chore: boilerplate-update (agentic SDLC check + base image updates) - #339
Conversation
Pulls latest boilerplate, which includes: - Agentic SDLC conformance check pipeline (ROSA-730) - OWNERS_ALIASES updates - Dockerfile base image updates Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
WalkthroughThis PR adds a new Tekton PipelineRun for agentic SDLC compliance checking that validates required repository files and content rules on pull requests, and updates OWNERS/OWNERS_ALIASES to reorganize approver groups, removing several lead/architect aliases and adding new rosa-staff-engineers, rosa-managers, and hp-architects groups. ChangesAgentic SDLC Check Pipeline
Ownership and Alias Updates
Estimated code review effort: 2 (Simple) | ~10 minutes Sequence Diagram(s)sequenceDiagram
participant PipelineRun
participant CloneRepository
participant CheckFileExistence
participant CheckContentValidation
PipelineRun->>CloneRepository: clone source_url at revision
CloneRepository-->>PipelineRun: repository workspace
PipelineRun->>CheckFileExistence: verify required files exist
CheckFileExistence-->>PipelineRun: PASS/FAIL/WARN counts
PipelineRun->>CheckContentValidation: validate CLAUDE.md, .codecov.yml, .pre-commit-config.yaml, docs
CheckContentValidation-->>PipelineRun: PASS/FAIL/WARN counts, exit non-zero on failure
Related PRs: None found. Suggested labels: ci, documentation, ownership Suggested reviewers: None identified. Poem: 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.tekton/deadmanssnitch-operator-agentic-sdlc-check-pull-request.yaml (1)
51-51: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueReusing the git-clone image to run unrelated shell checks.
Both check steps run generic shell logic (
date,wc,grep -E,basename) usingquay.io/konflux-ci/git-clone@sha256:..., an image intended for git cloning rather than general scripting. It likely works if it bundles common coreutils, but a dedicated minimal shell/toolbox image would better express intent and avoid depending on an implementation detail of the git-clone image's contents.Also applies to: 102-102
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.tekton/deadmanssnitch-operator-agentic-sdlc-check-pull-request.yaml at line 51, The check steps are using the git-clone image for unrelated shell commands, so update the step image references in the affected Tekton task to a dedicated minimal shell/toolbox image instead of quay.io/konflux-ci/git-clone. Keep the generic command logic in the same check step definitions, but change the image used by the shell-check steps so their intent matches the tooling they require.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.tekton/deadmanssnitch-operator-agentic-sdlc-check-pull-request.yaml:
- Around line 25-44: The clone task setup is mismatched with the check tasks’
expected working directory: clone-repository uses git-clone without placing the
repo under source, while the downstream checks run from
$(workspaces.source.path)/source. Update clone-repository to clone into the
source subdirectory (for example by setting subdirectory on the git-clone task),
or adjust the affected check task definitions to run from the workspace root so
the paths align.
---
Nitpick comments:
In @.tekton/deadmanssnitch-operator-agentic-sdlc-check-pull-request.yaml:
- Line 51: The check steps are using the git-clone image for unrelated shell
commands, so update the step image references in the affected Tekton task to a
dedicated minimal shell/toolbox image instead of quay.io/konflux-ci/git-clone.
Keep the generic command logic in the same check step definitions, but change
the image used by the shell-check steps so their intent matches the tooling they
require.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 0d675cbf-83ae-4729-9f98-2e6ae846c624
⛔ Files ignored due to path filters (6)
boilerplate/_data/last-boilerplate-commitis excluded by!boilerplate/**boilerplate/openshift/golang-osd-operator/OWNERS_ALIASESis excluded by!boilerplate/**boilerplate/openshift/golang-osd-operator/agentic-sdlc-check-pull-request.yaml.tmplis excluded by!boilerplate/**boilerplate/openshift/golang-osd-operator/updateis excluded by!boilerplate/**build/Dockerfileis excluded by!build/**build/Dockerfile.olm-registryis excluded by!build/**
📒 Files selected for processing (3)
.tekton/deadmanssnitch-operator-agentic-sdlc-check-pull-request.yamlOWNERSOWNERS_ALIASES
| - name: clone-repository | ||
| params: | ||
| - name: url | ||
| value: '{{source_url}}' | ||
| - name: revision | ||
| value: '{{revision}}' | ||
| taskRef: | ||
| params: | ||
| - name: name | ||
| value: git-clone | ||
| - name: bundle | ||
| value: quay.io/konflux-ci/tekton-catalog/task-git-clone:0.1@sha256:39efcb7d049d84feccce65e589996a89b19ab7c9f504015c3792e3daee697da3 | ||
| - name: kind | ||
| value: task | ||
| resolver: bundles | ||
| workspaces: | ||
| - name: output | ||
| workspace: workspace | ||
| - name: basic-auth | ||
| workspace: git-auth |
There was a problem hiding this comment.
🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win
🧩 Analysis chain
🌐 Web query:
Does the konflux-ci tekton-catalog task-git-clone:0.1 bundle clone into a "source" subdirectory by default or into the workspace root?
💡 Result:
The default behavior for the Tekton Catalog git-clone task depends on the specific version and implementation context. In the standard upstream Tekton Catalog (git-clone:0.1 and later versions), the task clones the repository into the root of the output workspace by default [1][2][3]. However, in certain Konflux-ci or Red Hat AppStudio implementations, the git-clone task is configured with a default value of "source" for the subdirectory parameter [4]. You should verify the default value defined in your specific Task or Pipeline definition, as environments like Konflux may override the upstream default to ensure repositories are cloned into a dedicated "source" subdirectory [4]. In all versions, you can explicitly control this behavior by setting the subdirectory parameter to the desired path [2][3].
Citations:
- 1: https://github.com/tektoncd/catalog/blob/main/task/git-clone/0.1/git-clone.yaml
- 2: https://github.com/tektoncd/catalog/blob/main/task/git-clone/0.4/README.md
- 3: https://github.com/tektoncd-catalog/git-clone/blob/v1.7.0/task/git-clone/git-clone.yaml
- 4: https://raw.githubusercontent.com/redhat-appstudio/tssc-sample-pipelines/main/pac/tasks/git-clone.yaml
🏁 Script executed:
sed -n '1,220p' .tekton/deadmanssnitch-operator-agentic-sdlc-check-pull-request.yamlRepository: openshift/deadmanssnitch-operator
Length of output: 9995
🌐 Web query:
"quay.io/konflux-ci/tekton-catalog/task-git-clone:0.1" subdirectory source default git-clone Tekton Konflux
💡 Result:
The git-clone Tekton Task, including the version specified by the image quay.io/konflux-ci/tekton-catalog/task-git-clone:0.1, includes a subdirectory parameter used to control where the repository is cloned within the output workspace [1][2][3]. By default, the git-clone Task clones the repository into the root of the output Workspace [1][2][3][4]. To change this behavior, you can set the subdirectory parameter [1][3][5]. Key details regarding the subdirectory parameter: - Function: Specifies the relative path within the output Workspace where the repository should be cloned [3][4][5]. - Default: Empty string (""), which results in the repository being cloned to the root of the workspace [3][5][6]. - Usage: When you provide a value for this parameter, the Task will clone the repository into that specified subdirectory [1][3]. This parameter is a standard feature across various versions of the Tekton git-clone Task [3][5][6]. If you are working in a Konflux or Tekton environment, ensure your Pipeline Task configuration includes this parameter under the params section if a non-root destination is required [3][5].
Citations:
- 1: https://artifacthub.io/packages/tekton-task/tekton-catalog-tasks/git-clone/0.1.0
- 2: https://github.com/tektoncd/catalog/blob/main/task/git-clone/0.1/git-clone.yaml
- 3: https://github.com/tektoncd/catalog/blob/main/task/git-clone/0.4/README.md
- 4: https://github.com/openshift-pipelines/task-git/blob/main/docs/task-git-clone.md
- 5: https://github.com/tektoncd/catalog/blob/main/task/git-clone/0.10/git-clone.yaml
- 6: https://github.com/tektoncd-catalog/git-clone/tree/main/task/git-clone
🌐 Web query:
site:github.com "task-git-clone:0.1" "subdirectory" "source" tekton
💡 Result:
In the Tekton git-clone Task (including version 0.1), the subdirectory parameter allows you to specify a relative path within the output Workspace where the Git repository should be cloned [1][2]. By default, the git-clone Task clones the repository directly into the root of the designated output Workspace [2][3][4]. If you set the subdirectory parameter, the Task will instead place the cloned repository contents into that specific sub-folder [1][3]. Key details regarding this parameter: - Purpose: It defines the target destination inside the output volume [2][5]. - Default: The default value is an empty string (""), which results in cloning to the root of the workspace [2][3][6]. - Behavior with deleteExisting: By default, the git-clone Task is configured to delete the contents of the target directory (or the workspace root if no subdirectory is specified) before performing the clone operation [3][4]. This behavior is controlled by the deleteExisting parameter, which defaults to "true" [2][5][6]. While version 0.1 is an early version of this task, the functionality for the subdirectory parameter has been a consistent feature across subsequent versions of the Tekton Catalog git-clone Task [3][4][5][7].
Citations:
- 1: https://github.com/tektoncd/catalog/blob/main/task/git-clone/0.1/git-clone.yaml
- 2: https://github.com/openshift-pipelines/task-git/blob/main/docs/task-git-clone.md
- 3: https://github.com/tektoncd/catalog/blob/main/task/git-clone/0.4/README.md
- 4: https://github.com/tektoncd/catalog/blob/main/task/git-clone/0.10/git-clone.yaml
- 5: https://github.com/tektoncd/catalog/blob/main/task/git-clone/0.6/git-clone.yaml
- 6: https://github.com/tektoncd-catalog/git-clone/tree/main/task/git-clone
- 7: https://github.com/tektoncd-catalog/git-clone/blob/v1.7.0/task/git-clone/git-clone.yaml
Clone the repository into source or update the workingDir
git-clone:0.1 clones to the root of the output workspace by default, but both check tasks run from $(workspaces.source.path)/source. Add subdirectory: source to clone-repository, or change the check tasks to use the workspace root.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.tekton/deadmanssnitch-operator-agentic-sdlc-check-pull-request.yaml around
lines 25 - 44, The clone task setup is mismatched with the check tasks’ expected
working directory: clone-repository uses git-clone without placing the repo
under source, while the downstream checks run from
$(workspaces.source.path)/source. Update clone-repository to clone into the
source subdirectory (for example by setting subdirectory on the git-clone task),
or adjust the affected check task definitions to run from the workspace root so
the paths align.
openshift-ci
Bot
added
the
approved
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #339 +/- ##
=======================================
Coverage 43.28% 43.28%
=======================================
Files 11 11
Lines 834 834
=======================================
Hits 361 361
Misses 424 424
Partials 49 49 🚀 New features to boost your workflow:
|
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: geowa4, tnierman The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
@tnierman: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
7f8a2d6
into
openshift:master
3 participants
Summary
make boilerplate-updateto pull latest boilerplate changesNotable changes
.tekton/deadmanssnitch-operator-agentic-sdlc-check-pull-request.yamlboilerplate/openshift/golang-osd-operator/agentic-sdlc-check-pull-request.yaml.tmplboilerplate/openshift/golang-osd-operator/updatebuild/Dockerfile,build/Dockerfile.olm-registryOWNERS_ALIASESTest plan
ROSA-730
🤖 Generated with Claude Code
Summary by CodeRabbit