镜像站点 · 本页由第三方 GitHub 只读镜像提供，非 GitHub 官方站点，不接受任何登录或凭据输入。前往 github.com
Skip to content

Various fixes to unblock presubmits & COPR nightlies #229

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ggiguash merged 5 commits into from
Jul 28, 2026
Merged

Various fixes to unblock presubmits & COPR nightlies #229

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
430b833
Use latest Go for building RPMs
pmtk Jul 24, 2026
9279be3
Disable new metrics packages
pmtk Jul 24, 2026
30c40be
Remove 5.0 deps repo workaround
pmtk Jul 24, 2026
ee8e0e5
Copy policy.json to align el10 containers-common and el9 crio
pmtk Jul 27, 2026
f335d4f
Pass GITHUB_TOKEN to curl
pmtk Jul 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/actions/quick-start-clean/action.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ runs:
IMAGE="${image_ref%%:*}"
TAG="${image_ref##*:}"
fi
sudo IMAGE="${IMAGE}" TAG="${TAG}" bash -xeuo pipefail < ./src/quickstart.sh
sudo IMAGE="${IMAGE}" TAG="${TAG}" GITHUB_TOKEN="${GITHUB_TOKEN:-}" bash -xeuo pipefail < ./src/quickstart.sh
Comment thread
pmtk marked this conversation as resolved.
Resolved

# Wait until the MicroShift service is ready and healthy
for _ in $(seq 100); do
Expand Down
13 changes: 13 additions & 0 deletions packaging/rpm.Containerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,19 @@ RUN dnf install -y \
gcc gettext golang jq make policycoreutils selinux-policy selinux-policy-devel systemd && \
dnf clean all

# Install the latest Go from upstream (EL9's Go is too old)
# hadolint ignore=DL4006
RUN GO_VER=$(curl -sL 'https://go.dev/VERSION?m=text' | head -1 | sed 's/^go//') && \
GO_ARCH=$([ "$(uname -m)" = "x86_64" ] && echo "amd64" || echo "arm64") && \
curl --fail --retry 3 --retry-delay 5 -L \
-o "/tmp/go${GO_VER}.linux-${GO_ARCH}.tar.gz" \
"https://go.dev/dl/go${GO_VER}.linux-${GO_ARCH}.tar.gz" && \
Comment thread
ggiguash marked this conversation as resolved.
Resolved
rm -rf /usr/local/go && \
tar -C /usr/local -xzf "/tmp/go${GO_VER}.linux-${GO_ARCH}.tar.gz" && \
rm -f "/tmp/go${GO_VER}.linux-${GO_ARCH}.tar.gz"
Comment thread
pmtk marked this conversation as resolved.
Resolved

ENV PATH="/usr/local/go/bin:${PATH}"

COPY --from=srpm /home/microshift/microshift/_output/rpmbuild/SRPMS/ /tmp/

ARG BUILDER_RPM_REPO_PATH=/home/microshift/microshift/_output/rpmbuild/
Expand Down
5 changes: 5 additions & 0 deletions src/image/modify-spec.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,9 @@
'cert-manager',
'observability',
'sriov',
'metrics-server',
'metrics-node-exporter',
'metrics-kube-state'
]

# Sections to remove for the subpackages
Expand All @@ -40,6 +43,8 @@
'05-high-performance-runtime.conf',
'microshift-baseline',
'microshift-tuned',
'kube-state-metrics',
'node-exporter'
]


Expand Down
12 changes: 11 additions & 1 deletion src/quickstart.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -200,9 +200,19 @@ check_podman_version
# For remote images with the 'latest' tag, update the tag to the latest released version
if [[ "${IMAGE}" != localhost/* ]] && [ "${TAG}" == "latest" ]; then
check_prerequisites curl jq
TAG="$(curl -fsSL --max-time 60 "https://github.com/proxy/api.github.com/repos/${OWNER}/${REPO}/releases/latest" | jq -r .tag_name)"
curl_args=(-fsSL --max-time 60)
# If the GITHUB_TOKEN is available use it to authN and avoid anonymous request limits
[ -n "${GITHUB_TOKEN:-}" ] && curl_args+=(-H "Authorization: token ${GITHUB_TOKEN}")
response=""
if ! response="$(curl "${curl_args[@]}" "https://github.com/proxy/api.github.com/repos/${OWNER}/${REPO}/releases/latest")"; then
Comment on lines +204 to +207

@coderabbitai coderabbitai Bot Jul 28, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== locate files =="
git ls-files | rg '(^|/)(quickstart\.sh|action\.ya?ml|.*check.*)$' || true

echo
echo "== quickstart relevant lines =="
if [ -f src/quickstart.sh ]; then
  nl -ba src/quickstart.sh | sed -n '180,225p'
fi

echo
echo "== quick-start action files =="
fd -a 'action\.ya?ml' .github actions src 2>/dev/null | sed 's#^\./##' | while read -r f; do
  if rg -n 'quickstart|GITHUB_TOKEN|xtrace|set -x|bash -x|pipefail' "$f" >/dev/null 2>&1; then
    echo "--- $f"
    nl -ba "$f" | sed -n '1,220p'
  fi
done

echo
echo "== search for quickstart invocation and env export =="
rg -n 'quickstart|GITHUB_TOKEN|set -x|bash -x|BUNDLER|GITHUB_TOKEN\|' .github src -S || true

echo
echo "== ShellCheck availability and lint (read-only) =="
if command -v shellcheck >/dev/null 2>&1; then
  shellcheck --version | head -5
  shellcheck src/quickstart.sh || true
else
  echo "shellcheck not available"
fi

Repository: microshift-io/microshift

Length of output: 851

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== quickstart relevant lines =="
awk 'NR>=180 && NR<=225 {printf "%7d  %s\n", NR, $0}' src/quickstart.sh

echo
echo "== quick-start action file =="
awk 'NR>=1 && NR<=220 {printf "%7d  %s\n", NR, $0}' .github/actions/quick-start-clean/action.yaml

echo
echo "== all action entries for quickstart/quick-start-clean/GITHUB_TOKEN/bash -x/set -x =="
awk '
  /quick-start-clean|quickstart|GITHUB_TOKEN|xtrace|set -x|bash -x|pipefail|RUN|env:/ {printf "%s:%s\n", FILENAME, $0}
' .github/actions src/quickstart.sh docs/quickstart.sh 2>/dev/null || true

echo
echo "== search quickstart call graph with grep =="
grep -RIn 'quickstart|quick-start-clean|GITHUB_TOKEN|set -x|bash -x|pipefail' .github src docs 2>/dev/null || true

Repository: microshift-io/microshift

Length of output: 5941

Keep GITHUB_TOKEN out of xtrace logs.

quick-start-clean runs this script with set -x and passes GITHUB_TOKEN into the child Bash invocation before the curl_args expansion that adds Authorization: token .... Disable tracing around this release lookup and remove it from the caller invocation rather than relying on masking.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/quickstart.sh` around lines 204 - 207, Update the release lookup around
the curl invocation in quickstart.sh to disable xtrace while GITHUB_TOKEN is
incorporated into curl_args and used, then restore the prior tracing state
afterward. Also remove GITHUB_TOKEN from the quick-start-clean caller’s child
Bash invocation so the token is not exposed through environment or command
tracing.

echo "ERROR: Failed to query GitHub API for the latest release"
echo "${response}"
exit 1
fi
TAG="$(echo "${response}" | jq -r .tag_name)"
if [ -z "${TAG}" ] || [ "${TAG}" == "null" ] ; then
echo "ERROR: Could not determine the latest release tag from GitHub"
echo "${response}"
exit 1
fi
fi
Expand Down
4 changes: 0 additions & 4 deletions src/rpm/create_repos.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,10 +68,6 @@ case $1 in
echo "ERROR: Could not determine the MicroShift version from the RPM repository at '${repo_path}'"
exit 1
fi
# TODO: Remove this workaround once 5.0 mirror repositories are available
if [ "${repo_version}" = "5.0" ]; then
repo_version="4.22"
fi
create_rhocp_repo "${repo_version}"
;;

Expand Down
6 changes: 6 additions & 0 deletions src/rpm/postinstall.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,12 @@ if [ "$(id -u)" -ne 0 ]; then
exit 1
fi

# CRI-O (built for el9) only checks /etc/containers/policy.json, but
# CentOS 10's containers-common-6.0 moved it to /usr/share/containers/.
if [ ! -f /etc/containers/policy.json ] && [ -f /usr/share/containers/policy.json ]; then
cp /usr/share/containers/policy.json /etc/containers/policy.json
fi

# Configure network and add some useful utilities
dnf install -y firewalld jq bash-completion
firewall-offline-cmd --zone=trusted --add-source=10.42.0.0/16
Expand Down
Loading