Fix security vulnerabilities for rhoai-2.25.4 - #6727
Merged
openshift-merge-bot[bot] merged 2 commits intoMar 26, 2026
Merged
Conversation
- Upgrade fastify 4.x to 5.8.2 and all @fastify/* plugins (RHOAIENG-48641, RHOAIENG-48642) - Add koa ^3.1.2 override for transitive dependency fix (RHOAIENG-51151, RHOAIENG-51152) - axios already at 1.13.5, no changes needed (RHOAIENG-49365, RHOAIENG-49366) Refs: RHOAIENG-48641, RHOAIENG-48642, RHOAIENG-51151, RHOAIENG-51152, RHOAIENG-49365, RHOAIENG-49366
Contributor
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 Coding Plan
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment Tip You can customize the high-level summary generated by CodeRabbit.Configure the |
Upgrade Go from 1.25.5 to 1.25.6 in go.mod, go.work, and upstream Dockerfile to fix memory exhaustion in net/url query parameter parsing. Refs: RHOAIENG-48604
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## stable-2.x #6727 +/- ##
==============================================
- Coverage 68.05% 67.84% -0.22%
==============================================
Files 2230 2237 +7
Lines 50369 50828 +459
Branches 14086 14246 +160
==============================================
+ Hits 34280 34485 +205
- Misses 16089 16343 +254
... and 12 files with indirect coverage changes Continue to review full report in Codecov by Sentry.
🚀 New features to boost your workflow:
|
manaswinidas
approved these changes
Mar 26, 2026
manaswinidas
left a comment
manaswinidas
left a comment
Member
There was a problem hiding this comment.
/lgtm
/approve
Dashboard loads fine and no errors on the console and the version on the about page shows 2.25.3
Contributor
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: manaswinidas The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-merge-bot
Bot
merged commit Mar 26, 2026
452e6d2
into
opendatahub-io:stable-2.x
143 of 149 checks passed
manaswinidas
added a commit
to red-hat-data-services/odh-dashboard
that referenced
this pull request
Mar 26, 2026
Fix security vulnerabilities for rhoai-2.25.4 (opendatahub-io#6727)
Merged
5 tasks
openshift-merge-bot Bot
pushed a commit
that referenced
this pull request
Apr 24, 2026
…t crash and 415 errors (#7387) PR #6727 upgraded Fastify 4→5 and @fastify/websocket v8→v11, causing: 1. WebSocket crash — v11 removed SocketStream, breaking all WS connections 2. 415 on all PATCH operations — Fastify 5 rejects merge-patch+json This fully reverts all changes from PR #6727 except the golang upversion (go.mod, go.work, Dockerfile kept at 1.25.6). Fastify is reverted to 4.29.1 which still addresses CVE-2025-32442 (the highest-priority CVE). The koa override is also removed.
7 tasks
openshift-merge-bot Bot
pushed a commit
that referenced
this pull request
Jun 10, 2026
* Add Konflux build simulation validation Adds comprehensive build validation to catch failures before they reach production. This validation runs automatically on PRs and can be executed locally for fast feedback during development. Key validations: - Phase 0 (Hermetic Preflight): Validates package-lock.json for RHOAI hermetic builds, checks workspace dependencies vs Dockerfile COPY commands, validates FIPS compliance requirements - Phase 1 (Docker Build): Tests ODH and RHOAI build modes in parallel - Phase 2 (Runtime): Container health, API endpoints, WebSocket stability, detects crashloops from dependency regressions (Fastify v5, @fastify/websocket v11) - Phase 3 (Module Federation): Validates remoteEntry.js, checks for missing webpack chunks, tests load performance - Phase 4 (Operator Integration): Kind cluster deployment and health validation - Phase 5 (Manifest Validation): Kustomize build testing for all overlays Benefits: - Catches hermetic build issues before downstream RHOAI builds fail - Detects workspace dependency problems (missing COPY commands) - Validates FIPS compliance (prevents release blockers) - Prevents Module Federation failures (ChunkLoadError, slow loads) - Fast feedback (10-20 minutes on PR, <1 minute for hermetic checks) - Local testing with same validation as CI Files added: - .github/workflows/pr-build-validation.yml: GH Actions workflow (5 phases) - scripts/validate-build.sh: Local validation script - docs/KONFLUX_BUILD_SIMULATION.md: Comprehensive documentation Prevents known issues: RHOAIENG-59862, RHOAIENG-59861, PR #6727, PR #7387 Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * fix(konflux-sim): Fix jq query to skip root package in lockfile validation The jq query was incorrectly selecting all objects with dependencies/devDependencies, which included the root package entry. The root entry doesn't have a 'resolved' field (as it's not a dependency), causing the validation to fail. Now properly checks .packages and skips the root entry (key == ''). Fixes both the GitHub workflow and the local validation script. * fix(konflux-sim): Skip workspace packages in resolved URL check Workspace packages (backend, frontend, packages/*) are local packages in the monorepo and don't have 'resolved' URLs in package-lock.json. Updated the jq query to only check packages in node_modules/, which are the actual external dependencies that need resolved URLs for hermetic builds. Filter changed from: .packages | to_entries[] | select(.key != "") To: .packages | to_entries[] | select(.key | startswith("node_modules/")) * fix: Remove flawed hermetic test and disable broken manifest validation PHASE 0 FIX: Remove hermetic npm install test with --network=none - The test consistently crashes npm with "Exit handler never called!" - npm ci attempts network operations even with --ignore-scripts - When --network=none is set, npm crashes instead of gracefully failing - The lockfile validation (grep for git+/github:/file:, jq for resolved URLs) already catches what matters for hermetic builds - The Docker build phase will catch real hermetic issues PHASE 5 FIX: Disable manifest validation - Pre-existing issue in repository: manifests/overlays/dev/kustomization.yaml references ../common/crd but should be ../../common/crd - This is not an issue introduced by this PR - Disabled Phase 5 with if: false until kustomization paths are fixed - Removed from summary dependencies to not block other validations SUMMARY FIX: - Removed hermetic-preflight from summary dependencies - Removed Phase 5 checks from validation logic - Workflow now validates Phases 1-4 only All changes tested: - YAML syntax validated - jq query for node_modules packages working correctly - No more crashes from hermetic test - No more failures from broken kustomization paths * fix(konflux-sim): fix Module Federation validation for host frontend Fixed Phase 2-3 validation that was incorrectly checking for remoteEntry.js in the host frontend build output. Issue: - Workflow assumed host frontend always generates remoteEntry.js - Host only generates it if mfConfig.length > 0 (federated modules detected) - Host has empty exposes: {} (doesn't expose modules) Fix: - Check for app.bundle.js instead (always generated) - Made remoteEntry.js check optional - If remoteEntry.js exists, validate size and webpack chunks - If not, log info message This aligns with Module Federation architecture where: - Remote packages (gen-ai, model-registry) generate remoteEntry.js - Host application may or may not generate it * chore: remove local validate-build.sh script The PR workflow validation now works correctly, so the local validation script is no longer needed. * security: Comprehensive security hardening for PR build validation workflow Implemented complete security hardening based on CodeRabbit AI review to address supply chain security, privilege escalation, and error handling vulnerabilities. **Security Improvements:** 1. **Pin GitHub Actions by Commit SHA** (CWE-494, CWE-829) - actions/checkout@34e1148 # v4.2.2 - actions/setup-node@49933ea # v4.2.0 - actions/upload-artifact@ea165f8 # v4.6.0 - actions/download-artifact@d3f86a1 # v4.2.1 Prevents supply chain attacks via tag manipulation 2. **Least-Privilege Permissions Model** - Added explicit permissions blocks to all jobs - contents: read (minimum required for checkout) - actions: write (only for artifact upload/download jobs) - actions: read (only for artifact download jobs) Reduces blast radius if workflow is compromised 3. **Strict Shell Error Handling** - Added 'set -euo pipefail' to all bash scripts - -e: exit on any error - -u: error on undefined variable - -o pipefail: pipe failures propagate Prevents silent failures and undefined variable issues 4. **Checksum Verification for Downloaded Binaries** - websocat: SHA256 481c0f38dd9847bb6e8f1fb301c00d113ca4a5426de5d4e32a59ddc61a7a5e77 - Kind v0.20.0: SHA256 513a7213d6c71e5e9a1c260fb90e25a1d5d0c91d36b3e2bb7f3a96f89f9695a0 - Kustomize v5.3.0: Prepared for re-enablement with checksum verification Prevents execution of tampered or corrupted binaries 5. **Improved Skip Conditions** - Check both PR title AND labels for skip flag - Allows label-based workflow control More flexible workflow control 6. **Optional Tool Dependencies with Fallback** - jq commands wrapped in 'command -v jq' checks - Provides clear warning messages when tools unavailable - Prevents silent failures from missing dependencies More resilient to environment differences 7. **Proper Timeout Handling and Readiness Probes** - READY=false pattern for all wait loops - Explicit timeout failures with debugging output - Improved container startup validation - Fixed deployment wait to properly exit 1 on timeout Prevents infinite waits, detects failures early 8. **Proper Variable Quoting** - All bash variables quoted: "${VARIABLE}" - Prevents word splitting issues More robust bash scripts 9. **Improved Error Messages** - Contextual error messages with expected vs actual state - Debugging output on failures (logs, status, etc.) - Clear actionable messages for developers Better debugging experience 10. **Correct API Endpoint Testing** - Fixed merge-patch test to use /api/config instead of /api/test-endpoint - Tests real endpoints, not placeholders Validates actual API functionality **Jobs Updated:** - hermetic-preflight: Permissions, pinned actions, error handling, optional jq - docker-build-odh/rhoai: Permissions, pinned actions, error handling - runtime-validation-odh/rhoai: Permissions, pinned actions, readiness probes, API tests - operator-integration: Permissions, pinned actions, Kind checksum, timeouts - manifest-validation: Permissions, pinned actions, kustomize checksum (disabled but prepared) - summary: Permissions, error handling **Testing:** - All changes validated against working PR #7425 - Security patterns documented in tiger-team skill LEARNINGS.md - Will be applied to all future generated workflows Related: CodeRabbit AI security review of PR #7425 Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * fix: Correct websocat SHA256 checksum for v1.12.0 The previous checksum was incorrect, causing checksum verification to fail in CI. Updated with the actual SHA256 from the official release binary: websocat.x86_64-unknown-linux-musl v1.12.0 SHA256: e4da4f6c00402e893f3e3120c62e16b61a84aaa78f772b3e155f319f5210d2c6 Verified by downloading the official binary and running sha256sum. Fixes CI failure in Phase 2-3 Runtime validation. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * fix: Remove binary checksum verification causing CI failures Reverted checksum verification for downloaded binaries (websocat, Kind, kustomize) back to simpler approach that was working before security hardening changes. The checksum verification was failing in CI with incorrect/mismatched hashes. **Changes:** - websocat: Removed SHA256 verification, just download and use - Kind: Removed SHA256 verification, simplified to curl + chmod + mv - kustomize: Reverted to official install script **Kept Security Hardening:** - ✅ GitHub Actions pinned by commit SHA - ✅ Least-privilege permissions on all jobs - ✅ Strict shell error handling (set -euo pipefail) - ✅ Improved skip conditions (title + label) - ✅ Optional tool dependencies with fallbacks - ✅ Proper timeout handling and readiness probes - ✅ Variable quoting and error messages Checksum verification is good security practice but was blocking CI. The pinned GitHub Actions and other hardening still provide significant security improvements. Fixes Phase 4 Kind installation failure. * fix: Revert operator-integration to lenient approach Reverted operator-integration job manifest application and deployment wait steps to match the last known working version (commit 6359504). **Problem:** Security hardening made these steps too strict, causing failures when deploying to vanilla Kind cluster (missing OpenShift CRDs, namespace issues, etc.). **Changes:** - Removed 'set -euo pipefail' from Apply manifests step - Removed 'set -euo pipefail' from Wait for deployment step - Simplified deployment wait to use '|| true' (failures ignored) - Removed strict error handling and exit 1 on deployment timeout - Matches exact working version before security hardening **Kept Security Improvements:** - Install Kind step still has 'set -euo pipefail' - Create Kind cluster still has 'set -euo pipefail' - Load image to Kind still has 'set -euo pipefail' - Other jobs (hermetic-preflight, docker-build, runtime-validation) keep strict error handling The operator-integration step is exploratory - it tries to deploy manifests to Kind but doesn't require full deployment success since ODH manifests expect OpenShift-specific resources. * fix(operator-integration): Add mock secrets and container runtime validation - Create mock TLS secrets and CA configmaps to allow volume mounts - Patch deployment to use minimal resources (128Mi/50m CPU per container) - Scale to 1 replica to fit in Kind's ~2Gi memory constraint - Wait for pods to pull images and start containers - Validate that containers actually run (not just YAML validity) This approach simulates what Konflux actually does - running containers in a cluster environment. Tested locally with Kind cluster: - ✅ All 9 containers running successfully - ✅ All 9 images pulled and loaded - ✅ Volume mounts working with mock secrets Much stronger validation than just checking deployment creation. * fix: Remove 'master' branch from workflow trigger Repository only has 'main' branch, not 'master'. * fix: Improve concurrency control with fallback pattern Match pattern from test.yml: - Use `github.event.pull_request.number || github.ref` for group - Handles both PR runs and push events to branches - Ensures in-progress runs are cancelled when new commits pushed * fix(operator-integration): Revert to lenient manifest application ClusterRoleBinding validation errors are pre-existing issues in the repo manifests (missing namespace fields). These are not caused by our changes. Make manifest application lenient (|| true) so it continues even if some resources fail validation. The subsequent deployment patching step will still fail if the deployment doesn't exist, providing validation that the important resources were created. This matches the original lenient approach while still validating that pods can actually run. * Enhance PR build validation workflow and update documentation - Add mock kubeconfig for health check endpoints in container tests - Add TODO comments for hermetic build improvements (pinned base images) - Update paths filter to use positive paths instead of paths-ignore - Simplify KONFLUX_BUILD_SIMULATION.md documentation Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * Address PR review feedback for build validation workflow Workflow improvements: - Centralize skip condition in env.SKIP_VALIDATION to avoid duplication - Add TODO explaining why hermetic npm install is disabled - Add explicit checksum verification failure for websocat download - Make RHOAI branding validation clearly a placeholder (not false positive) - Capture and report manifest apply failures instead of silent || true - Add warning message for deployment patch failures - Remove Phase 5 (manifest validation) - not ready, paths need fixing - Fix summary job to accept "skipped" as valid result for skip marker Documentation improvements: - Remove all references to non-existent validate-build.sh script - Update Usage section to clarify workflow-only validation - Remove Local Testing time estimates and requirements - Simplify Maintenance section Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * Implement hermetic install test and RHOAI branding validation Phase 0 - Hermetic Install Test: - Replace TODO with actual implementation using unshare --net - Tests npm install with network disabled (simulates Konflux/Hermeto) - Provides detailed error output with last 30 lines of npm logs - Validates that all dependencies can be resolved from package-lock.json Phase 2-3 - RHOAI Branding Validation: - Replace placeholder with actual HTML content checks - Fetches served HTML from RHOAI container - Check 1: Verifies "Red Hat OpenShift AI" or "RHOAI" is present - Check 2: Ensures "Open Data Hub" (ODH branding) is NOT present - Check 3: Confirms Red Hat product references exist - Provides detailed failure output with HTML snippets Testing: - Validated YAML syntax with Python yaml parser - Tested branding validation logic with mock HTML scenarios - Verified unshare command syntax (will run in GitHub Actions Ubuntu) Addresses review comments: - lucferbux: "The --network=none hermetic install is commented out — this is the core value proposition of Phase 0" - lucferbux: "RHOAI branding validation is still a no-op — unconditionally prints PASS" Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * Fix workflow syntax error - env context not available at job level GitHub Actions does not support the env context at the job level (only in steps). This caused workflow validation failures. Fix: - Remove env.SKIP_VALIDATION from workflow-level env - Add check-skip gate job that evaluates skip condition once - All other jobs depend on check-skip and use its output - Centralized skip logic: change in one place (check-skip job) - All jobs check: needs.check-skip.outputs.should-skip != 'true' This maintains centralized skip condition management while using GitHub Actions-compatible syntax. Fixes error: "Unrecognized named-value: 'env'. Located at position 1 within expression: env.SKIP_VALIDATION" Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * Fix hermetic install test - use Docker instead of unshare GitHub Actions runners don't allow unshare (requires CAP_SYS_ADMIN): unshare: unshare failed: Operation not permitted Solution: - Use Docker with --network=none instead of unshare --net - Docker network isolation doesn't require elevated privileges - Creates temporary Dockerfile that copies package files and runs npm install - Build with --network=none to simulate hermetic environment - Same validation: fails if package-lock.json has incomplete/dynamic resolution - Cleanup: removes test image and Dockerfile after test This provides the same hermetic validation while working within GitHub Actions security constraints. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * Fix hermetic install test - use npm ci --offline with pre-populated cache Previous attempts failed because npm crashes when network is disabled. New approach uses npm's offline mode properly: Two-stage Docker build: 1. cache-builder: Run npm ci to populate cache (with network) 2. hermetic-test: Run npm ci --offline using only the cache Key changes: - Use npm ci (deterministic, designed for CI) instead of npm install - Use --offline flag (strict cache-only) instead of --prefer-offline - Pre-populate cache in stage 1, test offline install in stage 2 - Remove --network=none (caused npm crashes) The --offline flag will error gracefully if: - package-lock.json is incomplete - Dependencies require network for resolution - Cache is missing required packages This properly validates hermetic installability without triggering npm bugs. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * Fix RHOAI branding validation by checking build artifacts The previous approach tried to run the container and curl localhost:8081, but this failed because the backend requires a working Kubernetes connection. The mock kubeconfig provided a context but caused the backend to try connecting to a non-existent K8s API. Root cause: RHOAI branding is determined at BUILD TIME through the BUILD_MODE environment variable in the Dockerfile, not at runtime. When BUILD_MODE=RHOAI, the Dockerfile sets ODH_PRODUCT_NAME and other env vars that webpack uses during 'npm run build' to embed branding in the static HTML. New approach: 1. Create temporary container from RHOAI image (without running it) 2. Extract built index.html using 'docker cp' 3. Check HTML content directly for RHOAI branding 4. Verify RHOAI logo/favicon files exist in build This validates that BUILD_MODE=RHOAI affects the build output correctly without needing to run the backend or mock Kubernetes. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * Simplify ODH validation to use artifact checking The ODH runtime validation was failing because all runtime tests (health endpoints, WebSocket, Module Federation performance) require a working Kubernetes connection. The mock kubeconfig provided a context but caused the backend to attempt connecting to a non-existent K8s API. Since this workflow validates Konflux build simulation (build artifacts), not runtime behavior, simplified the ODH validation to match the RHOAI approach: 1. Create temporary container (don't run it) 2. Extract index.html and dist directory using 'docker cp' 3. Validate ODH branding in HTML (default build should have "Open Data Hub") 4. Verify ODH logo/favicon files exist 5. Check Module Federation artifacts (app.bundle.js, remoteEntry.js, chunks) This validates that the default Docker build produces correct ODH artifacts without requiring Kubernetes connectivity. Runtime tests (if needed) should be added to a separate job with proper mocking. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * Fix app bundle filename check to match webpack output Webpack outputs app.[contenthash].js (e.g., app.15cfd673f96f07efec3b.js), not app.bundle.js. The validation was looking for the wrong filename. Changed check from: if [ ! -f "/tmp/odh-dist/app.bundle.js" ] To: if ! ls /tmp/odh-dist/app.*.js >/dev/null 2>&1 This matches the actual webpack output filename pattern with contenthash. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * Fix kind v0.20.0 checksum in Phase 4 The sha256sum check was failing because the checksum was incorrect. Verified actual checksum: curl -sL "https://kind.sigs.k8s.io/dl/v0.20.0/kind-linux-amd64" | sha256sum 513a7213d6d3332dd9ef27c24dab35e5ef10a04fa27274fe1c14d8a246493ded Updated from incorrect: 513a7213d6662b614ca7c7b8948b53f42dfc46a3cc7c44d9b166c71f7bca7f20 Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * Create mock OpenShift ConfigMaps for Kind in Phase 4 Pods were failing to start with FailedMount errors: configmap "openshift-service-ca.crt" not found configmap "kube-root-ca.crt" not found Dashboard pods expect OpenShift-specific ConfigMaps for volume mounts, but Kind is vanilla Kubernetes. Created empty mock ConfigMaps before deploying manifests to satisfy volume mount requirements. This allows pods to progress past volume mounting so images can be pulled and containers can start. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * Handle kube-root-ca.crt ConfigMap that may already exist The step was failing because Kubernetes auto-creates kube-root-ca.crt in namespaces on some versions. Changed from: kubectl create configmap kube-root-ca.crt ... -n opendatahub To: kubectl create configmap kube-root-ca.crt ... -n opendatahub 2>/dev/null || echo "(already exists, skipping)" This allows the step to succeed whether the ConfigMap already exists or not. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
Gkrumbach07
pushed a commit
to Gkrumbach07/odh-dashboard
that referenced
this pull request
Jul 7, 2026
* Add Konflux build simulation validation Adds comprehensive build validation to catch failures before they reach production. This validation runs automatically on PRs and can be executed locally for fast feedback during development. Key validations: - Phase 0 (Hermetic Preflight): Validates package-lock.json for RHOAI hermetic builds, checks workspace dependencies vs Dockerfile COPY commands, validates FIPS compliance requirements - Phase 1 (Docker Build): Tests ODH and RHOAI build modes in parallel - Phase 2 (Runtime): Container health, API endpoints, WebSocket stability, detects crashloops from dependency regressions (Fastify v5, @fastify/websocket v11) - Phase 3 (Module Federation): Validates remoteEntry.js, checks for missing webpack chunks, tests load performance - Phase 4 (Operator Integration): Kind cluster deployment and health validation - Phase 5 (Manifest Validation): Kustomize build testing for all overlays Benefits: - Catches hermetic build issues before downstream RHOAI builds fail - Detects workspace dependency problems (missing COPY commands) - Validates FIPS compliance (prevents release blockers) - Prevents Module Federation failures (ChunkLoadError, slow loads) - Fast feedback (10-20 minutes on PR, <1 minute for hermetic checks) - Local testing with same validation as CI Files added: - .github/workflows/pr-build-validation.yml: GH Actions workflow (5 phases) - scripts/validate-build.sh: Local validation script - docs/KONFLUX_BUILD_SIMULATION.md: Comprehensive documentation Prevents known issues: RHOAIENG-59862, RHOAIENG-59861, PR opendatahub-io#6727, PR opendatahub-io#7387 Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * fix(konflux-sim): Fix jq query to skip root package in lockfile validation The jq query was incorrectly selecting all objects with dependencies/devDependencies, which included the root package entry. The root entry doesn't have a 'resolved' field (as it's not a dependency), causing the validation to fail. Now properly checks .packages and skips the root entry (key == ''). Fixes both the GitHub workflow and the local validation script. * fix(konflux-sim): Skip workspace packages in resolved URL check Workspace packages (backend, frontend, packages/*) are local packages in the monorepo and don't have 'resolved' URLs in package-lock.json. Updated the jq query to only check packages in node_modules/, which are the actual external dependencies that need resolved URLs for hermetic builds. Filter changed from: .packages | to_entries[] | select(.key != "") To: .packages | to_entries[] | select(.key | startswith("node_modules/")) * fix: Remove flawed hermetic test and disable broken manifest validation PHASE 0 FIX: Remove hermetic npm install test with --network=none - The test consistently crashes npm with "Exit handler never called!" - npm ci attempts network operations even with --ignore-scripts - When --network=none is set, npm crashes instead of gracefully failing - The lockfile validation (grep for git+/github:/file:, jq for resolved URLs) already catches what matters for hermetic builds - The Docker build phase will catch real hermetic issues PHASE 5 FIX: Disable manifest validation - Pre-existing issue in repository: manifests/overlays/dev/kustomization.yaml references ../common/crd but should be ../../common/crd - This is not an issue introduced by this PR - Disabled Phase 5 with if: false until kustomization paths are fixed - Removed from summary dependencies to not block other validations SUMMARY FIX: - Removed hermetic-preflight from summary dependencies - Removed Phase 5 checks from validation logic - Workflow now validates Phases 1-4 only All changes tested: - YAML syntax validated - jq query for node_modules packages working correctly - No more crashes from hermetic test - No more failures from broken kustomization paths * fix(konflux-sim): fix Module Federation validation for host frontend Fixed Phase 2-3 validation that was incorrectly checking for remoteEntry.js in the host frontend build output. Issue: - Workflow assumed host frontend always generates remoteEntry.js - Host only generates it if mfConfig.length > 0 (federated modules detected) - Host has empty exposes: {} (doesn't expose modules) Fix: - Check for app.bundle.js instead (always generated) - Made remoteEntry.js check optional - If remoteEntry.js exists, validate size and webpack chunks - If not, log info message This aligns with Module Federation architecture where: - Remote packages (gen-ai, model-registry) generate remoteEntry.js - Host application may or may not generate it * chore: remove local validate-build.sh script The PR workflow validation now works correctly, so the local validation script is no longer needed. * security: Comprehensive security hardening for PR build validation workflow Implemented complete security hardening based on CodeRabbit AI review to address supply chain security, privilege escalation, and error handling vulnerabilities. **Security Improvements:** 1. **Pin GitHub Actions by Commit SHA** (CWE-494, CWE-829) - actions/checkout@34e1148 # v4.2.2 - actions/setup-node@49933ea # v4.2.0 - actions/upload-artifact@ea165f8 # v4.6.0 - actions/download-artifact@d3f86a1 # v4.2.1 Prevents supply chain attacks via tag manipulation 2. **Least-Privilege Permissions Model** - Added explicit permissions blocks to all jobs - contents: read (minimum required for checkout) - actions: write (only for artifact upload/download jobs) - actions: read (only for artifact download jobs) Reduces blast radius if workflow is compromised 3. **Strict Shell Error Handling** - Added 'set -euo pipefail' to all bash scripts - -e: exit on any error - -u: error on undefined variable - -o pipefail: pipe failures propagate Prevents silent failures and undefined variable issues 4. **Checksum Verification for Downloaded Binaries** - websocat: SHA256 481c0f38dd9847bb6e8f1fb301c00d113ca4a5426de5d4e32a59ddc61a7a5e77 - Kind v0.20.0: SHA256 513a7213d6c71e5e9a1c260fb90e25a1d5d0c91d36b3e2bb7f3a96f89f9695a0 - Kustomize v5.3.0: Prepared for re-enablement with checksum verification Prevents execution of tampered or corrupted binaries 5. **Improved Skip Conditions** - Check both PR title AND labels for skip flag - Allows label-based workflow control More flexible workflow control 6. **Optional Tool Dependencies with Fallback** - jq commands wrapped in 'command -v jq' checks - Provides clear warning messages when tools unavailable - Prevents silent failures from missing dependencies More resilient to environment differences 7. **Proper Timeout Handling and Readiness Probes** - READY=false pattern for all wait loops - Explicit timeout failures with debugging output - Improved container startup validation - Fixed deployment wait to properly exit 1 on timeout Prevents infinite waits, detects failures early 8. **Proper Variable Quoting** - All bash variables quoted: "${VARIABLE}" - Prevents word splitting issues More robust bash scripts 9. **Improved Error Messages** - Contextual error messages with expected vs actual state - Debugging output on failures (logs, status, etc.) - Clear actionable messages for developers Better debugging experience 10. **Correct API Endpoint Testing** - Fixed merge-patch test to use /api/config instead of /api/test-endpoint - Tests real endpoints, not placeholders Validates actual API functionality **Jobs Updated:** - hermetic-preflight: Permissions, pinned actions, error handling, optional jq - docker-build-odh/rhoai: Permissions, pinned actions, error handling - runtime-validation-odh/rhoai: Permissions, pinned actions, readiness probes, API tests - operator-integration: Permissions, pinned actions, Kind checksum, timeouts - manifest-validation: Permissions, pinned actions, kustomize checksum (disabled but prepared) - summary: Permissions, error handling **Testing:** - All changes validated against working PR opendatahub-io#7425 - Security patterns documented in tiger-team skill LEARNINGS.md - Will be applied to all future generated workflows Related: CodeRabbit AI security review of PR opendatahub-io#7425 Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * fix: Correct websocat SHA256 checksum for v1.12.0 The previous checksum was incorrect, causing checksum verification to fail in CI. Updated with the actual SHA256 from the official release binary: websocat.x86_64-unknown-linux-musl v1.12.0 SHA256: e4da4f6c00402e893f3e3120c62e16b61a84aaa78f772b3e155f319f5210d2c6 Verified by downloading the official binary and running sha256sum. Fixes CI failure in Phase 2-3 Runtime validation. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * fix: Remove binary checksum verification causing CI failures Reverted checksum verification for downloaded binaries (websocat, Kind, kustomize) back to simpler approach that was working before security hardening changes. The checksum verification was failing in CI with incorrect/mismatched hashes. **Changes:** - websocat: Removed SHA256 verification, just download and use - Kind: Removed SHA256 verification, simplified to curl + chmod + mv - kustomize: Reverted to official install script **Kept Security Hardening:** - ✅ GitHub Actions pinned by commit SHA - ✅ Least-privilege permissions on all jobs - ✅ Strict shell error handling (set -euo pipefail) - ✅ Improved skip conditions (title + label) - ✅ Optional tool dependencies with fallbacks - ✅ Proper timeout handling and readiness probes - ✅ Variable quoting and error messages Checksum verification is good security practice but was blocking CI. The pinned GitHub Actions and other hardening still provide significant security improvements. Fixes Phase 4 Kind installation failure. * fix: Revert operator-integration to lenient approach Reverted operator-integration job manifest application and deployment wait steps to match the last known working version (commit 6359504). **Problem:** Security hardening made these steps too strict, causing failures when deploying to vanilla Kind cluster (missing OpenShift CRDs, namespace issues, etc.). **Changes:** - Removed 'set -euo pipefail' from Apply manifests step - Removed 'set -euo pipefail' from Wait for deployment step - Simplified deployment wait to use '|| true' (failures ignored) - Removed strict error handling and exit 1 on deployment timeout - Matches exact working version before security hardening **Kept Security Improvements:** - Install Kind step still has 'set -euo pipefail' - Create Kind cluster still has 'set -euo pipefail' - Load image to Kind still has 'set -euo pipefail' - Other jobs (hermetic-preflight, docker-build, runtime-validation) keep strict error handling The operator-integration step is exploratory - it tries to deploy manifests to Kind but doesn't require full deployment success since ODH manifests expect OpenShift-specific resources. * fix(operator-integration): Add mock secrets and container runtime validation - Create mock TLS secrets and CA configmaps to allow volume mounts - Patch deployment to use minimal resources (128Mi/50m CPU per container) - Scale to 1 replica to fit in Kind's ~2Gi memory constraint - Wait for pods to pull images and start containers - Validate that containers actually run (not just YAML validity) This approach simulates what Konflux actually does - running containers in a cluster environment. Tested locally with Kind cluster: - ✅ All 9 containers running successfully - ✅ All 9 images pulled and loaded - ✅ Volume mounts working with mock secrets Much stronger validation than just checking deployment creation. * fix: Remove 'master' branch from workflow trigger Repository only has 'main' branch, not 'master'. * fix: Improve concurrency control with fallback pattern Match pattern from test.yml: - Use `github.event.pull_request.number || github.ref` for group - Handles both PR runs and push events to branches - Ensures in-progress runs are cancelled when new commits pushed * fix(operator-integration): Revert to lenient manifest application ClusterRoleBinding validation errors are pre-existing issues in the repo manifests (missing namespace fields). These are not caused by our changes. Make manifest application lenient (|| true) so it continues even if some resources fail validation. The subsequent deployment patching step will still fail if the deployment doesn't exist, providing validation that the important resources were created. This matches the original lenient approach while still validating that pods can actually run. * Enhance PR build validation workflow and update documentation - Add mock kubeconfig for health check endpoints in container tests - Add TODO comments for hermetic build improvements (pinned base images) - Update paths filter to use positive paths instead of paths-ignore - Simplify KONFLUX_BUILD_SIMULATION.md documentation Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * Address PR review feedback for build validation workflow Workflow improvements: - Centralize skip condition in env.SKIP_VALIDATION to avoid duplication - Add TODO explaining why hermetic npm install is disabled - Add explicit checksum verification failure for websocat download - Make RHOAI branding validation clearly a placeholder (not false positive) - Capture and report manifest apply failures instead of silent || true - Add warning message for deployment patch failures - Remove Phase 5 (manifest validation) - not ready, paths need fixing - Fix summary job to accept "skipped" as valid result for skip marker Documentation improvements: - Remove all references to non-existent validate-build.sh script - Update Usage section to clarify workflow-only validation - Remove Local Testing time estimates and requirements - Simplify Maintenance section Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * Implement hermetic install test and RHOAI branding validation Phase 0 - Hermetic Install Test: - Replace TODO with actual implementation using unshare --net - Tests npm install with network disabled (simulates Konflux/Hermeto) - Provides detailed error output with last 30 lines of npm logs - Validates that all dependencies can be resolved from package-lock.json Phase 2-3 - RHOAI Branding Validation: - Replace placeholder with actual HTML content checks - Fetches served HTML from RHOAI container - Check 1: Verifies "Red Hat OpenShift AI" or "RHOAI" is present - Check 2: Ensures "Open Data Hub" (ODH branding) is NOT present - Check 3: Confirms Red Hat product references exist - Provides detailed failure output with HTML snippets Testing: - Validated YAML syntax with Python yaml parser - Tested branding validation logic with mock HTML scenarios - Verified unshare command syntax (will run in GitHub Actions Ubuntu) Addresses review comments: - lucferbux: "The --network=none hermetic install is commented out — this is the core value proposition of Phase 0" - lucferbux: "RHOAI branding validation is still a no-op — unconditionally prints PASS" Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * Fix workflow syntax error - env context not available at job level GitHub Actions does not support the env context at the job level (only in steps). This caused workflow validation failures. Fix: - Remove env.SKIP_VALIDATION from workflow-level env - Add check-skip gate job that evaluates skip condition once - All other jobs depend on check-skip and use its output - Centralized skip logic: change in one place (check-skip job) - All jobs check: needs.check-skip.outputs.should-skip != 'true' This maintains centralized skip condition management while using GitHub Actions-compatible syntax. Fixes error: "Unrecognized named-value: 'env'. Located at position 1 within expression: env.SKIP_VALIDATION" Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * Fix hermetic install test - use Docker instead of unshare GitHub Actions runners don't allow unshare (requires CAP_SYS_ADMIN): unshare: unshare failed: Operation not permitted Solution: - Use Docker with --network=none instead of unshare --net - Docker network isolation doesn't require elevated privileges - Creates temporary Dockerfile that copies package files and runs npm install - Build with --network=none to simulate hermetic environment - Same validation: fails if package-lock.json has incomplete/dynamic resolution - Cleanup: removes test image and Dockerfile after test This provides the same hermetic validation while working within GitHub Actions security constraints. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * Fix hermetic install test - use npm ci --offline with pre-populated cache Previous attempts failed because npm crashes when network is disabled. New approach uses npm's offline mode properly: Two-stage Docker build: 1. cache-builder: Run npm ci to populate cache (with network) 2. hermetic-test: Run npm ci --offline using only the cache Key changes: - Use npm ci (deterministic, designed for CI) instead of npm install - Use --offline flag (strict cache-only) instead of --prefer-offline - Pre-populate cache in stage 1, test offline install in stage 2 - Remove --network=none (caused npm crashes) The --offline flag will error gracefully if: - package-lock.json is incomplete - Dependencies require network for resolution - Cache is missing required packages This properly validates hermetic installability without triggering npm bugs. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * Fix RHOAI branding validation by checking build artifacts The previous approach tried to run the container and curl localhost:8081, but this failed because the backend requires a working Kubernetes connection. The mock kubeconfig provided a context but caused the backend to try connecting to a non-existent K8s API. Root cause: RHOAI branding is determined at BUILD TIME through the BUILD_MODE environment variable in the Dockerfile, not at runtime. When BUILD_MODE=RHOAI, the Dockerfile sets ODH_PRODUCT_NAME and other env vars that webpack uses during 'npm run build' to embed branding in the static HTML. New approach: 1. Create temporary container from RHOAI image (without running it) 2. Extract built index.html using 'docker cp' 3. Check HTML content directly for RHOAI branding 4. Verify RHOAI logo/favicon files exist in build This validates that BUILD_MODE=RHOAI affects the build output correctly without needing to run the backend or mock Kubernetes. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * Simplify ODH validation to use artifact checking The ODH runtime validation was failing because all runtime tests (health endpoints, WebSocket, Module Federation performance) require a working Kubernetes connection. The mock kubeconfig provided a context but caused the backend to attempt connecting to a non-existent K8s API. Since this workflow validates Konflux build simulation (build artifacts), not runtime behavior, simplified the ODH validation to match the RHOAI approach: 1. Create temporary container (don't run it) 2. Extract index.html and dist directory using 'docker cp' 3. Validate ODH branding in HTML (default build should have "Open Data Hub") 4. Verify ODH logo/favicon files exist 5. Check Module Federation artifacts (app.bundle.js, remoteEntry.js, chunks) This validates that the default Docker build produces correct ODH artifacts without requiring Kubernetes connectivity. Runtime tests (if needed) should be added to a separate job with proper mocking. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * Fix app bundle filename check to match webpack output Webpack outputs app.[contenthash].js (e.g., app.15cfd673f96f07efec3b.js), not app.bundle.js. The validation was looking for the wrong filename. Changed check from: if [ ! -f "/tmp/odh-dist/app.bundle.js" ] To: if ! ls /tmp/odh-dist/app.*.js >/dev/null 2>&1 This matches the actual webpack output filename pattern with contenthash. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * Fix kind v0.20.0 checksum in Phase 4 The sha256sum check was failing because the checksum was incorrect. Verified actual checksum: curl -sL "https://kind.sigs.k8s.io/dl/v0.20.0/kind-linux-amd64" | sha256sum 513a7213d6d3332dd9ef27c24dab35e5ef10a04fa27274fe1c14d8a246493ded Updated from incorrect: 513a7213d6662b614ca7c7b8948b53f42dfc46a3cc7c44d9b166c71f7bca7f20 Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * Create mock OpenShift ConfigMaps for Kind in Phase 4 Pods were failing to start with FailedMount errors: configmap "openshift-service-ca.crt" not found configmap "kube-root-ca.crt" not found Dashboard pods expect OpenShift-specific ConfigMaps for volume mounts, but Kind is vanilla Kubernetes. Created empty mock ConfigMaps before deploying manifests to satisfy volume mount requirements. This allows pods to progress past volume mounting so images can be pulled and containers can start. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> * Handle kube-root-ca.crt ConfigMap that may already exist The step was failing because Kubernetes auto-creates kube-root-ca.crt in namespaces on some versions. Changed from: kubectl create configmap kube-root-ca.crt ... -n opendatahub To: kubectl create configmap kube-root-ca.crt ... -n opendatahub 2>/dev/null || echo "(already exists, skipping)" This allows the step to succeed whether the ConfigMap already exists or not. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
7 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixed CVEs
Changes
backend/package.json— Upgraded fastify 4.x → 5.x and all@fastify/*pluginsbackend/src/server.ts— Changedlogger→loggerInstance(fastify v5 API change)package.json— Addedkoa: ^3.1.2overridepackage-lock.json— Updated lockfilepackages/model-registry/upstream/bff/go.mod—go 1.25.5→go 1.25.6packages/model-registry/upstream/bff/go.work—go 1.25.5→go 1.25.6packages/model-registry/upstream/Dockerfile—golang:1.25.5→golang:1.25.6Verification