🚀 V2.9.0 al2023

[vigneshb027]

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #

Special notes for your reviewer:

Checklist:

• squashed commits
• includes documentation
• adds unit tests
• adds or updates e2e tests

In general, fix this by declaring a permissions: block either at the workflow root (applies to all jobs) or inside the specific job, granting only the scopes required. For this workflow, the steps only need to read the repository contents, so contents: read is sufficient. Because the query suggestion mentions that as a minimal starting point and the job doesn’t push or modify repository resources, we should restrict the token accordingly.

The best minimal, non-functional-change fix is to add a workflow-level permissions: section directly below the name: line. This will apply to all jobs (currently only verify) and ensures GITHUB_TOKEN is limited to contents: read. No other permissions (like pull-requests: write) are required for the existing steps. Concretely, in .github/workflows/pr-verify.yml, insert:

permissions:
  contents: read

after line 1 (name: PR verify). No new imports or actions are required.

In general, this problem is fixed by ensuring that integer parsing and target types use compatible bit sizes, or by enforcing explicit bounds checks before converting to a smaller integer type. Instead of using strconv.Atoi (which returns an architecture‑dependent int) and then casting to int32, we should parse directly into a 32‑bit integer using strconv.ParseInt with bitSize=32, and then convert that result to int32. This guarantees that any out‑of‑range value will be rejected with an error from ParseInt rather than silently wrapped during the cast.

For this specific code in controlplane/rosa/controllers/rosacontrolplane_controller.go, the best minimal fix is within the buildAPIEndpoint function around lines 1131–1138:

• Replace port, err := strconv.Atoi(portStr) (which yields int) with port64, err := strconv.ParseInt(portStr, 10, 32) (which yields int64 whose value is already range‑checked to 32 bits).
• Handle the error as currently done.
• Convert the resulting int64 to int32 when assigning to APIEndpoint.Port by writing Port: int32(port64). This cast is now safe because ParseInt with bitSize 32 guarantees the parsed value fits within the int32 range.
• No import changes are needed because strconv is already imported.
• The function’s external behavior remains unchanged: valid port numbers still parse successfully, and invalid ones still cause an error return.