, as referenced in the upstream dependencyopenshift-eng/oape-ai-e2e#62.