Add skupper-source OCI image for downstream build contexts - #2560
Add skupper-source OCI image for downstream build contexts#2560AryanP123 wants to merge 3 commits into
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
💤 Files with no reviewable changes (1)
📝 WalkthroughWalkthroughThe change adds a scratch-based OCI image for the Skupper source tree, local Docker and Podman build and push targets, and release workflow publication to Quay. ChangesSource image publishing
Estimated code review effort: 2 (Simple) | ~10 minutes Merge Risk: 🔵 Low · up to The release workflow still passes the Quay password through Docker command-line arguments, which can expose credentials to process inspection or command logging. The change is otherwise mergeable, but this bounded security concern needs explicit owner awareness and follow-up. Sequence Diagram(s)sequenceDiagram
participant ReleaseWorkflow
participant MakeTargets
participant Quay
ReleaseWorkflow->>MakeTargets: Build source image with release tag
MakeTargets->>Quay: Authenticate and push tagged source image
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
| docker-push-source: docker-build-source | ||
| ${DOCKER} push "${REGISTRY}/${SOURCE_IMAGE}:${IMAGE_TAG}" | ||
|
|
||
| podman-build-source: | ||
| ${PODMAN} build $(SHARED_IMAGE_LABELS) -t "${REGISTRY}/${SOURCE_IMAGE}:${IMAGE_TAG}" -f Dockerfile.source . | ||
|
|
||
| podman-push-source: podman-build-source | ||
| ${PODMAN} push "${REGISTRY}/${SOURCE_IMAGE}:${IMAGE_TAG}" |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
rg --glob '!.git/**' -n -C 8 \
'docker-push-source|podman-push-source|make[[:space:]].*(docker|podman)-push' . || trueRepository: skupperproject/skupper
Length of output: 1292
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- relevant files ---'
git ls-files | rg '(^|/)(Makefile|\.github/workflows/|scripts/|release|ci)' || true
printf '%s\n' '--- push targets and release invocations ---'
rg --glob '!.git/**' -n -C 5 \
'(^|[[:space:]])(docker|podman)-push(-source)?([:space:]|$)|make[[:space:]]+[^#\n]*(push|release)|make[[:space:]]+-C[^#\n]*(push|release)' \
. || true
printf '%s\n' '--- Makefile target definitions ---'
rg -n '^[A-Za-z0-9_.-]+:.*(push|release)|^[A-Za-z0-9_.-]+:' MakefileRepository: skupperproject/skupper
Length of output: 5420
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- relevant files ---'
git ls-files | rg '(^|/)(Makefile|\.github/workflows/|scripts/|release|ci)' || true
printf '%s\n' '--- push targets and release invocations ---'
rg --glob '!.git/**' -n -C 5 \
'(^|[[:space:]])(docker|podman)-push(-source)?([[:space:]$])|make[[:space:]]+[^#\n]*(push|release)|make[[:space:]]+-C[^#\n]*(push|release)' \
. || true
printf '%s\n' '--- Makefile target definitions ---'
rg -n '^[A-Za-z0-9_.-]+:.*(push|release)|^[A-Za-z0-9_.-]+:' MakefileRepository: skupperproject/skupper
Length of output: 3837
🏁 Script executed:
#!/bin/bash
set -euo pipefail
cat -n Makefile | sed -n '1,105p'
printf '%s\n' '--- source image and containerfile declarations ---'
rg -n -C 3 'CONTAINERFILES|SOURCE_IMAGE|Dockerfile\.source|docker-push|podman-push' Makefile .github scripts tests Dockerfile* 2>/dev/null || trueRepository: skupperproject/skupper
Length of output: 9595
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
import re
text = Path("Makefile").read_text()
containerfiles = re.search(r"^CONTAINERFILES\s*:=\s*(.+)$", text, re.MULTILINE).group(1).split()
source_target = "podman-push-source"
aggregate_targets = [f"podman-push-{Path(name).name.removeprefix('Dockerfile.')}" for name in containerfiles]
print("CONTAINERFILES:", containerfiles)
print("podman-push prerequisites:", aggregate_targets)
print("source target included:", source_target in aggregate_targets)
print("source target definition:", bool(re.search(r"^podman-push-source:\s+podman-build-source$", text, re.MULTILINE)))
PYRepository: skupperproject/skupper
Length of output: 537
Invoke a source push target in the release job.
CONTAINERFILES excludes Dockerfile.source, so aggregate podman-push does not invoke podman-push-source. If release automation uses only that aggregate target, skupper-source is not published. Invoke podman-push-source or docker-push-source explicitly.
| - run: | ||
| name: Docker login | ||
| command: docker login quay.io -u ${QUAY_LOGIN} -p ${QUAY_PASSWORD} |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
sed -n '370,410p' .circleci/config.yml
printf '\nDocker login references:\n'
rg -n -C 3 'docker login|QUAY_(LOGIN|PASSWORD)|docker-push-source' .circleci/config.yml Makefile 2>/dev/null || true
printf '\nShell expansion probe:\n'
bash -c 'set -- docker login quay.io -u ${QUAY_LOGIN} -p ${QUAY_PASSWORD}; printf "%s\n" "$@"' \
2>/dev/null || trueRepository: skupperproject/skupper
Length of output: 4284
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' 'Argument expansion with whitespace:'
QUAY_LOGIN='build user' QUAY_PASSWORD='secret with spaces' bash -c '
set -- docker login quay.io -u ${QUAY_LOGIN} -p ${QUAY_PASSWORD}
printf "argc=%s\n" "$#"
i=1
for arg in "$@"; do printf "arg%s=%q\n" "$i" "$arg"; i=$((i+1)); done
'
printf '\nRelevant job context and all matching commands:\n'
sed -n '160,190p' .circleci/config.yml
sed -n '370,405p' .circleci/config.yml
sed -n '415,455p' .circleci/config.yml
sed -n '495,520p' .circleci/config.yml
printf '\nMatching line numbers:\n'
rg -n 'docker login|helm registry login|skopeo login' .circleci/config.ymlRepository: skupperproject/skupper
Length of output: 4903
Use --password-stdin for registry authentication.
Line 397 exposes ${QUAY_PASSWORD} as a command-line argument and splits secrets containing whitespace. Apply the same change to the other registry login commands in .circleci/config.yml.
|
@AryanP123 should we also include a vendor directory as part of the source image? |
4 participants
Fixes #2559
Summary by CodeRabbit