feat(microshift-release): cumulative CVE scanning, Jira enrichment, and post-release dual errata - #264
Open
agullon wants to merge 1 commit into
Open
Conversation
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: agullon The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (3)
🚧 Files skipped from review as they are similar to previous changes (3)
WalkthroughChangesThe MicroShift release plugin now scans cumulative z-stream advisories and discovers component CVEs through Jira. Reports include scan details and enrichment status. The plugin version is updated to 1.7.0. MicroShift release precheck
Estimated code review effort: 4 (Complex) | ~45 minutes Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 9 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (9 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@plugins/microshift-release/scripts/precheck_xyz.py`:
- Around line 136-145: Preserve advisory coverage through fetch, interpretation,
and reporting. In plugins/microshift-release/scripts/precheck_xyz.py lines
136-145, return the merged report together with successful, attempted, and
failed versions, and mark partial coverage unavailable for recommendations;
retain the all-failed behavior. At lines 90-96, store the post-cap selected
range as coverage metadata; persist it in result at lines 479-489, and update
the reason formatting at lines 564-576 and detailed report formatting at lines
733-747 to use the actual successful or selected coverage rather than
reconstructing the original range.
In `@plugins/microshift-release/skills/pre-check/SKILL.md`:
- Around line 190-225: Add a manual-tests section for Step 7b covering both a
matching MicroShift component-CVE search and an empty-result search. For the
matching case, document the expected component-tracker CVE entry in the
enrichment table and the “ASK ART TO CREATE ARTIFACTS” recommendation when
resolution is Done or status is Verified; for the empty case, document that no
CVE table or recommendation output is produced.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 9739096f-0225-4898-906d-d8021cd8e0fa
📒 Files selected for processing (4)
.claude-plugin/marketplace.jsonplugins/microshift-release/.claude-plugin/plugin.jsonplugins/microshift-release/scripts/precheck_xyz.pyplugins/microshift-release/skills/pre-check/SKILL.md
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@plugins/microshift-release/scripts/precheck_xyz.py`:
- Around line 281-286: Update the decision paths using cve_impact, commits, and
pending_cves so pending enrichment never returns SKIP, including when commits ==
0; return NEEDS REVIEW until all advisory CVEs are enriched. Ensure
interpret_cves() results that are must_release while retaining pending IDs
include the pending details in early and mixed-impact reasons via cve_suffix.
Add tests covering zero-commit pending enrichment and mixed-impact pending CVEs.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 17dbeb9b-5a15-49fa-828a-0afa5558f13d
📒 Files selected for processing (2)
plugins/microshift-release/scripts/precheck_xyz.pyplugins/microshift-release/skills/pre-check/SKILL.md
🚧 Files skipped from review as they are similar to previous changes (1)
- plugins/microshift-release/skills/pre-check/SKILL.md
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@plugins/microshift-release/scripts/lib/jira_client.py`:
- Around line 118-146: Skip the issue in the CVE-processing flow when no label
matches _CVE_LABEL_RE, before determining release_action or appending to
all_bugs. Preserve matching-label behavior and add positive and negative tests
covering CVE label detection plus the release_required, not_actionable, and
needs_review branches.
- Around line 90-94: Validate minor against the exact \A\d+\.\d+\Z pattern
before constructing the JQL in the Jira query-building function. Reject any
non-matching value before it reaches the versions clause, and add tests covering
valid minor values and invalid values, including quote or injected-JQL attempts.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 68d179c4-2db3-494f-a2aa-6e49a5f55f97
📒 Files selected for processing (2)
plugins/microshift-release/scripts/lib/jira_client.pyplugins/microshift-release/scripts/lib/ocpbugs.py
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@plugins/microshift-release/skills/pre-check/SKILL.md`:
- Line 31: Update the Jira discovery flow associated with JIRA_API_TOKEN and
JIRA_USERNAME so missing credentials produce a skipped empty result, while
invalid credentials or Jira request failures preserve an unavailable/error state
instead of being treated as an empty successful list. Ensure the caller reports
the distinction accurately, and update SKILL.md documentation and tests to cover
skipped versus failed discovery, including expected results and credential/API
failure modes.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 032c70f8-e476-43d9-be4f-05d91b9926c3
📒 Files selected for processing (1)
plugins/microshift-release/skills/pre-check/SKILL.md
coderabbitai
Bot
added
the
ready-for-human-review
agullon
added a commit
to agullon/edge-tooling
that referenced
this pull request
Aug 12, 2026
Auto-applied: - precheck_xyz.py:327: pending CVEs with zero commits now returns NEEDS REVIEW instead of SKIP - jira_client.py:128: skip Jira issues that have no CVE label Co-Authored-By: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> pre-commit.check-secrets: ENABLED
agullon
marked this pull request as draft
August 12, 2026 13:45
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
agullon
added a commit
to agullon/edge-tooling
that referenced
this pull request
Aug 13, 2026
Auto-applied: - precheck_xyz.py:327: pending CVEs with zero commits now returns NEEDS REVIEW instead of SKIP - jira_client.py:128: skip Jira issues that have no CVE label Co-Authored-By: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> pre-commit.check-secrets: ENABLED
agullon
force-pushed
the
feat-precheck-cumulative-cves
branch
2 times, most recently
from
August 13, 2026 11:45
559ecc6 to
38dd3bb
Compare
agullon
changed the title
Contributor
Author
|
/label tide/merge-method-squash |
openshift-ci
Bot
added
the
tide/merge-method-squash
agullon
marked this pull request as ready for review
August 13, 2026 11:51
openshift-ci
Bot
removed
the
do-not-merge/work-in-progress
agullon
force-pushed
the
feat-precheck-cumulative-cves
branch
3 times, most recently
from
August 14, 2026 10:05
c2d7766 to
c2f8425
Compare
…nd post-release dual errata Three major improvements to MicroShift release tooling: 1. Pre-check: cumulative advisory CVE scanning - Scans advisories for ALL skipped OCP versions (not just current) - Discovers MicroShift component CVEs via Jira REST API - Enriches OCPBUGS and advisory CVEs directly in the script - Filters already-shipped CVEs using prior advisory data - Combined recommendations table with emoji indicators - Removed --verbose flag — script always shows full analysis 2. Pre-check: Jira REST API client (lib/jira_client.py) - OCPBUGS enrichment (summary, status, labels, release action) - Advisory CVE enrichment (searches by version-scoped JQL) - Component CVE discovery (pscomponent label matching) - Shipped CVE deduplication via resolutiondate filter 3. Post-release: dual errata verification - Verifies both RPM and bootc image erratas separately - Bootc errata sourced from shipment MR (stage + prod) - Cross-validates errata images against advisory.yaml - RPM downloads check against public errata page - Section names include source URLs for clarity Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> pre-commit.check-secrets: ENABLED
agullon
force-pushed
the
feat-precheck-cumulative-cves
branch
from
August 14, 2026 10:14
c2f8425 to
f6faafc
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Three major improvements to MicroShift release tooling, making the precheck script self-contained and the post-release checks comprehensive.
1. Pre-check: cumulative advisory CVE scanning
MicroShift often skips many OCP z-stream versions. Previously, the precheck only checked the current version's advisory. Now it scans ALL skipped versions to catch CVEs from releases MicroShift didn't participate in.
last_released+1through current version (capped at 20)text ~ "microshift"+ pscomponent label filtering)--verboseflag — script always shows full analysis2. Pre-check: Jira REST API client (
lib/jira_client.py)New module that queries Jira Cloud directly, making the script self-contained:
resolutiondatefilter + advisory presence to exclude already-shipped fixes3. Post-release: dual errata verification
Post-release checks now verify both RPM and bootc image erratas separately:
Recomendation statuses
Example output
/microshift-release:pre-check this week(results on 14th August):Recommendations
OCPBUGS in detail
Test plan
🤖 Generated with Claude Code