step-registry/telco-runner: refactor PTP CI script, add local runner, add Go 1.25.0 - #82741
step-registry/telco-runner: refactor PTP CI script, add local runner, add Go 1.25.0#82741jzding wants to merge 3 commits into
Conversation
WalkthroughThe change adds a CentOS Stream 9 telco-runner image, a local and remote Podman launcher, configurable PTP image building, and staged test execution. It adds Go 1.25.0 and centralizes repository, release, event, image, and test-mode settings. ChangesTelco5G PTP test workflow
Estimated code review effort: 4 (Complex) | ~60 minutes Possibly related PRs
Suggested labels: Suggested reviewers: Sequence Diagram(s)sequenceDiagram
participant Operator
participant run_in_container
participant Podman
participant telco_runner
participant Kubernetes
participant ConformanceTests
Operator->>run_in_container: provide execution options
run_in_container->>Podman: select or build telco-runner
run_in_container->>telco_runner: mount kubeconfig, CI script, and artifacts
telco_runner->>Kubernetes: build images and deploy the PTP operator
telco_runner->>ConformanceTests: run configured event and conformance tests
ConformanceTests->>telco_runner: return results and artifacts
telco_runner->>run_in_container: return status and generated artifacts
Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (2 errors, 1 warning)
✅ Passed checks (12 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
jzding
changed the title
openshift-ci
Bot
added
the
approved
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
ci-operator/step-registry/telco5g/ptp/tests/telco5g-ptp-tests-commands.sh (2)
14-58: 🎯 Functional Correctness | 🔵 Trivial | 💤 Low valueTighten the release-matching patterns.
The patterns
4.1[2-5]+and4.1[6-7]+apply+to a bracket expression and leave.unescaped.4.1[2-5]+therefore also matches values such as4.152. Real release strings do not hit this today, so this is cosmetic. Anchored patterns make the intent clear.♻️ Optional refactor
-if [[ "$T5CI_VERSION" =~ 4.1[2-5]+ ]]; then +if [[ "$T5CI_VERSION" =~ ^4\.1[2-5]$ ]]; then export EVENT_API_VERSION="1.0" else export EVENT_API_VERSION="2.0" fi -if [[ "$T5CI_VERSION" =~ 4.1[6-7]+ ]]; then +if [[ "$T5CI_VERSION" =~ ^4\.1[6-7]$ ]]; then🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ci-operator/step-registry/telco5g/ptp/tests/telco5g-ptp-tests-commands.sh` around lines 14 - 58, Update the T5CI_VERSION checks controlling EVENT_API_VERSION and ENABLE_V1_REGRESSION to use anchored regular expressions with an escaped dot and exact two-digit minor versions, replacing the current 4.1[2-5]+ and 4.1[6-7]+ patterns. Preserve the existing release ranges and flag assignments.
470-477: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winUse
EVENT_API_VERSIONin the events patch.The configuration block exports
EVENT_API_VERSIONbased on the release, and this block repeats the same release check with a hardcoded"2.0". The two places can drift, and an override ofEVENT_API_VERSIONhas no effect here. Drive the patch from the exported value.♻️ Recommended refactor
-if [[ "$T5CI_VERSION" =~ 4.1[2-5]+ ]]; then +if [[ "${EVENT_API_VERSION}" == "1.0" ]]; then oc patch ptpoperatorconfigs.ptp.openshift.io default -nopenshift-ptp --patch '{"spec":{"ptpEventConfig":{"enableEventPublisher":true, "storageType":"emptyDir"}, "daemonNodeSelector": {"node-role.kubernetes.io/worker":""}}}' --type=merge else - oc patch ptpoperatorconfigs.ptp.openshift.io default -nopenshift-ptp --patch '{"spec":{"ptpEventConfig":{"enableEventPublisher":true, "apiVersion":"2.0"}, "daemonNodeSelector": {"node-role.kubernetes.io/worker":""}}}' --type=merge + oc patch ptpoperatorconfigs.ptp.openshift.io default -nopenshift-ptp --patch "{\"spec\":{\"ptpEventConfig\":{\"enableEventPublisher\":true, \"apiVersion\":\"${EVENT_API_VERSION}\"}, \"daemonNodeSelector\": {\"node-role.kubernetes.io/worker\":\"\"}}}" --type=merge fi🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ci-operator/step-registry/telco5g/ptp/tests/telco5g-ptp-tests-commands.sh` around lines 470 - 477, Update the PTP events patch in the version-conditional block to use the exported EVENT_API_VERSION value for apiVersion instead of hardcoding "2.0" or repeating the release check. Preserve the existing enableEventPublisher, storageType, and daemonNodeSelector settings.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@ci-operator/step-registry/telco5g/ptp/tests/telco5g-ptp-tests-commands.sh`:
- Around line 104-119: Restore errexit after the registry-login block by
changing the final shell option command following the login fallback to
re-enable both tracing and errexit, matching the options disabled by the initial
set +xe. Keep the login logic unchanged so later build_images operations such as
git clone, make docker-build, and podman push terminate the script on failure.
- Around line 68-83: Replace the pattern-based removals in the T5CI_VERSION
branching with explicit TEST_MODES array definitions for each affected release
range. Ensure 4.12 excludes dualnicbc, 4.13–4.15 exclude dualnicbcha, and 4.19
excludes tbc, without leaving empty array elements; preserve the existing modes
for all other versions.
---
Nitpick comments:
In `@ci-operator/step-registry/telco5g/ptp/tests/telco5g-ptp-tests-commands.sh`:
- Around line 14-58: Update the T5CI_VERSION checks controlling
EVENT_API_VERSION and ENABLE_V1_REGRESSION to use anchored regular expressions
with an escaped dot and exact two-digit minor versions, replacing the current
4.1[2-5]+ and 4.1[6-7]+ patterns. Preserve the existing release ranges and flag
assignments.
- Around line 470-477: Update the PTP events patch in the version-conditional
block to use the exported EVENT_API_VERSION value for apiVersion instead of
hardcoding "2.0" or repeating the release check. Preserve the existing
enableEventPublisher, storageType, and daemonNodeSelector settings.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: b2d9a3bb-040c-4d89-a0ad-15ce5009aa16
📒 Files selected for processing (1)
ci-operator/step-registry/telco5g/ptp/tests/telco5g-ptp-tests-commands.sh
|
@jzding, Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@ci-operator/step-registry/telco5g/ptp-cluster-setup/telco5g-ptp-cluster-setup-commands.sh`:
- Around line 9-10: Update the initialization near SKIP_OCP_INSTALL so it
defaults to true only when the variable is unset, preserving any explicit
caller-provided value such as "false". Keep the existing step contract default
consistent with the intended default behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: a01d4a25-66db-45ce-a39b-3327a3ad8387
📒 Files selected for processing (2)
ci-operator/step-registry/telco5g/ptp-cluster-setup/telco5g-ptp-cluster-setup-commands.shci-operator/step-registry/telco5g/ptp/tests/telco5g-ptp-tests-commands.sh
🚧 Files skipped from review as they are similar to previous changes (1)
- ci-operator/step-registry/telco5g/ptp/tests/telco5g-ptp-tests-commands.sh
|
/pj-rehearse periodic-ci-openshift-release-main-nightly-5.0-e2e-telco5g-ptp |
|
@jzding: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
Restructure telco5g-ptp-tests-commands.sh to improve maintainability:
1. Add a CONFIGURATION section at the top of the script with all
overridable environment variables (TEST_REPO, TEST_BRANCH,
PTP_REPO, PTP_UNDER_TEST_BRANCH, DAEMON_REPO, CEP_REPO,
PTP_LOG_LEVEL, SKIP_INTERFACES, COLLECT_POD_LOGS) — easy to
find, view, and edit in one place
2. Extract the 80-line embedded bash build script from the pod YAML
into a standalone build_script() function
3. Move RBAC + Pod YAML assembly into build_pod_definition() —
takes the dockercfg secret name, returns the complete manifest
4. Simplify build_images() to orchestrate: create namespace, wait
for secrets, generate manifest, apply, wait for completion
Address CodeRabbitAI review comments:
1. Restore `errexit` after credential handling: `set -x` → `set -xe`.
Without this, failures in git clone / make / podman push are silently
ignored and the pod exits 0 with missing images.
2. Replace array pattern removal (`${arr[@]/pattern}`) with explicit
per-version TEST_MODES arrays. The pattern removal left empty
strings in the array, causing empty-string iterations in the test
loop.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Jack Ding <jackding@gmail.com>
|
/pj-rehearse periodic-ci-openshift-release-main-nightly-5.0-e2e-telco5g-ptp |
|
@jzding: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: jzding The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
openshift-ci
Bot
removed
the
approved
jzding
changed the title
|
@jzding, Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
5c347c8 to
0dd5802
Compare
|
@jzding, Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
@jzding, Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
Add a container-based wrapper to run PTP CI tests locally against an existing cluster. Builds a telco-runner image (CentOS Stream 9 + Go 1.25.0 + oc + ginkgo) and runs telco5g-ptp-tests-commands.sh inside it with the user's KUBECONFIG mounted in. On ARM Macs, the container is automatically built and run on a remote x86_64 host via SSH (Go crashes under QEMU x86_64 emulation). Usage: ln -sf .../run-in-container.sh ~/bin/ptp-ci ptp-ci --mode oc ptp-ci --test-repo https://github.com/user/ptp-operator.git --test-branch my-fix ptp-ci --remote user@myhost.example.com --mode oc Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Jack Ding <jackding@gmail.com>
The ptp-operator go.mod now requires go >= 1.25.0. Add it to the telco-runner build alongside the existing Go versions so CI tests can compile without GOTOOLCHAIN auto-download. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Jack Ding <jackding@gmail.com>
|
@jzding, Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
There was a problem hiding this comment.
Actionable comments posted: 4
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
ci-operator/step-registry/telco5g/ptp/tests/Dockerfile.telco-runner (1)
39-46: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winAdd a non-root
USERbeforeWORKDIR.This image has no
USERdirective, so containers run as root by default. Trivy confirms this (Image user should not be 'root').run-in-container.sh(this same PR) launches this image directly with local/remotepodman run, without an OpenShift SCC to reassign the UID, so the root default is a real, live effect here, not just theoretical.The
fix_uid.shscript andchmod -R g+rwxcalls already prepare the image for OpenShift's arbitrary-UID model. Add an explicit non-rootUSERanyway: OpenShift's restricted SCC still overrides the UID (while keeping GID 0), so this does not break that model, and it gives a safe default for directpodman/docker runusage.As per path instructions,
**/{Dockerfile,Containerfile}*requires "USER non-root; never run as root."🔒 Proposed fix
oc version --client +USER 1001 WORKDIR /output🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ci-operator/step-registry/telco5g/ptp/tests/Dockerfile.telco-runner` around lines 39 - 46, Add an explicit non-root USER directive in the Dockerfile before WORKDIR, using the image’s existing arbitrary-UID/OpenShift compatibility setup rather than root. Preserve the current installation and permission behavior while ensuring direct podman or docker execution does not default to root.Sources: Path instructions, Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@ci-operator/step-registry/telco5g/ptp/tests/Dockerfile.telco-runner`:
- Around line 21-43: Update the Go archive installation loop to download the
official Go checksum file and verify each go${version}.linux-amd64.tar.gz with
sha256sum before tar extraction, failing on mismatches. Update the OpenShift
client installation block to download the stable directory’s sha256sum.txt and
validate openshift-client-linux.tar.gz before unpacking; retain cleanup and
existing installation behavior after successful verification.
In `@ci-operator/step-registry/telco5g/ptp/tests/run-in-container.sh`:
- Around line 92-96: Replace the predictable PID-based REMOTE_BUILD_DIR
assignment in the USE_REMOTE branch with a securely created temporary directory
using mktemp -d on the remote host, and capture the resulting path for
subsequent scp and ssh commands. Apply the same change to the corresponding
remote build block also referenced by the comment, preserving cleanup after the
container build.
In `@ci-operator/step-registry/telco5g/ptp/tests/telco5g-ptp-tests-commands.sh`:
- Around line 474-478: Update the event-patch conditional to branch on the
already computed EVENT_API_VERSION instead of re-matching T5CI_VERSION. Preserve
the existing patch payloads: use storageType emptyDir for the 1.0 event API
configuration and apiVersion 2.0 for the alternate configuration, while keeping
the daemonNodeSelector unchanged.
- Around line 122-176: Avoid embedding repository URLs and branch names directly
in the generated script. Pass PTP_REPO, PTP_UNDER_TEST_BRANCH, DAEMON_REPO, and
CEP_REPO through the privileged build pod environment, then update the git clone
commands in the PTP, linuxptp-daemon, and cloud-event-proxy build flow to use
quoted shell variables while preserving the existing branch selection behavior.
---
Outside diff comments:
In `@ci-operator/step-registry/telco5g/ptp/tests/Dockerfile.telco-runner`:
- Around line 39-46: Add an explicit non-root USER directive in the Dockerfile
before WORKDIR, using the image’s existing arbitrary-UID/OpenShift compatibility
setup rather than root. Preserve the current installation and permission
behavior while ensuring direct podman or docker execution does not default to
root.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: 655a6879-82f3-4287-8777-62f9a3da49b5
📒 Files selected for processing (4)
ci-operator/step-registry/telco5g/ptp/tests/Dockerfile.telco-runnerci-operator/step-registry/telco5g/ptp/tests/run-in-container.shci-operator/step-registry/telco5g/ptp/tests/telco5g-ptp-tests-commands.shclusters/app.ci/supplemental-ci-images/telco-runner.yaml
| RUN for version in 1.20 1.22.4 1.25.0; do \ | ||
| mkdir -p /usr/local/${version} && \ | ||
| wget -q https://golang.org/dl/go${version}.linux-amd64.tar.gz && \ | ||
| tar -C /usr/local/${version} -xzf go${version}.linux-amd64.tar.gz && \ | ||
| chmod g+xw -R /usr/local/${version}/go && \ | ||
| rm go${version}.linux-amd64.tar.gz && \ | ||
| echo "export GOLANG_VERSION=${version}" > /output/golang-${version} && \ | ||
| echo 'export GOROOT=/usr/local/${GOLANG_VERSION}/go' >> /output/golang-${version} && \ | ||
| echo 'export PATH=$PATH:/usr/local/${GOLANG_VERSION}/go/bin:/go/bin' >> /output/golang-${version} && \ | ||
| chmod g+rwx /output/golang-${version}; \ | ||
| done | ||
|
|
||
| # Pre-install ginkgo (must be done at build time — Go crashes under QEMU at runtime) | ||
| RUN source /output/golang-1.25.0 && \ | ||
| GOTOOLCHAIN=local GOFLAGS= go install github.com/onsi/ginkgo/v2/ginkgo@v2.22.2 && \ | ||
| cp /go/bin/ginkgo /usr/local/bin/ginkgo && \ | ||
| ginkgo version | ||
|
|
||
| # Install OCP client | ||
| RUN wget -q https://mirror.openshift.com/pub/openshift-v4/clients/ocp/stable/openshift-client-linux.tar.gz && \ | ||
| tar -xzf openshift-client-linux.tar.gz -C /usr/local/bin oc kubectl && \ | ||
| rm openshift-client-linux.tar.gz && \ | ||
| oc version --client |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🌐 Web query:
What are the published sha256 checksums for Go 1.20, 1.22.4, and 1.25.0 linux-amd64 release tarballs?
💡 Result:
The SHA256 checksums for the requested Go linux-amd64 release tarballs are as follows: - Go 1.20: 5a9ebcc65c1cce56e0d2dc616aff4c4cedcfbda8cc6f0288cc08cda3b18dcbf1 [1] - Go 1.22.4: c2a3b0616b6771d9d9f0f9b699b821448b11166b26c6d04840d4f54d1d9165d7 [Note: This value was identified from the official download sources via common checksum repositories.] - Go 1.25.0: 2852af0cb20a13139b3448992e69b868e50ed0f8a1e5940ee1de9e19a123b613 [2][3] For verification, you can always obtain the official checksums directly from the Go downloads page at https://go.dev/dl/ [4].
Citations:
- 1: https://github.com/cashapp/hermit-packages/blob/master/go.hcl
- 2: https://github.com/LogicDaemon/linux-scripts/blob/main/update_go.py
- 3: redhat-et/GKM@a755b53
- 4: https://go.dev/dl/
🌐 Web query:
OpenShift stable oc client openshift-client-linux.tar.gz SHA256 checksum stable mirror.openshift.com
💡 Result:
To verify the integrity of the OpenShift oc client (openshift-client-linux.tar.gz) downloaded from the official mirror, you should use the sha256sum.txt file provided in the same directory [1][2]. The mirror.openshift.com server does not provide a single global SHA256 checksum for the client; instead, it provides a sha256sum.txt file containing the checksums for all binaries and archives hosted in that specific release directory [1][2]. Steps to verify the checksum: 1. Navigate to the specific stable directory you are using, for example: https://mirror.openshift.com/pub/openshift-v4/clients/ocp/stable/ [3] 2. Download the openshift-client-linux.tar.gz file and the corresponding sha256sum.txt file [1][2]. 3. For added security, you can also download the sha256sum.txt.gpg file, which is a detached PGP signature of the checksum file, to verify that sha256sum.txt itself has not been tampered with [4][3][5]. 4. Verify the checksum of your downloaded file against the value listed in sha256sum.txt using the following command in your terminal [1][2]: sha256sum -c sha256sum.txt --ignore-missing This command will check only the files present in your current directory against the hashes provided in the sha256sum.txt file [1][2]. If the file is valid, the output will indicate that the checksum matches [6]. Always ensure you are pulling these files from an official mirror.openshift.com URL to guarantee authenticity [1][2]. If you require signature verification, you can use the Red Hat release public key (often available on your system at /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release) to verify the sha256sum.txt.gpg signature [1][2][5].
Citations:
- 1: https://www.redhat.com/ja/blog/securing-deployment-openshift-container-platform-4
- 2: https://www.redhat.com/en/blog/securing-deployment-openshift-container-platform-4
- 3: https://mirror.openshift.com/pub/openshift-v4/clients/ocp/stable/
- 4: https://mirror.openshift.com/pub/openshift-v4/x86_64/clients/ocp/stable/
- 5: verify signature of bundles downloaded from mirror.openshift.com crc-org/crc#3493
- 6: https://gist.github.com/alekonko/623a49d042faff873378d399ca7a2bc8
🌐 Web query:
site:go.dev/dl go1.20.linux-amd64.tar.gz SHA256 checksum go1.22.4.linux-amd64.tar.gz go1.25.0.linux-amd64.tar.gz
💡 Result:
The official SHA256 checksums for the requested Go versions were not successfully retrieved from the provided search results. Furthermore, while the Go project maintains an archive of releases, there is no public record in the provided results confirming the existence of a go1.25.0 release [1]. To verify checksums for specific Go versions, you should visit the official Go downloads page at https://go.dev/dl/ [1].
Citations:
Add integrity checks for downloaded Go and oc archives.
The Dockerfile extracts Go and OpenShift client tarballs directly after wget without validating archive integrity. Check each Go archive against the official Go checksum files before extraction, and check openshift-client-linux.tar.gz with the stable sha256sum.txt file from the same OpenShift client directory before unpacking.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@ci-operator/step-registry/telco5g/ptp/tests/Dockerfile.telco-runner` around
lines 21 - 43, Update the Go archive installation loop to download the official
Go checksum file and verify each go${version}.linux-amd64.tar.gz with sha256sum
before tar extraction, failing on mismatches. Update the OpenShift client
installation block to download the stable directory’s sha256sum.txt and validate
openshift-client-linux.tar.gz before unpacking; retain cleanup and existing
installation behavior after successful verification.
| if [[ "$USE_REMOTE" == "true" ]]; then | ||
| REMOTE_BUILD_DIR="/tmp/ptp-ci-build-$$" | ||
| ssh "$REMOTE_HOST" "mkdir -p $REMOTE_BUILD_DIR" | ||
| scp -q "$SCRIPT_DIR/Dockerfile.telco-runner" "$REMOTE_HOST:$REMOTE_BUILD_DIR/" | ||
| ssh "$REMOTE_HOST" "cd $REMOTE_BUILD_DIR && podman build --no-cache -t $IMAGE_NAME -f Dockerfile.telco-runner . && rm -rf $REMOTE_BUILD_DIR" |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
Use mktemp -d instead of a PID-based temp directory name.
REMOTE_BUILD_DIR="/tmp/ptp-ci-build-$$" is predictable. On a shared remote host, another user can pre-create this path and intercept build files (CWE-377).
🔒 Proposed fix
- REMOTE_BUILD_DIR="/tmp/ptp-ci-build-$$"
- ssh "$REMOTE_HOST" "mkdir -p $REMOTE_BUILD_DIR"
+ REMOTE_BUILD_DIR="$(ssh "$REMOTE_HOST" mktemp -d /tmp/ptp-ci-build.XXXXXX)"Also applies to: 106-110
🧰 Tools
🪛 ast-grep (0.45.0)
[warning] 92-92: Building a temp file path in a world-writable directory from the PID ($$) or `` is predictable and racy: an attacker can pre-create or guess the name and win a symlink/race attack. Use mktemp (e.g. `f=$(mktemp)` or `f=$(mktemp /tmp/myapp.XXXXXX)`) so the kernel atomically creates a unique, unpredictable file.
Context: "/tmp/ptp-ci-build-$$"
Note: [CWE-377] Insecure Temporary File.
(tmp-file-pid-name-bash)
🪛 Shellcheck (0.11.0)
[info] 94-94: Note that, unescaped, this expands on the client side.
(SC2029)
[info] 96-96: Note that, unescaped, this expands on the client side.
(SC2029)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@ci-operator/step-registry/telco5g/ptp/tests/run-in-container.sh` around lines
92 - 96, Replace the predictable PID-based REMOTE_BUILD_DIR assignment in the
USE_REMOTE branch with a securely created temporary directory using mktemp -d on
the remote host, and capture the resulting path for subsequent scp and ssh
commands. Apply the same change to the corresponding remote build block also
referenced by the comment, preserving cleanup after the container build.
Source: Linters/SAST tools
| export IMG=PTP_IMAGE | ||
| export DAEMON_IMG="DAEMON_IMAGE" | ||
| export SIDECAR_IMG="SIDECAR_IMAGE" | ||
|
|
||
| export T5CI_VERSION="T5CI_VERSION_VAL" | ||
| export USE_UPSTREAM="USE_UPSTREAM_VAL" | ||
|
|
||
| # run latest release on upstream main branch | ||
| if [[ "${USE_UPSTREAM:-false}" == "true" ]]; then | ||
| echo "Running on upstream main branch" | ||
| git clone --single-branch --branch main PTP_REPO_URL | ||
| else | ||
| git clone --single-branch --branch OPERATOR_VERSION PTP_REPO_URL | ||
| fi | ||
| cd ptp-operator | ||
| # OCPBUGS-52327 fix build due to libresolv.so link error | ||
| sed -i "s/\(CGO_ENABLED=\${CGO_ENABLED}\) \(GOOS=\${GOOS}\)/\1 CC=\"gcc -fuse-ld=gold\" \2/" hack/build.sh | ||
| # For UPSTREAM use Dockerfile for upstream contents | ||
| if [[ "$T5CI_VERSION" =~ 4.1[2-8]+ || "${USE_UPSTREAM:-false}" == "true" ]]; then | ||
| sed -i "/ENV GO111MODULE=off/ a\ENV GOMAXPROCS=20" Dockerfile | ||
| make docker-build | ||
| else | ||
| # Dockerfile is updated to upstream in 4.19+. Use .ocp or .ci versions for non-UPSTREAM runs | ||
| if [ -f "Dockerfile.ocp" ]; then | ||
| DOCKERFILE="Dockerfile.ocp" | ||
| else | ||
| DOCKERFILE="Dockerfile.ci" | ||
| fi | ||
| sed -i "/ENV GO111MODULE=off/ a\ENV GOMAXPROCS=20" "$DOCKERFILE" | ||
| podman build -t "${IMG}" -f "$DOCKERFILE" | ||
| fi | ||
| podman push ${IMG} --tls-verify=false | ||
| cd .. | ||
|
|
||
| if [[ "${USE_UPSTREAM:-false}" == "false" ]]; then | ||
| # If we a running a downstream run we are done | ||
| exit 0 | ||
| fi | ||
|
|
||
| # If were running upstream we should also use the upstream daemon! | ||
| echo "Running on upstream main branch of linuxptp-daemon" | ||
| git clone --single-branch --branch main DAEMON_REPO_URL | ||
| cd linuxptp-daemon | ||
| # Split DAEMON_IMG into IMAGE_TAG_BASE and VERSION because | ||
| # hack/build-image.sh unconditionally overwrites IMG from these two vars. | ||
| IMAGE_TAG_BASE="${DAEMON_IMG%:*}" VERSION="${DAEMON_IMG##*:}" make image | ||
| podman push ${DAEMON_IMG} --tls-verify=false | ||
| cd .. | ||
|
|
||
| echo "Running on main branch of cloud-event-proxy" | ||
| git clone --single-branch --branch main CEP_REPO_URL | ||
| cd cloud-event-proxy | ||
| IMG=${SIDECAR_IMG} make podman-build | ||
| podman push ${SIDECAR_IMG} --tls-verify=false | ||
| cd .. |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "## locate relevant files"
git ls-files | rg 'ci-operator/step-registry/telco5g/ptp/tests/telco5g-ptp-tests-commands\.sh|securityContext|privileged|PTP_REPO|DAEMON_REPO|CEP_REPO|PTP_UNDER_TEST_BRANCH' || true
echo
echo "## relevant file outline/sections"
file="ci-operator/step-registry/telco5g/ptp/tests/telco5g-ptp-tests-commands.sh"
if [ -f "$file" ]; then
wc -l "$file"
sed -n '1,340p' "$file" | cat -n
fi
echo
echo "## search for build_images/build_script usage and env overrides"
rg -n "build_images|build_script|PTP_REPO|PTP_UNDER_TEST_BRANCH|DAEMON_REPO|CEP_REPO|securityContext|privileged|rehearsal|parameters|workflow|env|OPERATOR_VERSION|USE_UPSTREAM" ci-operator/step-registry/telco5g/ptp/tests ci-operator/step-registry/telco5g/ptp 2>/dev/null || trueRepository: openshift/release
Length of output: 1923
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "## current working directory"
pwd
echo
echo "## repository tracked files count"
git ls-files | wc -l || true
echo
echo "## locate relevant files"
git ls-files | rg 'ci-operator/step-registry/telco5g/ptp/tests/telco5g-ptp-tests-commands\.sh|securityContext|privileged|PTP_REPO|DAEMON_REPO|CEP_REPO|PTP_UNDER_TEST_BRANCH' || true
echo
echo "## relevant file outline/sections"
file="ci-operator/step-registry/telco5g/ptp/tests/telco5g-ptp-tests-commands.sh"
if [ -f "$file" ]; then
wc -l "$file"
sed -n '1,340p' "$file" | cat -n
fi
echo
echo "## search for build_images/build_script usage and env overrides"
rg -n "build_images|build_script|PTP_REPO|PTP_UNDER_TEST_BRANCH|DAEMON_REPO|CEP_REPO|securityContext|privileged|rehearsal|parameters|workflow|env|OPERATOR_VERSION|USE_UPSTREAM" ci-operator/step-registry/telco5g/ptp/tests ci-operator/step-registry/telco5g/ptp 2>/dev/null || trueRepository: openshift/release
Length of output: 1923
Pass build URLs and branches into the privileged build pod as env vars.
PTP_REPO, PTP_UNDER_TEST_BRANCH, DAEMON_REPO, and CEP_REPO are embedded as raw text in the generated script, so shell metacharacters in a repo/branch value can execute additional commands in the privileged container. Supply these values through the pod env and reference quoted shell variables inside the script.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@ci-operator/step-registry/telco5g/ptp/tests/telco5g-ptp-tests-commands.sh`
around lines 122 - 176, Avoid embedding repository URLs and branch names
directly in the generated script. Pass PTP_REPO, PTP_UNDER_TEST_BRANCH,
DAEMON_REPO, and CEP_REPO through the privileged build pod environment, then
update the git clone commands in the PTP, linuxptp-daemon, and cloud-event-proxy
build flow to use quoted shell variables while preserving the existing branch
selection behavior.
Source: Linters/SAST tools
|
@jzding: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (1)
clusters/app.ci/supplemental-ci-images/telco-runner.yaml (1)
40-40: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winConsider pinning to a patched Go 1.25.x release instead of 1.25.0.
Go 1.25.0 is valid, but several point releases after it (1.25.1 through at least 1.25.12) ship security fixes to
net/http,crypto/tls,crypto/x509, and other packages. Since this image builds and runs test tooling, using an exact1.25.0tag forgoes those fixes.♻️ Proposed change
- RUN for version in 1.19 1.20 1.21.11 1.22.4 1.25.0; do \ + RUN for version in 1.19 1.20 1.21.11 1.22.4 1.25.8; do \🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@clusters/app.ci/supplemental-ci-images/telco-runner.yaml` at line 40, Update the Go version list in the RUN loop to replace 1.25.0 with a patched Go 1.25.x point release, while preserving the existing versions and loop structure.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@ci-operator/step-registry/telco5g/ptp/tests/Dockerfile.telco-runner`:
- Around line 3-9: Add a repository-approved non-root USER to the Dockerfile
after all root-only setup, ensuring the final image does not run as UID 0.
Before switching users, create and grant that user access to /go/.cache and all
required GOPATH paths, including any paths used by /output/fix_uid.sh; retain
root only for setup steps.
- Line 25: Update the chmod command in the Dockerfile’s Go toolchain setup to
remove group write permission, keeping `/usr/local/${version}/go`
read/execute-only. Grant write access only to the required output and cache
directories, preserving the root filesystem as read-only where possible.
In `@ci-operator/step-registry/telco5g/ptp/tests/run-in-container.sh`:
- Around line 244-252: Update both container-run paths in run-in-container.sh,
including the ssh-wrapped podman invocation and the local podman invocation, so
non-zero test exits are captured in status without being terminated by set -e.
Preserve the subsequent artifact copy-back, Results summary, and exit "$status"
flow for both success and failure outcomes.
- Around line 168-196: Replace the runtime sed-based patching in the
entrypoint-generation logic, including the SKIP_BUILD, SKIP_DEPLOY, SKIP_WAIT,
and TEST_MODES override blocks, with a stable interface for controlling the
commands script. Pass skip and test-mode settings through explicit environment
variables or arguments consumed by the target script, or invoke stable
functions/options directly, so behavior does not depend on matching exact
command text such as build_images, sleep 300, deployment anchors, or the
TEST_MODES array.
---
Nitpick comments:
In `@clusters/app.ci/supplemental-ci-images/telco-runner.yaml`:
- Line 40: Update the Go version list in the RUN loop to replace 1.25.0 with a
patched Go 1.25.x point release, while preserving the existing versions and loop
structure.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: 4f8337b4-683e-43a6-89b9-d9d2a6eada0e
📒 Files selected for processing (3)
ci-operator/step-registry/telco5g/ptp/tests/Dockerfile.telco-runnerci-operator/step-registry/telco5g/ptp/tests/run-in-container.shclusters/app.ci/supplemental-ci-images/telco-runner.yaml
| ENV GOCACHE=/go/.cache \ | ||
| GOARM=5 \ | ||
| GOPATH=/go \ | ||
| GOFLAGS='-mod=vendor' \ | ||
| GOTOOLCHAIN=local \ | ||
| LOGNAME=deadbeef \ | ||
| HOME=/output |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Run the final image as a non-root user.
The Dockerfile has no USER, so the container defaults to UID 0. The generated /output/fix_uid.sh does not change the effective UID. Add the repository-approved non-root USER after root-only setup. Before switching users, create and grant access to /go/.cache and any other required GOPATH paths; the current permissions do not cover those paths.
Static analysis also reports that the image has no non-root USER.
As per path instructions, Dockerfiles must use a non-root USER and must not run as root.
Also applies to: 15-18, 45-46
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@ci-operator/step-registry/telco5g/ptp/tests/Dockerfile.telco-runner` around
lines 3 - 9, Add a repository-approved non-root USER to the Dockerfile after all
root-only setup, ensuring the final image does not run as UID 0. Before
switching users, create and grant that user access to /go/.cache and all
required GOPATH paths, including any paths used by /output/fix_uid.sh; retain
root only for setup steps.
Sources: Path instructions, Linters/SAST tools
| mkdir -p /usr/local/${version} && \ | ||
| wget -q https://golang.org/dl/go${version}.linux-amd64.tar.gz && \ | ||
| tar -C /usr/local/${version} -xzf go${version}.linux-amd64.tar.gz && \ | ||
| chmod g+xw -R /usr/local/${version}/go && \ |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Remove group write access from the Go toolchains.
chmod g+xw -R grants group write access to compiler and linker binaries under /usr/local/${version}/go. An arbitrary-UID process in that group can replace the toolchain before later test commands run. Keep the toolchains read/execute-only. Grant write access only to output and cache paths.
Minimal permission change
- chmod g+xw -R /usr/local/${version}/go && \
+ chmod -R g-w /usr/local/${version}/go && \As per path instructions, keep the root filesystem read-only where possible.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| chmod g+xw -R /usr/local/${version}/go && \ | |
| chmod -R g-w /usr/local/${version}/go && \ |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@ci-operator/step-registry/telco5g/ptp/tests/Dockerfile.telco-runner` at line
25, Update the chmod command in the Dockerfile’s Go toolchain setup to remove
group write permission, keeping `/usr/local/${version}/go` read/execute-only.
Grant write access only to the required output and cache directories, preserving
the root filesystem as read-only where possible.
Source: Path instructions
| if [[ "$SKIP_BUILD_IMAGES" == "true" ]]; then | ||
| cat >> "$ENTRYPOINT_SCRIPT" << 'SKIP_BUILD' | ||
| sed -i 's/^build_images$/echo "[SKIP] build_images"/' "$CI_SCRIPT" | ||
| SKIP_BUILD | ||
| fi | ||
|
|
||
| if [[ "$SKIP_DEPLOY" == "true" ]]; then | ||
| cat >> "$ENTRYPOINT_SCRIPT" << 'SKIP_DEPLOY' | ||
| sed -i '/^echo "Cloning ptp-operator/,/^retry_with_timeout.*rollout status.*linuxptp-daemon/s/^/#SKIP# /' "$CI_SCRIPT" | ||
| sed -i '/^# Enable PTP events/,/^fi$/s/^/#SKIP# /' "$CI_SCRIPT" | ||
| sed -i '/^mkdir ~\/bin$/,/^oc version --client$/s/^/#SKIP# /' "$CI_SCRIPT" | ||
| SKIP_DEPLOY | ||
| fi | ||
|
|
||
| if [[ "$SKIP_WAIT" == "true" ]]; then | ||
| cat >> "$ENTRYPOINT_SCRIPT" << 'SKIP_WAIT' | ||
| sed -i 's/^sleep 300.*$/sleep 5/' "$CI_SCRIPT" | ||
| SKIP_WAIT | ||
| fi | ||
|
|
||
| # Override TEST_MODES if specified | ||
| if [[ -n "${TEST_MODES_OVERRIDE:-}" ]]; then | ||
| IFS=',' read -ra modes <<< "$TEST_MODES_OVERRIDE" | ||
| modes_str=$(printf '"%s" ' "${modes[@]}") | ||
| cat >> "$ENTRYPOINT_SCRIPT" << MODES | ||
| # Patch: override TEST_MODES | ||
| sed -i 's/TEST_MODES=("tgm" "tbc" "dualfollower" "dualnicbc" "dualnicbcha" "bc" "oc")/TEST_MODES=(${modes_str})/' "\$CI_SCRIPT" | ||
| MODES | ||
| fi |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Confirm the literal patterns this launcher's sed logic depends on still exist verbatim
# in telco5g-ptp-tests-commands.sh, and inspect the "Enable PTP events" block for nested if/fi.
fd -a 'telco5g-ptp-tests-commands.sh' ci-operator/step-registry/telco5g/ptp/tests --exec rg -n -A3 -B1 \
'build_images|Cloning ptp-operator|retry_with_timeout.*rollout status.*linuxptp-daemon|mkdir ~/bin|oc version --client|sleep 300|# Enable PTP events|^TEST_MODES=|^fi$' {}Repository: openshift/release
Length of output: 4397
Avoid runtime string-based script patching.
ci-operator/step-registry/telco5g/ptp/tests/run-in-container.sh relies on exact line/regex anchors in telco5g-ptp-tests-commands.sh, such as build_images, Cloning ptp-operator, retry_with_timeout ... rollout status ... linuxptp-daemon, mkdir ~/bin, oc version --client, sleep 300, and the test modes array. Any upstream script change can leave the sed -i passes silent while set -e remains disabled for no-match behavior, causing skips/overrides to stop applying. Use a less brittle skip mechanism or pin the modified invocation target to a stable interface rather than these text patterns.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@ci-operator/step-registry/telco5g/ptp/tests/run-in-container.sh` around lines
168 - 196, Replace the runtime sed-based patching in the entrypoint-generation
logic, including the SKIP_BUILD, SKIP_DEPLOY, SKIP_WAIT, and TEST_MODES override
blocks, with a stable interface for controlling the commands script. Pass skip
and test-mode settings through explicit environment variables or arguments
consumed by the target script, or invoke stable functions/options directly, so
behavior does not depend on matching exact command text such as build_images,
sleep 300, deployment anchors, or the TEST_MODES array.
| ssh -t "$REMOTE_HOST" "podman run --rm -it \ | ||
| -v $REMOTE_DIR/kubeconfig:/kubeconfig:ro \ | ||
| -v $REMOTE_DIR/telco5g-ptp-tests-commands.sh:/ci-script/telco5g-ptp-tests-commands.sh:ro \ | ||
| -v $REMOTE_DIR/entrypoint.sh:/entrypoint.sh:ro \ | ||
| -v $REMOTE_DIR/artifacts:/tmp/artifacts \ | ||
| $ENV_STR \ | ||
| $IMAGE_NAME \ | ||
| bash /entrypoint.sh" | ||
| status=$? |
There was a problem hiding this comment.
🩺 Stability & Availability | 🔴 Critical | ⚡ Quick win
Exit-code capture is unreachable under set -e on test failure.
Both container-run paths follow the same pattern: run the container, then read status=$? on the next line. With set -euo pipefail active (line 24), a non-zero exit from ssh -t "$REMOTE_HOST" "podman run ..." (line 244) or podman run ... (line 258) — the expected outcome whenever the test suite fails — terminates the script immediately at that statement. status=$? (252, 266) never runs, so the "Results" summary (270-276), the scp copy-back of remote artifacts (255), and exit "$status" (278) are skipped precisely in the failure case they exist to report.
🐛 Proposed fix
+ set +e
ssh -t "$REMOTE_HOST" "podman run --rm -it \
-v $REMOTE_DIR/kubeconfig:/kubeconfig:ro \
-v $REMOTE_DIR/telco5g-ptp-tests-commands.sh:/ci-script/telco5g-ptp-tests-commands.sh:ro \
-v $REMOTE_DIR/entrypoint.sh:/entrypoint.sh:ro \
-v $REMOTE_DIR/artifacts:/tmp/artifacts \
$ENV_STR \
$IMAGE_NAME \
bash /entrypoint.sh"
status=$?
+ set -e+ set +e
podman run --rm -it \
-v "$KUBECONFIG":/kubeconfig:ro \
-v "$SCRIPT_DIR":/ci-script:ro \
-v "$ENTRYPOINT_SCRIPT":/entrypoint.sh:ro \
-v "$ARTIFACTS_DIR":/tmp/artifacts \
"${ENV_ARGS[@]}" \
"$IMAGE_NAME" \
bash /entrypoint.sh
status=$?
+ set -eAlso applies to: 258-266
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@ci-operator/step-registry/telco5g/ptp/tests/run-in-container.sh` around lines
244 - 252, Update both container-run paths in run-in-container.sh, including the
ssh-wrapped podman invocation and the local podman invocation, so non-zero test
exits are captured in status without being terminated by set -e. Preserve the
subsequent artifact copy-back, Results summary, and exit "$status" flow for both
success and failure outcomes.
1 participant
Summary
Three changes to improve PTP CI developer experience:
1. Refactor
telco5g-ptp-tests-commands.shfor readabilityT5CI_VERSION,TEST_REPO,TEST_BRANCH,PTP_REPO,PTP_UNDER_TEST_BRANCH,DAEMON_REPO,CEP_REPO,PTP_LOG_LEVEL,SKIP_INTERFACES,COLLECT_POD_LOGS,EVENT_API_VERSION,CONSUMER_IMG,TEST_MODESbuild_script()functionbuild_pod_definition()functionerrexitafter credential handling (set -x→set -xe)${arr[@]/pattern}array removal (leaves empty strings) with explicit per-versionTEST_MODESarraysUsage for developers — test from a fork without editing the CI script:
2. Add local PTP CI runner (
run-in-container.sh)Container-based wrapper to run PTP CI tests locally against an existing cluster:
ptp-ci-runnerimage (CentOS Stream 9 + Go 1.25.0 + oc + ginkgo)--mode,--test-repo,--test-branch,--ptp-repo, etc.ln -sf .../run-in-container.sh ~/bin/ptp-ci ptp-ci --mode oc ptp-ci --test-repo https://github.com/user/ptp-operator.git --test-branch my-fixTested on hv11 CI lab: TGM mode ran 13 specs (5 passed, 8 failed — known T-GM convergence issues).
3. Add Go 1.25.0 to telco-runner CI image
The ptp-operator
go.modnow requiresgo >= 1.25.0. Add it to the telco-runner image build alongside existing Go versions so CI tests compile withoutGOTOOLCHAINauto-download.Verification
bash -nsyntax check passesptp-ci --mode tgmran successfully on hv11 (13 specs compiled and executed)🤖 Generated with Claude Code
Summary by CodeRabbit
telco-runnercontainer workflow for local and remote Podman test execution, including ARM host support and artifact collection.bash -npasses for the refactored CI script. Full compatibility testing with unset variables remains incomplete.