feat: add Claude Code infrastructure and documentation

Author: devppratik

.claude/hooks/README.md

@@ -138,7 +138,7 @@ Used for local development with internal network access.
 
 **Usage**:
 ```bash
-prek run --all-files
+prek run --config hack/prek.ci.toml
 ```
 
 ### 2. **hack/prek.ci.toml** (CI-compatible)
@@ -179,13 +179,13 @@ This sets up pre-commit hooks that run validation automatically.
 
 ### Automatic Validation
 Prek runs automatically:
-- **On every turn**: Stop hook runs `prek run --all-files`
+- **On every turn**: Stop hook runs `prek run --config hack/prek.ci.toml`
 - **On commit**: Pre-commit hook runs relevant checks
 
 ### Manual Validation
 ```bash
 # Run all checks
-prek run --all-files
+prek run --config hack/prek.ci.toml
 
 # Run specific check
 prek run gitleaks
@@ -320,7 +320,7 @@ SKIP=hook-id git commit
    - Open an issue documenting the problem
    - Request reviewer approval before merge
 3. **Re-run full validation:**
-   - `prek run --all-files` locally
+   - `prek run --config hack/prek.ci.toml` locally
    - Ensure all required CI checks pass
    - Get explicit code review approval
 

.claude/hooks/pre-edit.sh

@@ -18,10 +18,27 @@ fi
 # Normalize file path to be repo-relative for consistent pattern matching
 # This ensures patterns like vendor/* work regardless of whether the input is absolute or relative
 REPO_ROOT=$(git rev-parse --show-toplevel 2>/dev/null || echo ".")
+
+# Reject absolute paths outside the repo
 if [[ "$FILE" = /* ]]; then
+  if [[ ! "$FILE" == "$REPO_ROOT"/* ]]; then
+    echo "❌ ERROR: File path is outside repository: $FILE"
+    exit 1
+  fi
   # Convert absolute path to repo-relative
   FILE="${FILE#"$REPO_ROOT"/}"
 fi
+
+# Canonicalize and reject traversal segments
+if command -v realpath >/dev/null 2>&1; then
+  CANONICAL=$(realpath -s --relative-to="$REPO_ROOT" "$FILE" 2>/dev/null || echo "")
+  if [[ -z "$CANONICAL" ]] || [[ "$CANONICAL" == *".."* ]]; then
+    echo "❌ ERROR: Invalid file path (contains traversal): $FILE"
+    exit 1
+  fi
+  FILE="$CANONICAL"
+fi
+
 # Strip leading ./
 FILE="${FILE#./}"
 

.claude/hooks/stop-prek-validation.sh

@@ -27,7 +27,7 @@ if [[ -z "$REPO_ROOT" ]]; then
   jq -n '{"decision": "block", "reason": "Not in a git repository. Cannot run prek validation."}'
   exit 0
 fi
-cd "$REPO_ROOT"
+cd "$REPO_ROOT" || exit 1
 
 # Check for jq dependency
 if ! command -v jq &> /dev/null; then

.claude/skills/README.md

@@ -33,7 +33,7 @@ Skills can be referenced in Claude conversations:
 ```text
 "Use the prow-ci skill to investigate the failed test in PR #123"
 "Check Prow CI results for the latest build"
-```
+```text
 
 ### Skill Components
 
@@ -63,13 +63,13 @@ To add a new skill:
 6. Test the skill workflow
 
 **Directory structure**:
-```
+```text
 .claude/skills/
 ├── README.md
 └── skillname/
     ├── SKILL.md          # Required: skill definition
     └── reference/        # Optional: supporting docs
-```
+```text
 
 ## Integration with Other Components
 

.claude/skills/prow-ci/SKILL.md

@@ -4,7 +4,7 @@ description: Fetch and analyze OpenShift Prow CI job failures with automated art
 trigger: prow, prow-ci, /prow-ci, ci results, check ci, analyze ci failure
 ---
 
-# Prow CI Analysis for Rbac Permissions Operator
+# Prow CI Analysis
 
 This skill fetches Prow CI job artifacts from Google Cloud Storage and provides automated failure analysis.
 
@@ -29,7 +29,7 @@ gh pr checks <PR_NUMBER>
 /prow-ci <prow-job-url>
 
 # Or ask naturally:
-"Analyze the lint failure in PR 328"
+"Analyze the lint failure in PR <NUMBER>"
 "Check why the validate job failed"
 "Show me what broke in the coverage job"
 ```
@@ -70,14 +70,14 @@ gh pr view <PR_NUMBER> --json statusCheckRollup --jq '.statusCheckRollup[] | sel
 
 Example Prow job URL:
 ```
-https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_rbac-permissions-operator/328/pull-ci-openshift-rbac-permissions-operator-master-lint/2059308810190721024
+https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_splunk_forwarder_operator/<PR_NUMBER>/pull-ci-openshift-splunk-forwarder-operator-master-lint/<BUILD_ID>
 ```
 
 ### Step 2: Fetch and Analyze
 
 Run the fetch script first:
 ```bash
-cd /Users/ppanda/rh-projects/ROSA-730/rbac-permissions-operator/.claude/skills/prow-ci
+cd $PWD/.claude/skills/prow-ci
 
 python3 fetch_prow_artifacts.py "<prow-job-url>" -o .work/prow-artifacts
 ```
@@ -109,18 +109,18 @@ Create a clear summary for the user with:
 ### Example Workflow
 
 ```bash
-# User provides: "Analyze the lint failure in PR 328"
+# User provides: "Analyze the lint failure in PR <NUMBER>"
 
 # 1. Get Prow job URL
-gh pr checks 328 | grep lint
+gh pr checks <PR_NUMBER> | grep lint
 
 # 2. Fetch artifacts
 python3 .claude/skills/prow-ci/fetch_prow_artifacts.py \
-  "https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_rbac-permissions-operator/328/pull-ci-openshift-rbac-permissions-operator-master-lint/2059308810190721024"
+  "https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_splunk_forwarder_operator/<PR_NUMBER>/pull-ci-openshift-splunk-forwarder-operator-master-lint/<BUILD_ID>"
 
 # 3. Analyze
 python3 .claude/skills/prow-ci/analyze_failure.py \
-  .work/prow-artifacts/2059308810190721024 \
+  .work/prow-artifacts/<BUILD_ID> \
   -f markdown
 
 # 4. Review the output and provide actionable summary
@@ -130,15 +130,15 @@ python3 .claude/skills/prow-ci/analyze_failure.py \
 
 **Main Dashboard**: https://prow.ci.openshift.org/  
 **CI Search**: https://github.com/openshift/ci-search  
-**Job History**: https://prow.ci.openshift.org/?repo=openshift%2Frbac-permissions-operator
+**Job History**: https://prow.ci.openshift.org/?repo=openshift%2Fsplunk-forwarder-operator
 
 ## Common Use Cases
 
 ### 1. Check Recent CI Results
 
 ```bash
 # View recent PR jobs
-curl -s "https://prow.ci.openshift.org/?repo=openshift%2Frbac-permissions-operator&type=presubmit" | grep -E "pull-ci-openshift-rbac-permissions-operator"
+curl -s "https://prow.ci.openshift.org/?repo=openshift%2Fsplunk-forwarder-operator&type=presubmit" | grep -E "pull-ci-openshift-splunk-forwarder-operator"
 
 # Check latest job status for specific PR
 # Replace PR_NUMBER with actual PR number
@@ -148,12 +148,12 @@ gh pr view PR_NUMBER --json statusCheckRollup --jq '.statusCheckRollup[] | selec
 ### 2. Access Build Logs
 
 Prow logs are stored at:
-- **Pull request jobs**: `gs://test-platform-results/pr-logs/pull/openshift_rbac-permissions-operator/[PR_NUMBER]/[JOB_NAME]/[JOB_ID]`
+- **Pull request jobs**: `gs://test-platform-results/pr-logs/pull/openshift_splunk_forwarder_operator/[PR_NUMBER]/[JOB_NAME]/[JOB_ID]`
 - **Periodic jobs**: `gs://test-platform-results/logs/[JOB_NAME]/[JOB_ID]`
 
 **Viewing logs via web**:
 ```text
-https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_rbac-permissions-operator/[PR_NUMBER]/[JOB_NAME]/[JOB_ID]
+https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_splunk_forwarder_operator/[PR_NUMBER]/[JOB_NAME]/[JOB_ID]
 ```
 
 ### 3. Analyze Test Failures
@@ -175,16 +175,16 @@ gh pr checks PR_NUMBER | grep -i "fail"
 ### 4. Common Job Names
 
 **Prow CI Jobs** (configured in openshift/release):
-- `pull-ci-openshift-rbac-permissions-operator-master-e2e-binary-build-success` - E2E binary build verification
-- `pull-ci-openshift-rbac-permissions-operator-master-coverage` - Code coverage analysis (with Codecov)
-- `pull-ci-openshift-rbac-permissions-operator-master-lint` - Linting checks
-- `pull-ci-openshift-rbac-permissions-operator-master-test` - Unit tests
-- `pull-ci-openshift-rbac-permissions-operator-master-validate` - Validation checks
+- `pull-ci-openshift-splunk-forwarder-operator-master-e2e-binary-build-success` - E2E binary build verification
+- `pull-ci-openshift-splunk-forwarder-operator-master-coverage` - Code coverage analysis (with Codecov)
+- `pull-ci-openshift-splunk-forwarder-operator-master-lint` - Linting checks
+- `pull-ci-openshift-splunk-forwarder-operator-master-test` - Unit tests
+- `pull-ci-openshift-splunk-forwarder-operator-master-validate` - Validation checks
 
 **Tekton Pipelines** (configured in `.tekton/`):
-- `rbac-permissions-operator-pull-request` - Main PR pipeline (docker build with OCI-TA)
-- `rbac-permissions-operator-e2e-pull-request` - E2E testing pipeline
-- `rbac-permissions-operator-pko-pull-request` - PKO (Package Operator) pipeline
+- `splunk-forwarder-operator-pull-request` - Main PR pipeline (docker build with OCI-TA)
+- `splunk-forwarder-operator-e2e-pull-request` - E2E testing pipeline
+- `splunk-forwarder-operator-pko-pull-request` - PKO (Package Operator) pipeline
 - Corresponding `-push` pipelines for merged commits
 
 ## Debugging CI Failures
@@ -197,7 +197,7 @@ gh pr checks PR_NUMBER
 ### Step 2: Access Prow UI
 Open the Prow link from PR checks or construct manually:
 ```text
-https://prow.ci.openshift.org/?repo=openshift%2Frbac-permissions-operator&type=presubmit
+https://prow.ci.openshift.org/?repo=openshift%2Fsplunk-forwarder-operator&type=presubmit
 ```
 
 ### Step 3: Review Logs
@@ -238,15 +238,15 @@ make docker-build
 This repo uses **both Prow and Tekton** for comprehensive CI:
 
 **Prow CI** (openshift/release):
-- Configuration: `ci-operator/config/openshift/rbac-permissions-operator/openshift-rbac-permissions-operator-master.yaml`
+- Configuration: `ci-operator/config/openshift/splunk-forwarder-operator/openshift-splunk-forwarder-operator-master.yaml`
 - Runs: lint, test, validate, coverage, e2e-binary-build
-- Uses Codecov for coverage reporting (secret: `rbac-permissions-operator-codecov-token`)
+- Uses Codecov for coverage reporting (secret: `splunk-forwarder-operator-codecov-token`)
 - Skip rules: Changes to `.tekton/`, `.github/`, `.md` files, `OWNERS`, `LICENSE` don't trigger most jobs
 
 **Tekton Pipelines** (`.tekton/`):
 - Primary build pipeline using Pipelines as Code
 - Three pipeline types: main, e2e, pko
-- Builds container images to Quay (rbac-permissions-operator-tenant)
+- Builds container images to Quay (splunk-forwarder-operator-tenant)
 - Pull request images expire after 5 days
 - Uses boilerplate framework from `openshift/boilerplate` (docker-build-oci-ta pipeline)
 
@@ -260,31 +260,31 @@ gh pr checks <PR_NUMBER>
 gh pr view <PR_NUMBER> --json statusCheckRollup
 
 # Filter only Prow jobs
-gh pr checks <PR_NUMBER> | grep "pull-ci-openshift-rbac-permissions-operator"
+gh pr checks <PR_NUMBER> | grep "pull-ci-openshift-splunk-forwarder-operator"
 
 # Check Tekton pipeline status
 gh pr view <PR_NUMBER> --json statusCheckRollup --jq '.statusCheckRollup[] | select(.context | contains("Tekton"))'
 
 # Open Prow dashboard in browser (cross-platform)
 # Copy and paste this URL into your browser:
-# https://prow.ci.openshift.org/?repo=openshift%2Frbac-permissions-operator
+# https://prow.ci.openshift.org/?repo=openshift%2Fsplunk-forwarder-operator
 
 # Or use platform-specific command:
-# macOS: open "https://prow.ci.openshift.org/?repo=openshift%2Frbac-permissions-operator"
-# Linux: xdg-open "https://prow.ci.openshift.org/?repo=openshift%2Frbac-permissions-operator"
-# Windows: start "https://prow.ci.openshift.org/?repo=openshift%2Frbac-permissions-operator"
+# macOS: open "https://prow.ci.openshift.org/?repo=openshift%2Fsplunk-forwarder-operator"
+# Linux: xdg-open "https://prow.ci.openshift.org/?repo=openshift%2Fsplunk-forwarder-operator"
+# Windows: start "https://prow.ci.openshift.org/?repo=openshift%2Fsplunk-forwarder-operator"
 
 # View specific PR on Prow (replace <PR_NUMBER>)
-# https://prow.ci.openshift.org/?repo=openshift%2Frbac-permissions-operator&type=presubmit&pull=<PR_NUMBER>
+# https://prow.ci.openshift.org/?repo=openshift%2Fsplunk-forwarder-operator&type=presubmit&pull=<PR_NUMBER>
 ```
 
 ## Troubleshooting
 
 ### Can't find job results?
 - Check both Prow AND Tekton - this repo uses both systems
-- Prow jobs: `pull-ci-openshift-rbac-permissions-operator-master-*`
+- Prow jobs: `pull-ci-openshift-splunk-forwarder-operator-master-*`
 - Tekton jobs: Usually show as "Tekton" or pipeline names in PR checks
-- Verify repo name format in Prow: `openshift_rbac-permissions-operator` (underscore, not dash)
+- Verify repo name format in Prow: `openshift_splunk_forwarder_operator` (underscore, not dash)
 - Ensure PR has been opened and CI has run
 
 ### Logs show permission denied?
@@ -303,7 +303,7 @@ gh pr view <PR_NUMBER> --json statusCheckRollup --jq '.statusCheckRollup[] | sel
 - Common issues:
   - Image build failures → Check Dockerfile syntax and build context
   - Pipeline timeout → Check for slow steps or network issues
-  - Auth failures → Secret configuration in `rbac-permissions-operator-tenant` namespace
+  - Auth failures → Secret configuration in `splunk-forwarder-operator-tenant` namespace
 - Local validation:
   ```bash
   # Validate Tekton YAML syntax
@@ -333,27 +333,27 @@ git clone https://github.com/openshift/ci-search.git
 ## CI Configuration Files
 
 **Prow Configuration** (in openshift/release repo):
-- Location: `ci-operator/config/openshift/rbac-permissions-operator/openshift-rbac-permissions-operator-master.yaml`
+- Location: `ci-operator/config/openshift/splunk-forwarder-operator/openshift-splunk-forwarder-operator-master.yaml`
 - Update process: Submit PR to openshift/release repository
-- Auto-generated jobs in: `ci-operator/jobs/openshift/rbac-permissions-operator/`
+- Auto-generated jobs in: `ci-operator/jobs/openshift/splunk-forwarder-operator/`
 
 **Tekton Pipelines** (in this repo):
 - Location: `.tekton/` directory
 - Files:
-  - `rbac-permissions-operator-pull-request.yaml` - Main PR pipeline
-  - `rbac-permissions-operator-push.yaml` - Post-merge pipeline
-  - `rbac-permissions-operator-e2e-pull-request.yaml` - E2E testing
-  - `rbac-permissions-operator-pko-pull-request.yaml` - PKO validation
+  - `splunk-forwarder-operator-pull-request.yaml` - Main PR pipeline
+  - `splunk-forwarder-operator-push.yaml` - Post-merge pipeline
+  - `splunk-forwarder-operator-e2e-pull-request.yaml` - E2E testing
+  - `splunk-forwarder-operator-pko-pull-request.yaml` - PKO validation
 - Triggered by: Pipelines as Code (via Tekton)
 - Uses: Boilerplate docker-build-oci-ta pipeline from openshift/boilerplate
 
 ## Coverage Reporting
 
 This repository uses Codecov for coverage tracking:
-- Secret: `rbac-permissions-operator-codecov-token` (stored in Prow)
+- Secret: `splunk-forwarder-operator-codecov-token` (stored in Prow)
 - Generate coverage locally: `make coverage`
 - Coverage runs on PRs and post-merge (`publish-coverage`)
-- Dashboard: Check Codecov for rbac-permissions-operator
+- Dashboard: Check Codecov for splunk-forwarder-operator
 
 ## Integration with Other Skills
 

.claude/skills/prow-ci/analyze_failure.py

@@ -19,7 +19,11 @@ def parse_junit_xml(xml_file):
         root = tree.getroot()
 
         failures = []
-        for testsuite in root.findall('.//testsuite'):
+        # Handle root-level testsuite or nested testsuites
+        suites = [root] if root.tag == 'testsuite' else []
+        suites.extend(root.findall('.//testsuite'))
+
+        for testsuite in suites:
             suite_name = testsuite.get('name', 'unknown')
             for testcase in testsuite.findall('.//testcase'):
                 test_name = testcase.get('name', 'unknown')
@@ -106,8 +110,12 @@ def analyze_prowjob(prowjob_file):
     if not os.path.exists(prowjob_file):
         return None
 
-    with open(prowjob_file, 'r') as f:
-        data = json.load(f)
+    try:
+        with open(prowjob_file, 'r') as f:
+            data = json.load(f)
+    except (json.JSONDecodeError, OSError) as e:
+        print(f"Error: Could not parse prowjob from {prowjob_file}: {e}", file=sys.stderr)
+        return None
 
     status = data.get('status', {})
     spec = data.get('spec', {})

.claude/skills/prow-ci/fetch_prow_artifacts.py

@@ -81,8 +81,12 @@ def fetch_prowjob_json(gcs_base_path, output_dir):
     local_path = os.path.join(output_dir, 'prowjob.json')
 
     if download_from_gcs(gcs_path, local_path):
-        with open(local_path, 'r') as f:
-            return json.load(f)
+        try:
+            with open(local_path, 'r') as f:
+                return json.load(f)
+        except json.JSONDecodeError as e:
+            print(f"Error: Could not parse JSON from {local_path}: {e}", file=sys.stderr)
+            return None
     return None