test: run ITS pipeline e2e checks on pull requests - #3574
dheerajodha wants to merge 1 commit into
Conversation
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: trueComment |
|
Risk Assessment: low (1/5) DetailsSingle small Tekton PipelineRun config file (54 lines) added under .tekton/. No protected paths, no security-sensitive content per the metadata script, no dependency changes, no GitHub Actions workflow changes. Author is a known human contributor. Tier 2 applies the all-files-new moderate baseline of 2. Weighted composite (Tier 1 62% x 1.125 + Tier 2 38% x 2) = 1.46, rounds to 1 (low). Note: this baseline score does not reflect the fork-code-execution risk raised as a high finding, which is qualitative and outside the Tier 1 signal set. |
ReviewFindingsHigh
Next steps:
|
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
| - name: url | ||
| value: https://github.com/conforma/e2e-tests.git | ||
| - name: revision | ||
| value: 715c96ced8341ce10f5ab5b800ddcdec8b3d9e79 |
There was a problem hiding this comment.
[high] supply-chain
Both spec.params[revision] (line 26) and spec.pipelineRef.params[revision] (line 50) pin to conforma/e2e-tests SHA 715c96ced8341ce10f5ab5b800ddcdec8b3d9e79, which is the HEAD of the still-open PR conforma/e2e-tests#12. That commit has not landed on the e2e-tests main branch, so the pipeline being executed here has not cleared its own repo review/merge gate. If #12 is squash-merged, the resulting merge commit will have a different SHA and both pins here will silently reference an orphaned commit. The inline comment on line 43 claims the revision is reviewed, but the reviewed gate for e2e-tests is merge to main.
Suggested fix: Block merge until conforma/e2e-tests#12 is merged to main, then update both revision values (line 26 and line 50) to the resulting upstream merge-commit SHA. Keep the PR in draft until the dependency lands.
| - name: its-pipeline-repo-url | ||
| value: '{{source_url}}' | ||
| - name: its-pipeline-revision | ||
| value: '{{revision}}' |
There was a problem hiding this comment.
[high] fork-controlled-code-with-secrets
Params its-pipeline-repo-url: {{source_url}} (line 36) and its-pipeline-revision: {{revision}} (line 38) cause the runner to fetch and execute an ITS pipeline definition drawn from the PR source repo/revision. The CEL trigger (lines 11-14) only gates on event == pull_request and target_branch == main; there is no author_association, org-membership, or /ok-to-test guard expressed in this file. A fork-authored PR that touches pipelines/enterprise-contract/** or this trigger file will therefore cause fork-controlled YAML to be interpreted by the runner in namespace rhtap-contract-tenant under service account konflux-integration-runner with konflux-test-infra (registry creds) and mapt-kind-secret (AWS creds) mounted. Protection today rests entirely on the out-of-band PaC approver gate.
Suggested fix: Pick one or more of: (a) restrict its-pipeline-repo-url/its-pipeline-revision to the trusted upstream (base repo/base ref); (b) tighten the CEL to require a trusted actor, e.g. body.pull_request.author_association in [MEMBER, OWNER, COLLABORATOR]; or (c) explicitly document and enforce the PaC approver gate (/ok-to-test required for fork PRs) on this Repository CR. Also consider removing AWS/registry secrets from this PR-triggered variant if they are not needed for the ITS pipeline lint/schema checks.
|
/retest |
This branch has not been deployed
1 participant
Changes to the enterprise-contract ITS pipeline currently have no dedicated pre-merge E2E run. Add a Pipelines-as-Code trigger for PRs targeting main that change the ITS pipeline or this trigger. It runs only the ITS suite and reports the result on the CLI PR.
The test runner and suite are pinned independently of the pipeline under test. The ITS definition is resolved from the PR source URL and exact commit SHA, including fork PRs. The pipeline retains its task bundle references; this check does not build a custom CLI image.
Depends on conforma/e2e-tests#12 (EC-1943). Keep this PR in draft until that change is merged. Both runner/test pins currently reference its commit
715c96ced8341ce10f5ab5b800ddcdec8b3d9e79; if it is squash-merged, replace both with the resulting upstream commit before testing/merging this PR.Validation: Tekton Pipeline and PipelineRun validation passed using the E2E repository's Tekton API types. Parameter propagation from the trigger through the runner to the ITS environment was checked. The ITS suite compiles and all three scenarios are selected in a dry run. A live run could not be performed because the configured cluster hostname does not resolve.
Rollout still required: demonstrate a passing run and a failing run with an intentionally broken task bundle reference. Confirm both results belong to the CLI PR head SHA. This PR creates the check; it does not change GitHub merge rules. Because the trigger is path-filtered, do not add it as an unconditional required check without arranging a reported result for unrelated PRs. Complete that merge-rule integration before closing EC-1943.