Repository navigation
Conversation
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the
 |
jsell-rh
added
the
agent/review-spec-approved
Spec review:
|
HyperShell environment destroyedThis ephemeral OpenShift environment has been destroyed. Comment |
Code reconciliation: Hermeto hermetic pilot (api-server + cli)Pushed What changed (6
|
| Component | Blocker to move into prefetch |
|---|---|
control-plane |
go install helm.sh/helm/v3/cmd/helm@v3.14.0 (x2) + multi-module replaces to ../cli, ../api-server |
web-console, fleet-dashboard |
pnpm workspace (single root pnpm-lock.yaml/pnpm-workspace.yaml); Hermeto pnpm handling, not npm/yarn |
agent-runtime, agent-runtime-slim |
bespoke components/agents/install-tools.py offline installer + pip + multi-stage native builds |
fullsend-sandbox |
ghcr.io/fullsend-ai base + curl https://go.dev/dl/... toolchain fetch; also no in-image go build |
- CICD-ECC-03 (trusted attestation) and CICD-ECC-04 (
+dirtybaked binary) both require reading the liveverifystep output / image build log (authoritative rule codes, the dirty binary's ingestion path), which cannot be produced locally. - CICD-ECC-06 (merge Mintmaker base-image bumps promptly) is an operational merge policy, not a code change.
Fan-out recipe once the pilot goes green in Konflux: apply the same three params per file, with one prefetch-input entry per from-source ecosystem pointing at that module's directory, after moving each ad-hoc fetch into prefetch. Full detail recorded in skills/RECONCILE.md.
🤖 Generated with Claude Code
jsell-rh
left a comment
jsell-rh
left a comment
There was a problem hiding this comment.
Verdict: agent/review-code-rejected.
The api-server hermetic pilot builds green. The cli hermetic pilot does not. After this change sets hermetic: "true" for cli, the cli Konflux build fails, and so do the cli and pr-group enterprise-contract checks. The cli migration is not complete. See the inline notes on the three cli pipeline files. Make the cli hermetic build pass, or drop the cli changes and keep api-server as the single validated pilot.
| value: Dockerfile | ||
| - name: path-context | ||
| value: components/cli | ||
| - name: hermetic |
There was a problem hiding this comment.
This flips the cli build to network isolation (hermetic). After this change, the check Red Hat Konflux / hypershell-cli-main-on-pull-request fails, and the cli enterprise-contract check fails with it. The api-server build uses the same three params and passes, so the cause is specific to the cli build, not the param syntax.
The commit message states the cli build is safe because build-release.sh is a pure cross-compile loop. The live build shows this claim is not correct for cli. Hold this param at "false" for cli until the cli hermetic build is confirmed green with ec validate, or move the failing ad-hoc fetch into prefetch. Keep only the component that passes in the pilot.
| value: Dockerfile | ||
| - name: path-context | ||
| value: components/cli | ||
| - name: hermetic |
There was a problem hiding this comment.
Same blocking problem on the push pipeline. If this merges, the cli image build on main will fail. The cli image will not refresh. Because enterprise-contract validates all component images together, a broken or stale cli image makes the application-wide check worse, not better. That is the opposite of the goal in issue #776. Do not flip hermetic here until the cli build is proven green.
| value: Dockerfile | ||
| - name: path-context | ||
| value: components/cli | ||
| - name: hermetic |
There was a problem hiding this comment.
Same blocking problem on the merge-queue pipeline. Keep this param aligned with the push and pull-request files. Flip all three together only after the cli hermetic build passes.
…ot (CICD-ECC-02) Code review of PR #779 rejected the cli hermetic change: flipping `hermetic: "true"` for cli turned `hypershell-cli-main-on-pull-request` red, while api-server with the identical three params stayed green - so the failure is cli-build-specific, not param syntax. The prior commit claimed cli was safe because `build-release.sh` is "a pure cross-compile loop"; the live Konflux build disproved that claim. Per issue #776 ("do one Go-only component end to end first, confirm it is green, then fan out") and the reviewer's guidance, revert the cli pipeline changes to hermetic off in all three `.tekton` files (push, pull-request, merge-queue), restoring the green cli build. api-server remains the single CI-validated Hermeto pilot (its on-pull-request build passes with hermetic on). This keeps the whole-application enterprise-contract goal moving forward instead of landing a broken cli image. Update skills/RECONCILE.md: correct the inaccurate "cli is safe" note and move cli into the deferred set alongside the other six components, each of which still needs a confirmed-green hermetic build (traced from the Konflux build log / `ec validate`) before its flag can flip. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Review feedback addressed (commit
|
markturansky
left a comment
markturansky
left a comment
There was a problem hiding this comment.
Root cause for why enable-package-registry-proxy alone does not pass the EC rule
Investigated this while working on #778. Posting the findings here since this PR
is the right owner of the EC fix.
The Conforma policy rule prefetch_dependencies.package_registry_proxy_enabled
calls tekton.task_param(task, "enable-package-registry-proxy") == "true". The
param IS correctly recorded in the SLSA v1 attestation's
resolvedDependencies[name="pipelineTask"] content as spec.params[].value = "true" (string). But the rule still fires. Here is why:
task.rego has two _slsa_task rules:
-
Line 43 (tasks WITH
status.results): mergesspec.paramsinto a
top-levelparamsfield via_slsav1_task_params().task_param()then
finds the param. -
Line 31 (tasks WITHOUT
status.results): returns the task object as-is.
No param extraction.task.params(top-level) does not exist.
task_params() (line 145) only checks task.params, never task.spec.params.
So for tasks without results, params are invisible to every downstream rule.
The standard prefetch-dependencies task succeeds but produces zero results
(status.results key is absent). Rule 2 fires, no param extraction, the deny
rule fires.
The -oci-ta variant prefetch-dependencies-oci-ta produces results. Rule 1
fires, params are extracted, check passes.
This confirms the hermetic/TA migration is the only viable path - setting the
proxy param on a standard (non-TA) pipeline has no effect because the EC rule
literally cannot read it. Not a workaround; the correct fix.
The remaining 7 components need the same triple (hermetic, proxy,
prefetch-input) to move to a results-producing TA prefetch task.
2fd9f5c to
0e68598
Compare
…ot (CICD-ECC-02) Code review of PR #779 rejected the cli hermetic change: flipping `hermetic: "true"` for cli turned `hypershell-cli-main-on-pull-request` red, while api-server with the identical three params stayed green - so the failure is cli-build-specific, not param syntax. The prior commit claimed cli was safe because `build-release.sh` is "a pure cross-compile loop"; the live Konflux build disproved that claim. Per issue #776 ("do one Go-only component end to end first, confirm it is green, then fan out") and the reviewer's guidance, revert the cli pipeline changes to hermetic off in all three `.tekton` files (push, pull-request, merge-queue), restoring the green cli build. api-server remains the single CI-validated Hermeto pilot (its on-pull-request build passes with hermetic on). This keeps the whole-application enterprise-contract goal moving forward instead of landing a broken cli image. Update skills/RECONCILE.md: correct the inaccurate "cli is safe" note and move cli into the deferred set alongside the other six components, each of which still needs a confirmed-green hermetic build (traced from the Konflux build log / `ec validate`) before its flag can flip. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Spec review verdict:
|
Codify the desired state for issue #776: every Konflux component image in the hypershell-main application passes the enterprise-contract (Conforma) check on main. Add specs/platform/konflux-enterprise-contract-conformance.spec.md (CICD-ECC) with six requirements: application-wide conformance invariant, Hermeto-prefetched hermetic builds with full SBOM attribution across every from-source ecosystem, valid trusted SLSA attestation without adding pipeline tasks, no non-reproducible (+dirty) baked binaries, single pipeline source of truth per component, and keeping base images current. Register CICD-ECC in specs/ids.md and add the spec to the registry in specs/index.spec.md. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…-02) Reconcile specs/platform/konflux-enterprise-contract-conformance.spec.md (CICD-ECC-02) for the two clean Go-only components, the issue-sanctioned Hermeto pilot (issue #776: "do one Go-only component end to end first, then fan out"). api-server and cli now set, in all three pipeline files each (push, pull-request, merge-queue), the params that route their from-source dependencies through Hermeto so the image SBOM carries full attribution: - hermetic: "true" - enable-package-registry-proxy: "true" - prefetch-input: {"type": "gomod", "path": "components/<component>"} These two components are safe to flip because their builds perform no ad-hoc network fetch beyond `go mod download` / `go build` (cli's build-release.sh is a pure cross-compile loop) and their modules declare no replace directives, so enabling hermetic is a complete migration, not a flag flip that would break the build. The remaining six components (control-plane, web-console, fleet-dashboard, agent-runtime, agent-runtime-slim, fullsend-sandbox) each need a genuine hermetic Dockerfile migration (helm `go install`, pnpm workspace, pip / install-tools.py, curl go.dev + ghcr base) whose correctness can only be confirmed against Konflux build logs / `ec validate`; they are deferred per the spec's staged-conformance model (CICD-ECC-01.03) and documented in skills/RECONCILE.md. CICD-ECC-05 is already satisfied: redundant Konflux PR #774 is closed and fullsend-sandbox keeps one .tekton source. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…ot (CICD-ECC-02) Code review of PR #779 rejected the cli hermetic change: flipping `hermetic: "true"` for cli turned `hypershell-cli-main-on-pull-request` red, while api-server with the identical three params stayed green - so the failure is cli-build-specific, not param syntax. The prior commit claimed cli was safe because `build-release.sh` is "a pure cross-compile loop"; the live Konflux build disproved that claim. Per issue #776 ("do one Go-only component end to end first, confirm it is green, then fan out") and the reviewer's guidance, revert the cli pipeline changes to hermetic off in all three `.tekton` files (push, pull-request, merge-queue), restoring the green cli build. api-server remains the single CI-validated Hermeto pilot (its on-pull-request build passes with hermetic on). This keeps the whole-application enterprise-contract goal moving forward instead of landing a broken cli image. Update skills/RECONCILE.md: correct the inaccurate "cli is safe" note and move cli into the deferred set alongside the other six components, each of which still needs a confirmed-green hermetic build (traced from the Konflux build log / `ec validate`) before its flag can flip. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Align the Konflux enterprise-contract conformance spec with the merged fullsend-sandbox change (PR #797) and the current state of main. fullsend-sandbox no longer builds a repository module from source. It is a self-contained image on a digest-pinned registry.access.redhat.com/ubi9 base that assembles its toolchain and the tirith binary from checksum-pinned downloads, so it has no Hermeto-resolvable from-source ecosystem. - Purpose: correct the fullsend-sandbox row (no from-source ecosystem) and describe its self-contained UBI9 build. - CICD-ECC-02: scope the hermetic requirement to components that build from a Hermeto-resolvable ecosystem; add the checksum-pinned path for fullsend-sandbox (verify every download by SHA-256, do not set hermetic:true until downloads are vendored); add scenario CICD-ECC-02.05. Record that a hermetic flag flips only after a confirmed-green build. - CICD-ECC-06: cover both registry.access.redhat.com/hi/* and registry.access.redhat.com/ubi9/* Red Hat base registries. - RECONCILE.md: update the deferred note (PR #774 closed, PR #797 merged, six remaining from-source components, fullsend-sandbox on the checksum path). scripts/check_spec_ids.py passes. No em dashes. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
0e68598 to
222bc9c
Compare
…c build (CICD-ECC-02/03) The plain prefetch-dependencies + hermetic buildah pipeline introduced exactly one enterprise-contract failure on the api-server image (measured: main snapshot 0 failures vs this PR's snapshot 1 failure, the only delta being api-server's hermetic image). The trusted-artifacts (-oci-ta) task set already used by agent-runtime and fullsend-sandbox passes enterprise-contract with hermetic on, so convert api-server's pull-request pipeline to it: git-clone-oci-ta -> prefetch-dependencies-oci-ta -> buildah-remote-oci-ta (native amd64+arm64) -> build-image-index, wiring SOURCE_ARTIFACT/PREFETCH_ARTIFACT instead of a shared PVC workspace. Keeps hermetic: true, enable-package-registry-proxy: true, and the gomod prefetch-input for components/api-server. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…acts (CICD-ECC-02/03) The earlier revision migrated only the api-server pull-request pipeline to Trusted Artifacts; the push and merge-queue pipelines kept the standard (non-TA) prefetch-dependencies task while carrying hermetic and enable-package-registry-proxy params. Per the review root-cause, the standard prefetch task produces no status.results, so Conforma cannot read enable-package-registry-proxy and the prefetch_dependencies deny rule fires. Because the shipped image is built by the push pipeline, leaving push non-TA would keep api-server non-conformant on main despite a green PR build. Convert the push and merge-queue pipelines to the identical multi-arch Trusted-Artifacts pipelineSpec as the green pull-request pipeline, so all three api-server files share one pipelineSpec (the convention already followed by the agent-runtime, agent-runtime-slim, and fullsend-sandbox trios). No task is added or removed, so no trusted_task.trusted violation; only task variants and Trusted-Artifact wiring change, and the shared PVC workspace is dropped. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
Addressed the code-review rejection in Root cause (from @markturansky's review): the standard non-TA Change: converted the Verified locally: all three 🤖 Generated with Claude Code |
… eight components Refine the Konflux enterprise-contract conformance spec so it codifies the full-scope desired state for every in-scope component, not only the Go-only pilot, and so each component's target attribution model matches its actual build inputs. - Correct the Purpose ecosystem table: the Node components build from a single shared pnpm workspace lockfile at the repository root; the agent runtimes build only `hsctl` (gomod, from components/cli) from source and assemble their Python and Node tool closures from SHA-256-locked downloads. - Split CICD-ECC-02 so that the package-registry proxy and per-ecosystem prefetch-input apply to every Hermeto-resolvable component, while hermetic: "true" applies only once a component has no remaining input Hermeto cannot prefetch. Note the proxy param is read only on a results-producing (Trusted Artifacts) prefetch task. - Resolve the shared pnpm workspace lockfile at the repository root for npm/pnpm prefetch instead of assuming a per-package lockfile. - Generalize the checksum-pinned attribution path to cover both fullsend-sandbox and the agent runtime tool closures, with the same do-not-flip-hermetic-until- vendored constraint. - Fix scenario CICD-ECC-02.02 (remove the inaccurate pip claim) and 02.03 (pnpm shared root lockfile), and add CICD-ECC-02.06 for the agent runtimes' mixed gomod-through-Hermeto plus tools-by-digest model. Keeps all existing requirement IDs stable (CICD-ECC-01..06). check_spec_ids.py and check_forbidden_terms.py pass. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Spec Review:
|
…enterprise-contract-conformance
Amber code review flagged that the CICD-ECC-02 parenthetical claimed every component except fullsend-sandbox has at least a gomod ecosystem. That is inaccurate: web-console builds from Node (pnpm) only and has no go.mod, as the Purpose table already shows. Reword the parenthetical to match the table: every component that builds Go from source has a gomod ecosystem, web-console is the Node-only pnpm exception, and fullsend-sandbox has no from-source ecosystem. Documentation accuracy only; the normative requirement body (which handles gomod and npm/pnpm separately) is unchanged. check_spec_ids.py and check_forbidden_terms.py pass. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…enterprise-contract-conformance
Code reconciliation follow-up (automated)Addressed the prior State verified
Change in this push
CI note: the only failing check was Moving issue #776 to 🤖 Generated with Claude Code |
jsell-rh
left a comment
jsell-rh
left a comment
There was a problem hiding this comment.
Agent code review: REJECTED. See the full review on issue #776. Two blocking findings: (1) Closes #776 closes the tracking issue too early, because 7 of 8 components and the attestation and dirty-binary items are still open; use Part of #776. (2) The inline comment below marks an undocumented single-architecture to multi-architecture change of the shipped api-server image.
| - name: kind | ||
| value: task | ||
| resolver: bundles | ||
| - name: build-container-arm64 |
There was a problem hiding this comment.
Blocking (traceability). This adds a second build architecture. On main the pipeline built one architecture (amd64) and build-image-index defaulted ALWAYS_BUILD_INDEX to false. This change builds build-container-amd64 and build-container-arm64 and sets ALWAYS_BUILD_INDEX: "true", so the shipped api-server image becomes a multi-architecture index. Conforma conformance does not require arm64; a single-architecture Trusted Artifacts build also satisfies enterprise-contract. The change mirrors the agent-runtime trio, so it is conventional, but no CICD-ECC requirement or PR text records the decision to start shipping arm64. Please confirm arm64 is intended and record it in the spec or PR body, or drop the arm64 task if it is only a side effect of copying the agent-runtime template.
Address the maintainer code-review rejection of PR #779 (issue #776). Finding 2 (blocking): the api-server Trusted-Artifacts conversion builds a native multi-architecture (linux/amd64 + linux/arm64) image index where main shipped amd64 only, with no recorded decision. This is intended, not a template side effect: components/api-server/Dockerfile already carries per-arch base images and a BUILDARCH/TARGETARCH toolchain split and documents "Bump amd64 and arm64 together", matching the agent-runtime trio's native multi-arch layout. Record the decision in CICD-ECC-02 (new paragraph plus Scenario CICD-ECC-02.07): Go components whose Dockerfile carries per-arch base images build the multi-arch index with ALWAYS_BUILD_INDEX "true"; components whose Dockerfile does not stay single-architecture until they add them. No pipeline mechanics change, so the green hypershell-api-server-main-on-pull-request build is preserved. Note the review follow-up in skills/RECONCILE.md. Finding 1 (Closes #776 would auto-close the tracking issue before the eight-component acceptance criteria are met) is fixed in the PR body (Closes -> Part of). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
… gomod (CICD-ECC-02) Convert the cli pull-request pipeline to the proven api-server Trusted Artifacts hermetic template (git-clone-oci-ta, prefetch-dependencies-oci-ta, buildah-remote-oci-ta, native multi-arch index) with hermetic: "true", enable-package-registry-proxy: "true", and a gomod prefetch-input pointing at components/cli. The earlier cli rejection flipped the three params on the standard (non-Trusted-Artifacts) pipeline; this converts the task variants to the results-producing form Conforma reads, matching the green api-server pilot. The cli pull-request build is the pre-merge verification signal. Attribute the agent-runtime and agent-runtime-slim gomod ecosystem (the hsctl build from components/cli) through Hermeto by setting enable-package-registry-proxy: "true" and a gomod prefetch-input on their pull-request pipelines. These keep hermetic: "false" per CICD-ECC-02.06 because their Python and Node tool closures are SHA-256-locked downloads that Hermeto cannot yet prefetch. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…ICD-ECC-02) The cli pull-request hermetic Trusted-Artifacts build is green, proving the recipe. Convert the push and merge-queue pipelines to the same multi-arch Trusted-Artifacts pipelineSpec so the shipped (push-built) cli image is hermetic and Conforma can read the package-registry-proxy param from the results-producing prefetch task. The push pipeline keeps its floating main tag (ADDITIONAL_TAGS on apply-tags); no task is added or removed, so no trusted_task.trusted violation (CICD-ECC-03). All three cli pipelineSpec bodies now mirror the green api-server and pull-request forms. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
… (PR #779) Record this session's verified Konflux results: cli converted to hermetic multi-arch Trusted Artifacts (green), agent-runtime and agent-runtime-slim gomod attributed through Hermeto (green), and the remaining control-plane, web-console, and fleet-dashboard conversions documented as blocked on a Go/pnpm build toolchain this autonomous environment lacks, with the concrete recipe for each. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Fan-out progress: cli converted and green, agent runtimes attributed; 3 components blocked on a build toolchainActing on the "ship full scope in a single PR" direction, I drove the live Converted and confirmed green on this PR
So verified coverage is now Blocked on a build toolchain this environment does not haveThese three need
Could you either run the remaining three conversions (or hand me an environment |
…ICD-ECC-02)
The prior change set enable-package-registry-proxy and the gomod
prefetch-input only on the agent-runtime and agent-runtime-slim
pull-request pipelines. The shipped images are built by the push
pipeline, so the agent-runtime and agent-runtime-slim images on main
carried no gomod attribution despite a green pull-request build, and the
change did not meet CICD-ECC-02's "all three pipeline files" rule it
introduced (Amber review finding, 2026-10-29).
Add hermetic: "false", enable-package-registry-proxy: "true", and the
gomod prefetch-input ({"type": "gomod", "path": "components/cli"}) to the
top-level spec.params of both push and both merge-queue pipelines. These
pipelines are already Trusted-Artifacts (prefetch-dependencies-oci-ta),
and their pipelineSpec already declares and wires the three params, so
only the top-level overrides were missing; the three pipelineSpec bodies
per component remain byte-identical. hermetic stays "false" per
CICD-ECC-02.06 because the Python/Node tool closures are SHA-256-locked
install-tools.py downloads Hermeto cannot yet prefetch.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
jsell-rh
added
agent/review-code-rejected
…ifacts (CICD-ECC-02) Convert all three control-plane pipeline files (push, pull-request, merge-queue) to the proven api-server hermetic Trusted-Artifacts template: native linux/amd64 + linux/arm64 builds via buildah-remote-oci-ta, git-clone and prefetch on the -oci-ta variants, hermetic: "true", enable-package-registry-proxy: "true", and a two-entry gomod prefetch-input. The one input that blocked a hermetic control-plane build was the Dockerfile's networked `go install helm.sh/helm/v3/cmd/helm@v3.14.0`. Track Helm as a Go `tool` dependency in a dedicated, isolated module (components/control-plane/tools/helm) so its full dependency tree is pinned in go.sum and prefetched by Hermeto. The Dockerfile now builds helm from that module with -mod=mod, so the build needs no live network. The module is kept separate from the control-plane module so Helm's older k8s.io pins do not perturb the control-plane dependency graph. The prefetch-input declares both gomod modules ([components/control-plane, components/control-plane/tools/helm]). Each Konflux build is native (BUILDARCH == TARGETARCH), so one helm build serves both the chart-packaging step and the runtime copy, removing the prior cross-compile dance. Two incidental base64 byte sequences in the new go.sum are whitelisted in .forbidden-terms-whitelist.json, matching the existing go.sum precedent. Part of #776 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Codecov Report✅ All modified and coverable lines are covered by tests. @@ Coverage Diff @@
## main #779 +/- ##
=======================================
Coverage 44.82% 44.82%
=======================================
Files 386 386
Lines 30412 30412
=======================================
+ Hits 13631 13633 +2
+ Misses 15053 15051 -2
Partials 1728 1728
Flags with carried forward coverage won't be shown. Click here to find out more. Continue to review full report in Codecov by Sentry.
🚀 New features to boost your workflow:
|
…facts (CICD-ECC-02)
Convert all three web-console pipeline files (push, pull-request, merge-queue)
to the proven multi-arch Trusted-Artifacts pipelineSpec (git-clone-oci-ta,
prefetch-dependencies-oci-ta, buildah-remote-oci-ta amd64+arm64,
build-image-index with ALWAYS_BUILD_INDEX "true"). Set
enable-package-registry-proxy: "true" and a pnpm prefetch-input
({"type": "npm", "path": "."}) that resolves the repository's shared root
pnpm workspace lockfile, so the image SBOM attributes the Node dependencies
through Hermeto.
hermetic stays "false" per CICD-ECC-02: scripts/bootstrap_pnpm.sh fetches the
pnpm release tarball over the network (SHA-256-verified, the checksum-pinned
path), so network isolation would break the bootstrap. Vendoring the pnpm
bootstrap for a fully hermetic build is the spec's deferred goal; the npm/pnpm
ecosystem is attributed through the proxy now, mirroring the agent-runtime
gomod pattern.
Part of #776
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
… Artifacts (CICD-ECC-02)
Convert all three fleet-dashboard pipeline files (push, pull-request,
merge-queue) to the proven multi-arch Trusted-Artifacts pipelineSpec. Set
enable-package-registry-proxy: "true" and a two-ecosystem prefetch-input
([{"type": "gomod", "path": "components/fleet-dashboard"}, {"type": "npm",
"path": "."}]): the gomod entry attributes the Go BFF dependencies and the npm
entry resolves the shared root pnpm workspace lockfile for the UI bundle, so the
image SBOM attributes both ecosystems through Hermeto.
hermetic stays "false" per CICD-ECC-02 because the UI build bootstraps pnpm via
scripts/bootstrap_pnpm.sh (SHA-256-verified network fetch); the gomod and
npm/pnpm ecosystems are attributed through the registry proxy, mirroring the
agent-runtime gomod pattern.
Part of #776
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…t-dashboard (CICD-ECC-02)
The repository's Node workspace uses a pnpm-lock.yaml (lockfileVersion 9.0), not
package-lock.json. Hermeto's "npm" prefetch type looks for package-lock.json and
fails with LockfileNotFound on a pnpm repo; the "pnpm" type reads the shared root
pnpm-lock.yaml and resolves all workspace sub-packages from it. Switch the
prefetch-input Node entry from {"type": "npm"} to {"type": "pnpm"} for both
components, matching CICD-ECC-02.03's "resolve the root workspace pnpm-lock.yaml
with pnpm handling."
Part of #776
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…s (CICD-ECC-02)
The first live build showed that enable-package-registry-proxy with
hermetic: "false" does not cleanly cover pnpm: `pnpm install` routed a scoped
package through the proxy and failed with ERR_PNPM_FETCH_404 / "No authorization
header was set". Switch both Node components to a full hermetic build, the
intended Hermeto pnpm flow, which resolves every dependency from the prefetched
offline store.
Changes:
- Add prefetch/pnpm (package.json + package-lock.json) pinning pnpm 11.15.1 as an
isolated, npm-managed bootstrap (not a pnpm workspace member).
- Dockerfiles install pnpm offline with `npm ci --prefix /opt/pnpm-bootstrap
--prefer-offline` from the Hermeto-prefetched npm cache instead of the networked
scripts/bootstrap_pnpm.sh (which CI still uses for non-hermetic jobs). The
command falls back to the registry outside Hermeto, so local builds still work.
- .tekton: hermetic: "true"; prefetch-input gains a {"type": "npm",
"path": "prefetch/pnpm"} entry alongside the {"type": "pnpm", "path": "."}
workspace entry (fleet-dashboard also keeps its gomod entry). With
--frozen-lockfile pnpm skips resolution, so the workspace's resolution-time
policies (minimumReleaseAge, trustPolicy, blockExoticSubdeps) do not re-run
offline; only tarball fetch + integrity apply, satisfied by the store.
- .dockerignore: include prefetch/ in the build context.
- check_dependency_age.py: exclude the prefetch/ bootstrap from the pnpm-workspace
membership and package-lock.json prohibition checks (it is intentionally an
isolated npm bootstrap, not a workspace package).
- .mergify.yml: map prefetch/** into the web-console and fleet-dashboard scopes
(same coupling as scripts/bootstrap_pnpm.sh).
Part of #776
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…s (CICD-ECC-02) The hermetic web-console and fleet-dashboard builds failed with ERR_PNPM_FETCH_404 (e.g. opentelemetry-semantic-conventions-1.43.0.tgz). Hermeto's pnpm handling rewrites pnpm-lock.yaml tarball URLs to relative filenames AND injects a root .npmrc whose `registry=file://.../deps/pnpm/npm/` redirects pnpm to the prefetched cache. The Dockerfiles copied the rewritten lockfile but not that .npmrc, and .dockerignore (deny-all + allowlist) stripped it from the build context, so pnpm resolved the relative names against registry.npmjs.org and 404'd. - .dockerignore: allowlist `.npmrc` so Hermeto's injected file survives. - Commit a benign (comment-only) root .npmrc so the COPY succeeds and local non-Hermeto builds keep using pnpm defaults; Hermeto preserves existing settings when it appends the registry line. - web-console: copy .npmrc into the build and prod (bundle) install stages. - fleet-dashboard: copy .npmrc into the ui-build install stage. - .mergify.yml: classify `.npmrc` as a barrier file (workspace-wide pnpm/npm config, like .dockerignore) so the scope policy (CICD-MRG-08) passes. PNPM_CONFIG_TRUST_LOCKFILE=true (required for pnpm >= 11.3, this repo pins 11.15.1) is supplied by Hermeto generate-env and applied by the buildah-remote-oci-ta task, as proven by the already-green hermetic gomod builds that source no env manually. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…nary (CICD-ECC-04)
The agent-runtime and agent-runtime-slim images baked the upstream fullsend
release archive (tools-*.json). That binary is stamped
`pkg:golang/github.com/fullsend-ai/fullsend@v0.49.0+dirty`: the upstream release
tree is modified at build time, so it is a non-reproducible binary (CICD-ECC-04)
and, as a downloaded golang package, is not Hermeto-attributed (it raises four
live `sbom_spdx.hermeto_attribution_required` warnings that become failures on
2027-01-15). Every inspected upstream release (v0.49.0, v0.52.0) is +dirty, so a
version bump is not a fix.
A clean `git` checkout of the public v0.49.0 tag builds a clean, reproducible
binary (verified: `vcs.modified=false`, no `+dirty`), and Hermeto prefetches its
gomod closure cleanly (verified locally with the konflux hermeto image: 668
dependencies fetched, nested `internal/mintcore` replace handled).
- Add fullsend as a submodule pinned to v0.49.0
(`components/agents/third_party/fullsend`), avoiding a 1839-file vendored copy
and keeping the dependency-audit policy gates meaningful.
- Add a Go `fullsend-builder` stage to both Containerfiles that builds
`./cmd/fullsend` with `-buildvcs=false` (deterministic, never `+dirty`) and
installs it to /usr/local/bin/fullsend.
- Remove the `fullsend` entry from `components/agents/locks/tools-{amd64,arm64}.json`.
- Add the fullsend gomod path to the `prefetch-input` of all six agent-runtime /
agent-runtime-slim pipeline files so Hermeto attributes its dependency closure.
- Teach `check_forbidden_terms.py` to skip submodule gitlinks and
`check_dependency_age.py` to exclude `third_party/` (foreign source trees).
- Classify `.gitmodules` as a Mergify barrier file; update the agents README.
Verification of the rebuilt image SBOM (clean version, Hermeto-attributed, no
`+dirty`) is pending the live Konflux build on this PR.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…l (PR #779) Replaces the stale "still blocked on a build toolchain this environment lacks" and deferred-component narrative, which was false in the rerun environment (Go, Node, pnpm, helm, podman/docker and live Konflux access are all present). Records the full-scope delivery across all eight components, the fullsend clean-source build (correcting the earlier +dirty "upstream blocker" inference), and the honest EC verification status (live builds pending; neutral/WARNING EC not counted as conformance). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
/test hypershell-web-console-main-on-pull-request |
…tic builds (CICD-ECC-02) The web-console and fleet-dashboard hermetic builds still fetched from registry.npmjs.org (EAI_AGAIN, network off) even with Hermeto's injected `.npmrc` registry=file://, because pnpm-workspace.yaml's `registries.default: https://registry.npmjs.org/` and `trustLockfile: false` take precedence over .npmrc. Verified against pnpm 11.15.1 with fresh stores: the YAML `registries.default` overrides the .npmrc registry, so pnpm resolves the Hermeto-rewritten relative tarball names against the public registry and fails offline. Fix, scoped to the hermetic build only: before `pnpm install`, when Hermeto has injected a `registry=file:` line into .npmrc (the hermetic-build marker), point pnpm-workspace.yaml's `registries.default` at that prefetched cache and set `trustLockfile: true`. Local (non-Hermeto) builds have no injected file:// registry, so this is a no-op and the committed public-registry default plus all supply-chain settings (minimumReleaseAge, trustPolicy, verifyStoreIntegrity, trustLockfile: false, ...) are preserved. Validated locally with the konflux hermeto 0.63.0 prefetch output and pnpm 11.15.1: `pnpm install --frozen-lockfile --offline` with a fresh store installs all 789 packages from the file:// cache and 0 from the network. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…ibution blocker (PR #779) Records the authoritative combined pr-group EC evidence (5fvxs, head 979f262): all 8 builds green, 0 EC failures, no +dirty, attestation trusted, #774 closed. Documents that the Go/Node components are effectively fully attributed (residual 2-4 warnings are Go stdlib + first-party main-module PURLs) and that the remaining agent-image warnings are the closed-source acli plus upstream fullsend-sandbox base-image tools - requiring a tenant-level Conforma policy exception (rhtap-releng-tenant/app-interface-standard) or upstream source, reported as a concrete external blocker rather than waived. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
jsell-rh
added
agent/reviewable-code
…enterprise-contract-conformance # Conflicts: # .mergify.yml
jsell-rh
added
agent/blocked
…meto attribution
Build gh (all three agent images) and gitleaks (fullsend-sandbox) from pinned
Go tool modules instead of downloading upstream release binaries, so their full
dependency closures are resolved and attributed through Hermeto (CICD-ECC-02)
rather than shipped as unattributed baked binaries. This closes the
source-available share of the residual `hermeto_attribution_required` warnings.
- Add tool modules components/agents/tools/{gh,gitleaks} (gh v2.100.0 -- the
newest release within the repo's go1.26.7 build toolchain; gitleaks v8.30.1),
mirroring the existing control-plane/tools/helm pattern.
- agent-runtime and agent-runtime-slim: add a gh-builder stage, copy the built
gh, drop gh from the SHA-256 tool locks, and add the gh tool module to each
pipeline's gomod prefetch-input.
- fullsend-sandbox: add a digest-pinned Go tool-builder stage that builds gh and
gitleaks, drop their curl downloads, and add both tool modules to the pipeline
prefetch-input (enable-package-registry-proxy already defaulted on).
- Record the narrow, repository-side acceptance of the residual attribution
warnings for source-unavailable binaries (closed-source acli) as Requirement
CICD-ECC-07; this is accepted risk, not a tenant-policy exception, and does not
cover source-available tools. Update the Purpose table and scenarios
CICD-ECC-02.05/02.06/02.08 accordingly.
- Whitelist an incidental forbidden-term byte sequence in the new gh go.sum hash.
Refs #776
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…enterprise-contract-conformance
… rebuilds (PR #779) Supersedes the prior tenant-exception blocker with the maintainer's narrow acceptance: checksum/upstream provenance for source-unavailable binaries (acli), while source-available tools (gh, gitleaks) are rebuilt from source through Hermeto (CICD-ECC-02.08 / CICD-ECC-07). Updates the agent-image bullets and replaces the external-blocker paragraph with the accepted-residual narrative. Refs #776 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
… cache Match the proven components/control-plane/tools/helm build pattern: building a remote tool package path (gh, gitleaks) from the prefetched module cache in a hermetic/prefetch build requires -mod=mod, otherwise the default readonly mode cannot resolve the tool module from cache. Applies to the gh-builder stages in agent-runtime and agent-runtime-slim and the go-tools-builder stage in fullsend-sandbox. Refs #776 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The agent runtime build context is the repository root. Konflux generates a source SBOM by inventorying the go.mod modules it finds in that source tree and merges it into the component image SBOM, so the image SBOM lists every in-repo go.mod under the build context, including components/agents/tools/gitleaks (built only into fullsend-sandbox). This is source inventory in the SBOM, not physical bundling of repository source in the shipped image: the final runtime stages copy only the assembled rootfs, the tool closure, and the built hsctl/fullsend/gh binaries. Without a matching prefetch-input entry the inventoried gitleaks module is unattributed, so adding the gitleaks tool module surfaced ~30 source-available attribution warnings on agent-runtime and agent-runtime-slim. gh avoids this because it is already prefetched there. Add the gitleaks gomod entry to both agent image pipelines so Hermeto attributes the inventoried module the same way, and document the source-inventory behavior in CICD-ECC-02.06. Verified against the runtime image SBOM: the gitleaks package carries sourceInfo /components/agents/tools/gitleaks/go.mod (a module inventory entry), and the runtime acli binary embeds no gitleaks dependency. Refs #776 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
/test hypershell-agent-runtime-main-on-pull-request |
Summary
Brings every Konflux component image to
enterprise-contract(Conforma)conformance for issue #776, in this single PR (full scope - no component deferred).
What this PR changes (all eight components)
specs/platform/konflux-enterprise-contract-conformance.spec.md(CICD-ECC,seven requirements); register in
specs/ids.md/specs/index.spec.md.api-server,cli,control-plane- full hermetic multi-archTrusted-Artifacts builds (gomod
prefetch-input, all three pipeline files each).control-plane's networkedgo install helmbecomes a tracked tool module(
components/control-plane/tools/helm) built from the Hermeto cache.web-console,fleet-dashboard- hermetic pnpm (+ gomod for fleet). Thenetworked pnpm bootstrap is prefetched; Hermeto's injected
.npmrcis propagatedinto every install stage; and, scoped to the hermetic build,
pnpm-workspace.yaml'sregistries.defaultis pointed at the prefetched cache withtrustLockfile: true.agent-runtime,agent-runtime-slim- gomod attributed (all three files each).fullsendis built from pinned clean source (submodulecomponents/agents/third_party/fullsend@ v0.49.0,-buildvcs=false), removing the+dirtyupstream release (CICD-ECC-04 + CICD-ECC-02).ghis built from sourcefrom a pinned tool module (
components/agents/tools/gh@ gh v2.100.0) and droppedfrom the SHA-256 tool locks, so its gomod closure is Hermeto-attributed.
fullsend-sandbox-ghandgitleaksare built from source from pinnedtool modules (
components/agents/tools/gh@ v2.100.0,components/agents/tools/gitleaks@ v8.30.1) in a digest-pinned Go tool-builderstage, replacing their release-binary downloads. Base-registry fix in fix(agents): build fullsend-sandbox on Red Hat UBI9, drop ghcr.io base #797 (merged);
Red Hat Konflux update hypershell-fullsend-sandbox-main #774 closed (CICD-ECC-05).
Source-available tool rebuilds (the decision's target)
Per the maintainer decision below, every source-available tool the agent images
ship is now built from source so its dependency closure is attributed through
Hermeto, instead of shipped as a prebuilt binary attributed only by checksum.
ghis pinned to v2.100.0, the newest release still within the repo's
go1.26.7buildtoolchain (v2.101.0+ require go 1.27); it is built once from a single shared tool
module into all three agent images.
gitleaksv8.30.1 is built from source intofullsend-sandbox.Because the agent runtime build context is the repository root, Konflux's source
SBOM inventories every in-repo
go.modunder that context and merges it into theimage SBOM (this is source inventory, not physical bundling of repo source - the
shipped runtime layers copy only the assembled rootfs, the tool closure, and the
built
hsctl/fullsend/ghbinaries). So thegitleakstool module is inventoriedin the agent-runtime SBOMs even though only
fullsend-sandboxbuilds it; both agentimage pipelines therefore also prefetch
components/agents/tools/gitleaksso Hermetoattributes the inventoried module (CICD-ECC-02.06).
Accepted residual: source-unavailable binaries only (CICD-ECC-07)
The closed-source Atlassian CLI (
acli,pkg:golang/atlassian.com/cli) has nopublished source to build from, so its embedded module metadata cannot be resolved
through Hermeto. It is attributed by SHA-256 digest and upstream provenance. The
residual
sbom_spdx.hermeto_attribution_requiredwarnings foracliare acceptedas a recorded repository risk (Requirement CICD-ECC-07). This acceptance is
narrow:
acli). It does notcover any source-available tool -
ghandgitleaksare built from source andattributed for exactly this reason.
tenant-policy exception. The tenant Conforma policy is not modified, the
warnings are not suppressed or excluded, and the missing attribution is not
represented as present.
hermeto_attribution_requiredis a non-enforcedWARNINGin Konflux today;the
enterprise-contractresult isWARNING, not a failure.Maintainer decision (superseding the prior tenant-exception requirement)
Verification (live Konflux)
At the pre-fix head
b4374de0, the combined pr-groupenterprise-contractreport(snapshot
tj975, all eight PR images) isWARNINGwith 3415 successes, 0failures, 2779 warnings (2632 attribution), 0
+dirty(down from 3557 total /3410 attribution at the prior
hwppg).ghclosure terms are 0 across allimages;
fullsend-sandboxgitleaks terms are 0. The only remainingsource-available-tool warnings were the
gitleakstool-module source inventoryon the two agent images, now attributed by the added prefetch entry at the current
head.
Remaining warnings after this PR are: the accepted
acliclosed-source closure(CICD-ECC-07); Go
stdliband first-party main-module metadata on the Go/Nodeimages; and pre-existing source-SBOM inventory entries for other repository modules
(e.g.
components/control-plane/tools/helm,components/api-server,tests/e2e)that the repo-root build context inventories but the agent images neither build nor
prefetch. Those last are informational, present before this PR, and not
source-unavailable; this PR does not expand scope to prefetch every repository module
into the agent images. Fresh combined-report evidence at the current head is attached
to issue #776.
Part of #776. A human performs the merge; this PR is not auto-merged.
🤖 Generated with Claude Code