ci(check-payload): add smoke tests#79882
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Enterprise Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
WalkthroughThis PR adds four CI payload-scan jobs (4.12, 4.15, 4.20, 5.0) and per-job resource overrides. Each job resolves a nightly release pullSpec, derives image references, extracts image filesystems using mounted registry credentials, and runs /check-payload scan local; jobs use the check-payload container and a 45m timeout. ChangesPayload Scan CI Jobs
🎯 2 (Simple) | ⏱️ ~10 minutes Suggested labels: 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: smith-xyz The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
ci-operator/config/openshift/check-payload/openshift-check-payload-main.yaml (1)
83-97: ⚡ Quick winAdd retry/backoff for
ocregistry calls to reduce flake risk.
curlhas retries, butoc adm release infoandoc image extractdo not. A transient registry/network hiccup can fail the job unnecessarily.Suggested patch pattern
commands: | set -euo pipefail + retry() { + local attempts="$1"; shift + local delay="$1"; shift + local n=1 + until "$@"; do + if [[ $n -ge $attempts ]]; then + return 1 + fi + sleep "$delay" + n=$((n+1)) + done + } export REGISTRY_AUTH_FILE=/secrets/ci-pull-credentials/.dockerconfigjson @@ - IMAGES=$(oc adm release info "$PULLSPEC" -a "$REGISTRY_AUTH_FILE" --pullspecs -o json \ + IMAGES=$(retry 3 5 oc adm release info "$PULLSPEC" -a "$REGISTRY_AUTH_FILE" --pullspecs -o json \ | jq -r '[.references.spec.tags[] | select(.from.name != null) | .from.name] | .[0:15] | .[]') @@ - if ! oc image extract "$img" -a "$REGISTRY_AUTH_FILE" --path /:/tmp/unpacked --confirm; then + if ! retry 3 5 oc image extract "$img" -a "$REGISTRY_AUTH_FILE" --path /:/tmp/unpacked --confirm; then echo "ERROR: failed to extract $img" >&2 failed=$((failed+1)) continue fiAlso applies to: 117-131, 151-165, 185-199
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ci-operator/config/openshift/check-payload/openshift-check-payload-main.yaml` around lines 83 - 97, Add a retry/backoff wrapper and use it for the registry calls (oc adm release info and oc image extract) to reduce flakes: implement a small helper function (e.g., retry_cmd or retry_with_backoff) that accepts a command and retries it with exponential backoff and a limited number of attempts, then replace direct calls to oc adm release info "$PULLSPEC" -a "$REGISTRY_AUTH_FILE" and oc image extract "$img" -a "$REGISTRY_AUTH_FILE" --path /:/tmp/unpacked --confirm with calls to that helper; apply the same wrapper to the other similar oc invocations referenced (the blocks around IMAGES resolution and the image-extract loop, and the other occurrences noted) so transient network/registry errors are retried before failing the job.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In
`@ci-operator/config/openshift/check-payload/openshift-check-payload-main.yaml`:
- Around line 83-97: Add a retry/backoff wrapper and use it for the registry
calls (oc adm release info and oc image extract) to reduce flakes: implement a
small helper function (e.g., retry_cmd or retry_with_backoff) that accepts a
command and retries it with exponential backoff and a limited number of
attempts, then replace direct calls to oc adm release info "$PULLSPEC" -a
"$REGISTRY_AUTH_FILE" and oc image extract "$img" -a "$REGISTRY_AUTH_FILE"
--path /:/tmp/unpacked --confirm with calls to that helper; apply the same
wrapper to the other similar oc invocations referenced (the blocks around IMAGES
resolution and the image-extract loop, and the other occurrences noted) so
transient network/registry errors are retried before failing the job.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: ced3cf1b-2098-4dd8-afb7-b907beb14111
⛔ Files ignored due to path filters (1)
ci-operator/jobs/openshift/check-payload/openshift-check-payload-main-presubmits.yamlis excluded by!ci-operator/jobs/**
📒 Files selected for processing (1)
ci-operator/config/openshift/check-payload/openshift-check-payload-main.yaml
|
/pj-rehearse pull-ci-openshift-check-payload-main-payload-scan-4-12 |
|
@smith-xyz: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse pull-ci-openshift-check-payload-main-payload-scan-4-15 pull-ci-openshift-check-payload-main-payload-scan-4-20 pull-ci-openshift-check-payload-main-payload-scan-5-0 |
|
@smith-xyz: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
smith-xyz
force-pushed
the
ci/check-payload-scan-presubmits-v2
branch
from
1afea65 to
b27a7bf
Compare
|
[REHEARSALNOTIFIER]
Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
/pj-rehearse pull-ci-openshift-check-payload-main-payload-scan-4-15 pull-ci-openshift-check-payload-main-payload-scan-4-20 pull-ci-openshift-check-payload-main-payload-scan-5-0 |
|
@smith-xyz: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
@smith-xyz: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/pj-rehearse ack |
|
@smith-xyz: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
openshift-merge-bot
Bot
added
the
rehearsals-ack
1 participant
Adds some quick testing to prevent regression issues
Summary by CodeRabbit
This PR updates OpenShift CI configuration to add quick smoke tests for the check-payload component by introducing four new payload-scan presubmit jobs in the ci-operator config for the openshift/check-payload repo.
Practical effect / scope
What each job does (practical terms)
Resource / configuration changes
Purpose