WIP: Fake bump#924
Conversation
|
/test e2e-aws-operator-encryption-kms |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository: openshift/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: ⛔ Files ignored due to path filters (4)
📒 Files selected for processing (2)
✅ Files skipped from review due to trivial changes (1)
🚧 Files skipped from review as they are similar to previous changes (1)
WalkthroughThe PR adds a ChangesKMS Plugin and Operator Image Integration
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes 🚥 Pre-merge checks | ✅ 12 | ❌ 3❌ Failed checks (2 warnings, 1 inconclusive)
✅ Passed checks (12 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Around line 135-137: The go.mod file contains a replace directive on line 137
that redirects the github.com/openshift/library-go import to a personal fork at
github.com/ardaguclu/library-go, which violates supply-chain security controls
and introduces an untrusted dependency source. Remove the entire line containing
the github.com/openshift/library-go replace override (the second line of the
replace block), keeping only the github.com/onsi/ginkgo/v2 replacement. This
personal fork override should only exist in local development environments, not
in the production code.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 7e9213bb-3224-4591-9222-2e347628f523
⛔ Files ignored due to path filters (9)
go.sumis excluded by!**/*.sumvendor/github.com/openshift/library-go/pkg/operator/encryption/controllers/key_controller.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/library-go/pkg/operator/encryption/controllers/kms_preflight_controller.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/library-go/pkg/operator/encryption/kms/pluginlifecycle/builder.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/library-go/pkg/operator/encryption/kms/pluginlifecycle/sidecar.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/library-go/test/library/encryption/helpers.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/library-go/test/library/encryption/kms/vault.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/library-go/test/library/encryption/scenarios.gois excluded by!**/vendor/**,!vendor/**vendor/modules.txtis excluded by!**/vendor/**,!vendor/**
📒 Files selected for processing (2)
go.modpkg/operator/workload/sync_openshift_oauth_apiserver.go
| replace ( | ||
| github.com/onsi/ginkgo/v2 => github.com/openshift/onsi-ginkgo/v2 v2.6.1-0.20251001123353-fd5b1fb35db1 | ||
| github.com/openshift/library-go => github.com/ardaguclu/library-go v0.0.0-20260619072729-555fb535777b |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== go.mod replace directives =="
rg -n '^\s*replace|\bgithub\.com/(openshift|ardaguclu)/library-go\b' go.mod
echo
echo "== Imports affected by library-go replace =="
rg -n --type go '"github.com/openshift/library-go/' -C1Repository: openshift/cluster-authentication-operator
Length of output: 50398
Remove the library-go fork override before merging.
Line 137 redirects all github.com/openshift/library-go imports to a personal fork (github.com/ardaguclu/library-go), introducing a supply-chain trust boundary change in a security-critical authentication operator. This override must be removed before merge—keep it only for local development.
Suggested fix
replace (
github.com/onsi/ginkgo/v2 => github.com/openshift/onsi-ginkgo/v2 v2.6.1-0.20251001123353-fd5b1fb35db1
- github.com/openshift/library-go => github.com/ardaguclu/library-go v0.0.0-20260619072729-555fb535777b
)Per coding guidelines, dependency files must meet supply-chain controls: no personal forks in production code, verified provenance, and trusted sources only.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` around lines 135 - 137, The go.mod file contains a replace directive
on line 137 that redirects the github.com/openshift/library-go import to a
personal fork at github.com/ardaguclu/library-go, which violates supply-chain
security controls and introduces an untrusted dependency source. Remove the
entire line containing the github.com/openshift/library-go replace override (the
second line of the replace block), keeping only the github.com/onsi/ginkgo/v2
replacement. This personal fork override should only exist in local development
environments, not in the production code.
Source: Coding guidelines
|
/test e2e-aws-operator-encryption-kms |
|
/test e2e-aws-operator-encryption-kms |
|
/test e2e-aws-operator-encryption-kms |
|
@ardaguclu: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
openshift-ci
Bot
added
the
needs-rebase
|
PR needs rebase. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/close |
|
@ardaguclu: Closed this PR. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
1 participant
In order to test openshift/library-go#2317
Summary by CodeRabbit
OPERATOR_IMAGEenvironment variable to the deployment, pointing to the cluster authentication operator image.