Collect clones and postpone triaging of y streams for CVEs #316

majamassarini · 2025-10-28T14:24:54Z

No description provided.

gemini-code-assist

Code Review

This pull request introduces a new agent, clones_analyzer_agent.py, to identify and link cloned Jira issues. It also modifies the triage_agent.py to incorporate the new agent into its workflow, postponing triage of Y-stream CVEs until the corresponding Z-stream errata have been shipped. Additionally, the common/models.py file is updated to include schemas for the new agent, and the mcp_server/jira_tools.py file is modified to handle CVE triage eligibility. The Makefile and compose.yaml files are updated to include the new agent.

mcp_server/jira_tools.py

agents/triage_agent.py

mcp_server/jira_tools.py

lbarcziova

this will be amazing, thanks Maja!

mcp_server/jira_tools.py

lbarcziova · 2025-10-29T07:40:41Z

mcp_server/jira_tools.py

        return CVEEligibilityResult(
            is_cve=True,
-            is_eligible_for_triage=False,
+            when_eligible_for_triage=WhenEligibility.NEVER,


eventually, the embargo can be lifted, so this could be also later? But I don't remember for sure if Jotnar even sees those

Searching for assignee = jotnar-project and "Embargo Status" = "True" gives no result. So probably we don't see them.

lbarcziova · 2025-10-29T07:45:50Z

mcp_server/jira_tools.py

+    # @TODO: is this ok??? Or should I check something else?
+    return current_status.lower() == "closed"


this looks enough for me, but @opohorel @TomasKorbar or @ljavorsk can confirm

mcp_server/jira_tools.py

lbarcziova · 2025-10-29T07:51:29Z

agents/clones_analyzer_agent.py

+logger = logging.getLogger(__name__)
+
+
+def get_instructions() -> str:


how reliable is this when running locally? I am wondering if this wouldn't be more straightforward to do via tools using Jira API? Or it's not really straightforward?

I would say it is reliable. I don't know if I can write a regexp for it. Because I don't know what to expect in the title. So probably this is safer. And in "this agent" there is still a missing step (one of the reason why this PR is still in draft) I should start suggesting if any clone is missing.

agents/triage_agent.py

siteshwar · 2025-11-11T10:06:46Z

agents/clones_analyzer_agent.py

+
+      To find other Jira issues which are clones of <JIRA_ISSUE> Jira issue, do the following:
+
+      1. Search for other Jira issues which have the same affected component as <JIRA_ISSUE> Jira issue in RHEL Jira project and extract their titles.


Shall we use get_jira_details() here to get component name, issue title etc. to make the process more deterministic?

It should be using it, since it is the passed tool for all the agent definitions. Or am I missing something?

majamassarini · 2025-11-18T10:34:16Z

/gemini review

gemini-code-assist

Code Review

This pull request introduces a new clones-analyzer-agent to identify cloned Jira issues and modifies the triage-agent to postpone the triage of Y-stream and maintenance-stream CVEs until their corresponding Z-stream clones are resolved. A new cron job is also added to periodically re-evaluate these postponed issues.

The changes are well-structured and address the goal of handling Y-stream CVEs more appropriately. However, I've found a critical logic error in how Z-stream issues are identified, which would prevent the postponement logic from working as intended. I've also identified several areas for code cleanup, including removing unused code and clarifying confusing logic. Please see my detailed comments for suggestions.

gemini-code-assist · 2025-11-18T10:36:22Z

mcp_server/jira_tools.py

+    if not re.match(r"^rhel-\d+\.\d+$", branch.lower()):
+        return True


There is a critical logic error here. The function check_z_stream_errata_shipped is intended to check the status of Z-stream issues, but the regex r"^rhel-\\d+\\.\\d+$" matches Y-streams (e.g., rhel-9.8), not Z-streams (e.g., rhel-9.8.z).

The current logic will check the status of Y-stream clones and incorrectly return True for Z-stream clones without checking their status. This defeats the purpose of postponing Y-stream triage.

The logic should be inverted to check for Z-streams. A simpler way to check for a Z-stream branch is to see if it ends with .z.

Suggested change

if not re.match(r"^rhel-\d+\.\d+$", branch.lower()):

return True

if not branch.lower().endswith('.z'):

return True

gemini-code-assist · 2025-11-18T10:36:23Z

agents/triage_agent.py

+                elif JiraLabels.POSTPONED.value in JiraLabels.all_labels():
+                    await tasks.set_jira_labels(
+                        jira_issue=state.jira_issue,
+                        labels_to_remove=[JiraLabels.POSTPONED.value],
+                        dry_run=dry_run
+                    )


The condition JiraLabels.POSTPONED.value in JiraLabels.all_labels() is always true, which makes this elif block confusing. It will execute for any resolution other than POSTPONED, attempting to remove the POSTPONED label. However, all jotnar_ labels are already removed at the beginning of the workflow (line 629). This block is redundant, causes unnecessary API calls, and should be removed.

gemini-code-assist · 2025-11-18T10:36:23Z

agents/clones_analyzer_agent.py

+def create_clones_analyzer_agent(mcp_tools: list[Tool], local_tool_options: dict[str, Any]) -> RequirementAgent:
+    return RequirementAgent(**get_agent_definition(mcp_tools))


The function create_clones_analyzer_agent is not used anywhere in the codebase. It also has an unused parameter local_tool_options. It should be removed to avoid dead code.

gemini-code-assist · 2025-11-18T10:36:23Z

agents/clones_analyzer_agent.py

+
+    setup_observability(os.environ["COLLECTOR_ENDPOINT"])
+
+    dry_run = os.getenv("DRY_RUN", "False").lower() == "true"


The dry_run variable is initialized but never used within the main function. It should be removed.

gemini-code-assist · 2025-11-18T10:36:23Z

mcp_server/jira_tools.py

+                params={"fields": "status, assignee"},
+                headers=headers,
+            ) as response:
+                response.raise_for_status()
+                current_issue = await response.json()
+                current_status = current_issue.get("fields", {}).get("status", {}).get("name", "")
+                current_assignee = current_issue.get("fields", {}).get("assignee", {}).get("name", "")


The current_assignee variable is fetched but never used. It should be removed, and the API call can be optimized to only fetch the status field.

Suggested change

params={"fields": "status, assignee"},

headers=headers,

) as response:

response.raise_for_status()

current_issue = await response.json()

current_status = current_issue.get("fields", {}).get("status", {}).get("name", "")

current_assignee = current_issue.get("fields", {}).get("assignee", {}).get("name", "")

params={"fields": "status"},

headers=headers,

) as response:

response.raise_for_status()

current_issue = await response.json()

current_status = current_issue.get("fields", {}).get("status", {}).get("name", "")

gemini-code-assist bot reviewed Oct 28, 2025

View reviewed changes

majamassarini force-pushed the triage_and_clones branch from cf62623 to 85b1f4a Compare October 28, 2025 14:27

majamassarini marked this pull request as draft October 28, 2025 14:28

lbarcziova reviewed Oct 29, 2025

View reviewed changes

siteshwar reviewed Nov 11, 2025

View reviewed changes

majamassarini added 2 commits November 17, 2025 14:19

Collect clones or related issues

be14a4b

Postpone processing of y-streams for CVEs

0e743de

majamassarini force-pushed the triage_and_clones branch from 85b1f4a to ecdd2d7 Compare November 17, 2025 13:20

majamassarini added 2 commits November 17, 2025 15:37

Process X.10z streams after other z-streams

c1536d3

Process postponed issue at midnight or upon request

13a369e

majamassarini force-pushed the triage_and_clones branch from ecdd2d7 to 13a369e Compare November 17, 2025 14:38

gemini-code-assist bot reviewed Nov 18, 2025

View reviewed changes

		# @TODO: is this ok??? Or should I check something else?
		return current_status.lower() == "closed"

		logger = logging.getLogger(__name__)


		def get_instructions() -> str:


		To find other Jira issues which are clones of <JIRA_ISSUE> Jira issue, do the following:

		1. Search for other Jira issues which have the same affected component as <JIRA_ISSUE> Jira issue in RHEL Jira project and extract their titles.

		if not re.match(r"^rhel-\d+\.\d+$", branch.lower()):
		return True

		def create_clones_analyzer_agent(mcp_tools: list[Tool], local_tool_options: dict[str, Any]) -> RequirementAgent:
		return RequirementAgent(**get_agent_definition(mcp_tools))


		setup_observability(os.environ["COLLECTOR_ENDPOINT"])

		dry_run = os.getenv("DRY_RUN", "False").lower() == "true"

Collect clones and postpone triaging of y streams for CVEs #316

Are you sure you want to change the base?

Collect clones and postpone triaging of y streams for CVEs #316

Uh oh!

Conversation

majamassarini commented Oct 28, 2025

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

lbarcziova left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

lbarcziova Oct 29, 2025

Choose a reason for hiding this comment

Uh oh!

majamassarini Nov 17, 2025

Choose a reason for hiding this comment

Uh oh!

lbarcziova Oct 29, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

lbarcziova Oct 29, 2025

Choose a reason for hiding this comment

Uh oh!

majamassarini Oct 30, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

siteshwar Nov 11, 2025

Choose a reason for hiding this comment

Uh oh!

majamassarini Nov 17, 2025

Choose a reason for hiding this comment

Uh oh!

majamassarini commented Nov 18, 2025

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Nov 18, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Nov 18, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Nov 18, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Nov 18, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Nov 18, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants