Repository navigation
Conversation
…kage registry proxy The enterprise-contract rule prefetch_dependencies.package_registry_proxy_enabled fails for api-server, cli, control-plane, web-console and fleet-dashboard. These pipelines already wire enable-package-registry-proxy=true, but the plain prefetch-dependencies task skips its only step when prefetch-input is empty, so the parameter is never recorded in the SLSA attestation that the rule reads. The components already on trusted-artifacts (agent-runtime, fullsend-sandbox) pass because the oci-ta task records params even with empty input. Set a non-empty prefetch-input per ecosystem (gomod for the Go components, pnpm for the UI builds) so the prefetch step runs and the parameter is attested. No hermetic flag and no Dockerfile changes. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the
 |
HyperShell environment updated to commit
|
| Fact | Value |
|---|---|
| Namespaces | Platform: hypershell-ci-pr-800 Keycloak: hypershell-ci-pr-800-keycloak |
| OpenShift console | https://console-openshift-console.apps.rosa.hysh-aws-01.c6uk.p3.openshiftapps.com |
| API | https://hypershell-api-hypershell-ci-pr-800.apps.rosa.hysh-aws-01.c6uk.p3.openshiftapps.com |
| Web console | https://hypershell-web-console-hypershell-ci-pr-800.apps.rosa.hysh-aws-01.c6uk.p3.openshiftapps.com |
| Keycloak admin console | https://keycloak-hypershell-ci-pr-800-keycloak.apps.rosa.hysh-aws-01.c6uk.p3.openshiftapps.com/admin/hypershell/console/ |
Log in through the web console with your GitHub account (you must be a member of the configured organization or on its allowlist) or with a seeded test-tier username and password. To test as developer or platform-admin, sign in as that user, or open the Keycloak admin console, sign in with GitHub, and impersonate that user.
CLI access
oc login --server=https://api.hysh-aws-01.c6uk.p3.openshiftapps.com:443 --web
Setting prefetch-input activates cachi2 build integration, which broke the cli, control-plane, web-console and fleet-dashboard builds (pnpm resolution 404s and gomod cache issues) even with hermetic disabled. Only api-server builds cleanly with gomod prefetch. Revert prefetch-input on the four that broke, restoring their working builds. They need the trusted-artifacts (oci-ta) pipeline instead, which clears the enterprise-contract rule with empty input and no cachi2 integration. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
Superseded by #801 |
Problem
The application-wide
enterprise-contractcheck fails with 5 violations ofprefetch_dependencies.package_registry_proxy_enabled, one each forapi-server,cli,control-plane,web-consoleandfleet-dashboard.Root cause
These pipelines already define
enable-package-registry-proxywithdefault: "true"and wire it into the prefetch task. The rule, however, reads the resolved value from
the image's SLSA attestation, and a task's params are only attested when the task
actually executes. The plain
prefetch-dependenciestask gates its single step onwhen input != ""; with an emptyprefetch-inputthe step is skipped, nothing isrecorded, and the rule sees no
enable-package-registry-proxy=true.The components already on trusted-artifacts (
agent-runtime,fullsend-sandbox)pass because the
-oci-tatask has askip-tastep that runs even on empty input,so the param is always attested.
Fix
Per Konflux support guidance, set a non-empty
prefetch-inputso the prefetch stepruns and the (already
true) parameter lands in the attestation. No hermetic flag,no Dockerfile changes.
{"type": "gomod", "path": "components/api-server"}{"type": "gomod", "path": "components/cli"}{"type": "gomod", "path": "components/control-plane"}{"type": "pnpm", "path": "."}{"type": "pnpm", "path": "."}Applied to all three pipeline variants (push, pull-request, merge-queue) for each
component. 15 files, 30 insertions.
Verification
The prefetch step must succeed or the build fails. This is exercised by the
pull-request and merge-queue pipelines before anything merges. Watch the
per-component
enterprise-contractchecks flip green.Lower-confidence rows to watch on the build:
control-planego.mod has in-reporeplacedirectives (=> ../api-server,=> ../cli); cachi2 supports these but confirm on the build.web-console/fleet-dashboardare pnpm workspace builds; pnpm prefetch is anestablished pattern but is the riskier case.
If any component's prefetch fails, the fallback for that one is migrating it to the
-oci-tatasks, which clear the rule with empty input and no cachi2 execution.The app-wide
enterprise-contractcheck only goes fully green once all five buildsuccessfully, since it validates the whole snapshot together.
Note:
api-serveroverlaps open PR #779 (which enables it via a full hermeticbuild). If #779 lands first, drop the api-server hunk here.
🤖 Generated with Claude Code