OSAC-1681: Add GitHub Actions e2e job - #371
Conversation
Add e2e-test.yml caller workflow that builds the PR's Ansible EE image, pushes to GHCR, and invokes the shared e2e workflow from osac-test-infra with component image override and AAP-specific projectGitBranch/URI overrides. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
@omer-vishlitzky: This pull request references OSAC-1681 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
WalkthroughAdds a GitHub Actions workflow that builds and publishes a pull-request-specific Ansible execution environment image, then passes it and pull-request metadata to a reusable end-to-end test workflow. ChangesPR E2E workflow
Estimated code review effort: 3 (Moderate) | ~15–30 minutes Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 10 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (10 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: omer-vishlitzky The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.github.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 8
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/e2e-test.yml:
- Around line 42-50: Add the repository’s existing SAST, dependency/SCA, and
container-image scanning checks between the “Build execution environment” step
and the “Push PR image” step in the workflow. Ensure the push is gated on all
scans completing successfully, reusing established pipeline checks and image
reference symbols such as steps.meta.outputs.image.
- Around line 49-50: Add a dedicated image-signing job after the PR image push
that signs the pushed image by digest using keyless cosign and requests only the
id-token: write permission. Update the E2E workflow’s image-consumption step to
verify that signature before running tests, preserving the existing image
reference and push flow.
- Line 19: Update all workflow action references in the e2e test workflow,
including actions/checkout and osac-test-infra/e2e-prepare, to immutable
40-character commit SHAs instead of tags or branches. Apply this consistently to
the action references at the indicated locations while preserving their existing
inputs and behavior.
- Around line 52-54: Update the e2e job invoking the reusable workflow to
explicitly set least-privilege permissions: apply workflow-wide permissions: {}
and grant only the required scope, such as packages: read when the private image
is pulled.
- Around line 18-19: Update the actions/checkout step named Checkout to set
persist-credentials to false, ensuring the repository token is not retained in
local Git configuration for subsequent PR-controlled steps.
- Around line 4-7: Update the workflow trigger configuration and component-image
reference: add concurrency for pull requests using a group keyed by the PR
number, canceling in-progress runs as appropriate, and replace the mutable
pr-<number> image tag with an immutable commit SHA or pushed digest reference.
Keep workflow_dispatch behavior intact.
- Around line 4-7: Update the workflow_dispatch configuration and the AAP
ref/repository URI references in this workflow so manual runs receive explicit
inputs or conditional fallback values when github.event.pull_request is
unavailable. Preserve the existing pull_request behavior and ensure both values
resolve correctly for either trigger.
- Around line 12-14: Update the workflow’s image publication flow to use a
trusted event or workflow path rather than pull_request_target, while retaining
packages: write for publishing access. Ensure fork-origin pull requests can
trigger the required trusted publication flow without granting them direct write
access.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 344e0722-696d-4fdb-8520-f3f37e5f4854
📒 Files selected for processing (1)
.github/workflows/e2e-test.yml
| on: | ||
| pull_request: | ||
| branches: [main] | ||
| workflow_dispatch: {} |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow files =="
git ls-files '.github/workflows/*' | sed -n '1,120p'
echo
echo "== e2e-test.yml =="
if [ -f .github/workflows/e2e-test.yml ]; then
nl -ba .github/workflows/e2e-test.yml | sed -n '1,140p'
else
echo "missing .github/workflows/e2e-test.yml"
fi
echo
echo "== component-image references in workflows =="
rg -n "component-image|GITHUB_SHA|github\.pull_request\.head\.sha|ghcr\.io|gh\.cr\.io|pull_request|workflow_dispatch|pull_request_target|concurrency" .github/workflows -S || true
echo
echo "== relevant reusable action refs in workflow =="
rg -n "uses:\s*[^#]+" .github/workflows/e2e-test.yml -S || true
echo
echo "== package metadata maybe =="
for f in package.json pyproject.toml composer.json pom.xml build.gradle settings.gradle; do
[ -f "$f" ] && { echo "--- $f"; sed -n '1,160p' "$f"; }
doneRepository: osac-project/osac-aap
Length of output: 1931
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
p=Path('.github/workflows/e2e-test.yml')
if not p.exists():
print('missing workflow')
raise SystemExit
txt=p.read_text()
for needle in ['component-image', 'GITHUB_SHA', 'pull_request.head.sha', 'concurrency', 'workflow_dispatch', 'pull_request_target']:
print(f'{needle}: {needle in txt}')
lines=txt.splitlines()
for i,l in enumerate(lines,1):
if 'component-image' in l or 'GITHUB_SHA' in l or 'pull_request.head.sha' in l or 'concurrency' in l:
print(f'{i}: {l}')
PYRepository: osac-project/osac-aap
Length of output: 1931
Serialize PR runs and make the image reference immutable.
PR runs reuse pr-<number>, and this workflow has no concurrency control. A newer run can overwrite the image while an older E2E job is still consuming it, causing tests to execute against the wrong snapshot. Add a per-PR concurrency group and include the commit SHA or pushed digest in component-image.
🧰 Tools
🪛 zizmor (1.28.0)
[warning] 4-7: insufficient job-level concurrency limits (concurrency-limits): workflow is missing concurrency setting
(concurrency-limits)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/e2e-test.yml around lines 4 - 7, Update the workflow
trigger configuration and component-image reference: add concurrency for pull
requests using a group keyed by the PR number, canceling in-progress runs as
appropriate, and replace the mutable pr-<number> image tag with an immutable
commit SHA or pushed digest reference. Keep workflow_dispatch behavior intact.
Source: Linters/SAST tools
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Repository files matching workflow:"
git ls-files '.github/workflows/**/*' || true
echo
if [ -f .github/workflows/e2e-test.yml ]; then
echo "Line count:"
wc -l .github/workflows/e2e-test.yml
echo
echo "Relevant contents:"
nl -ba .github/workflows/e2e-test.yml | sed -n '1,120p'
else
echo ".github/workflows/e2e-test.yml not found"
fiRepository: osac-project/osac-aap
Length of output: 1931
🌐 Web query:
GitHub Actions workflow_dispatch inputs required context pull_request github.event.pull_request
💡 Result:
The workflow_dispatch event in GitHub Actions does not natively provide pull request context [1][2]. When a workflow is triggered by workflow_dispatch, the github.event.pull_request context is typically empty or null because the workflow was manually initiated, not triggered by a pull request event [1][3]. Key considerations: 1. Context Availability: The inputs context is only available for workflows triggered by workflow_dispatch (or reusable workflows) [1][2]. Conversely, the github.event.pull_request context is only populated when a workflow is triggered by a pull_request event [3][4]. These two contexts do not inherently share information unless you manually pass pull request data as inputs during the manual trigger. 2. Trigger Behavior: If you include both on: workflow_dispatch and on: pull_request in your workflow file, the workflow will trigger whenever either event occurs [5]. This can lead to the workflow running automatically on pull requests when you might only intend for it to run manually [5]. 3. Workaround for Non-Default Branches: A common technical pattern involves adding a pull_request trigger to a workflow so it can be registered and tested on non-default branches, while using conditional logic (if: github.event_name == 'workflow_dispatch') within the jobs to ensure that expensive or sensitive steps only execute when manually triggered [6]. If you require pull request data inside a workflow_dispatch trigger, you must either trigger the workflow via the API with the necessary PR information passed as inputs, or rely on other methods to fetch the context dynamically during execution [7][6].
Citations:
- 1: https://docs.github.com/en/actions/reference/workflows-and-actions/contexts
- 2: https://github.com/github/docs/blob/main/content/actions/reference/workflows-and-actions/contexts.md
- 3: https://docs.github.com/en/actions/how-tos/write-workflows/choose-when-workflows-run/trigger-a-workflow
- 4: https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows
- 5: https://stackoverflow.com/questions/76363988/github-actions-workflow-dispatch-event-triggers-automatically-on-pull-request
- 6: https://blog.infra.kiwi/gha-when-i-define-a-workflow-with-workflow-dispatch-i-cannot-invoke-it-49e364f2ed4d
- 7: https://docs.github.com/en/actions/how-tos/manage-workflow-runs/manually-run-a-workflow?tool=webui
Provide AAP ref and URI inputs for manual runs.
workflow_dispatch does not populate github.event.pull_request, so manual runs will resolve the AAP ref and repository URI to empty unless the workflow supplies dispatch inputs or conditional defaults.
🧰 Tools
🪛 zizmor (1.28.0)
[warning] 4-7: insufficient job-level concurrency limits (concurrency-limits): workflow is missing concurrency setting
(concurrency-limits)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/e2e-test.yml around lines 4 - 7, Update the
workflow_dispatch configuration and the AAP ref/repository URI references in
this workflow so manual runs receive explicit inputs or conditional fallback
values when github.event.pull_request is unavailable. Preserve the existing
pull_request behavior and ensure both values resolve correctly for either
trigger.
| permissions: | ||
| contents: read | ||
| packages: write |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== files =="
git ls-files '.github/workflows/*' || true
echo "== e2e workflow excerpt =="
if [ -f .github/workflows/e2e-test.yml ]; then
nl -ba .github/workflows/e2e-test.yml | sed -n '1,140p'
fi
echo "== pull_request_target / checkout occurrences =="
rg -n "pull_request_target|pull_request|checkout|GITHUB_TOKEN|GITHUB_TOKEN|packages: write|podman push|docker push|cosign|sigstore" .github/workflows || trueRepository: osac-project/osac-aap
Length of output: 1931
🌐 Web query:
GitHub Actions pull_request fork GITHUB_TOKEN permissions downgrade read-only packages write
💡 Result:
When a GitHub Actions workflow is triggered by a pull request from a public fork, the GITHUB_TOKEN is automatically restricted to read-only permissions by the GitHub platform [1][2]. This security measure is enforced regardless of the permissions defined in your workflow file [1][2]. Key details regarding this behavior: 1. Automatic Restriction: GitHub intentionally enforces a read-only token for workflows triggered by fork pull requests to prevent unauthorized actions (such as pushing malicious code or publishing rogue packages) using the repository's secrets or identity [1][2]. 2. Scope of Restriction: This automatic read-only adjustment applies to all pull request-related events (such as pull_request and pull_request_review) that originate from forked repositories [3]. 3. pull_request_target Exception: The pull_request_target event is an exception to this rule because it executes the workflow context of the base repository's default branch, which is considered trusted [4][5]. Because it runs trusted code, it is capable of having write permissions [4]. However, this event should be used with caution, as it can inadvertently expose secrets to potentially malicious PR content if the workflow is not carefully designed [4][6]. 4. Repository Settings: While organizations and repositories have settings that allow administrators to "Send write tokens to workflows from pull requests," enabling this on public repositories for fork PRs is generally discouraged due to the security risks involved [5][3]. If your workflow requires write access (e.g., to publish packages), you should structure it to run on events other than pull requests from forks—such as the push event or a merge event—where the workflow runs in the context of the main repository and can maintain higher permissions [2]. For tasks that must occur during a PR review, consider alternative authentication methods like using GitHub App installation access tokens or personal access tokens stored as secrets, though these must be managed carefully to avoid security vulnerabilities [7][8].
Citations:
- 1: https://github.blog/changelog/2021-04-20-github-actions-control-permissions-for-github_token/
- 2: https://nectar.ibtisam-iq.com/delivery/github-actions/permissions/
- 3: Clarify Permissions Calculation for Workflow Jobs in Documentation github/docs#33566
- 4: https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target
- 5: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository
- 6: https://stackoverflow.com/questions/78444367/github-token-permission-in-workflow-changes-to-read-after-setting-it-to-write
- 7: https://docs.github.com/en/actions/tutorials/authenticate-with-github_token
- 8: https://docs.github.com/en/actions/concepts/security/github_token
Use a trusted publish path with writable package access.
packages: write is read-only from fork-origin pull_request events, so this workflow cannot push the image from forked PRs. Route publication to a trusted workflow/event flow instead of pull_request_target.
🧰 Tools
🪛 zizmor (1.28.0)
[warning] 14-14: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment
(undocumented-permissions)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/e2e-test.yml around lines 12 - 14, Update the workflow’s
image publication flow to use a trusted event or workflow path rather than
pull_request_target, while retaining packages: write for publishing access.
Ensure fork-origin pull requests can trigger the required trusted publication
flow without granting them direct write access.
Source: Path instructions
| - name: Checkout | ||
| uses: actions/checkout@v6 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow outline =="
git ls-files '.github/workflows/e2e-test.yml' || true
if [ -f .github/workflows/e2e-test.yml ]; then
wc -l .github/workflows/e2e-test.yml
cat -n .github/workflows/e2e-test.yml
fi
echo "== checkout usages in workflows =="
rg -n "actions/checkout|persist-credentials|permissions:" .github/workflows || true
echo "== git diff stat/name =="
git diff --stat || true
git diff -- .github/workflows/e2e-test.yml | sed -n '1,220p' || trueRepository: osac-project/osac-aap
Length of output: 1931
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== current pwd and repo presence =="
pwd
ls -la
echo "== workflow outline =="
git ls-files '.github/workflows/e2e-test.yml' || true
if [ -f .github/workflows/e2e-test.yml ]; then
wc -l .github/workflows/e2e-test.yml
cat -n .github/workflows/e2e-test.yml
fi
echo "== checkout usages in workflows =="
rg -n "actions/checkout|persist-credentials|permissions:" .github/workflows || true
echo "== git diff stat/name =="
git diff --stat || true
git diff -- .github/workflows/e2e-test.yml | sed -n '1,220p' || true
echo "== safe yaml parse if python available =="
python3 - <<'PY'
from pathlib import Path
p=Path(".github/workflows/e2e-test.yml")
print("exists", p.exists(), "size", p.stat().st_size if p.exists() else None)
PYRepository: osac-project/osac-aap
Length of output: 1931
Disable checkout credential persistence.
This workflow checkouts the PR head before running later steps; set persist-credentials: false on actions/checkout so the repository token is not left in the local Git config for PR-controlled tooling to access.
🧰 Tools
🪛 zizmor (1.28.0)
[warning] 18-19: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 19-19: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/e2e-test.yml around lines 18 - 19, Update the
actions/checkout step named Checkout to set persist-credentials to false,
ensuring the repository token is not retained in local Git configuration for
subsequent PR-controlled steps.
Source: Linters/SAST tools
| image: ${{ steps.meta.outputs.image }} | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v6 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow excerpt =="
cat -n .github/workflows/e2e-test.yml | sed -n '1,80p'
echo
echo "== action refs in workflows =="
rg -n 'uses:\s*[^#]+' .github/workflows || true
echo
echo "== git status / diff stat =="
git status --short
git diff --stat || trueRepository: osac-project/osac-aap
Length of output: 1931
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow file =="
cat -n .github/workflows/e2e-test.yml | sed -n '1,90p'
echo
echo "== action refs in workflows =="
rg -n 'uses:\s*[^#]+' .github/workflows || true
echo
echo "== resolve GitHub refs to dereferenced SHAs =="
python3 - <<'PY'
import json, sys, urllib.request, urllib.error
refs = [
("actions/checkout", "v6"),
("actions/cache", "v4"),
("actions/upload-artifact", "v4"),
("osac-test-infra/e2e-prepare", "main"),
]
for owner, tag in refs:
url = f"https://api.github.com/repos/{owner}/git/refs/tags/{tag}"
req = urllib.request.Request(url, headers={"User-Agent": "code-rabbit-verifier"})
try:
with urllib.request.urlopen(req, timeout=15) as r:
data = json.load(r)
except urllib.error.HTTPError as e:
print(f"{owner}@{tag}: HTTP {e.code}")
continue
obj = data.get("object") or {}
print(f"{owner}@{tag}: object={obj}")
PYRepository: osac-project/osac-aap
Length of output: 1931
Pin workflow actions to full commit SHAs.
Replace the mutable references with 40-character SHAs, including the GitHub actions refs and osac-test-infra/e2e-prepare@main, so the workflow cannot drift with tag/branch movement. Also applies to lines 28, 31, and 54.
🧰 Tools
🪛 zizmor (1.28.0)
[warning] 18-19: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 19-19: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/e2e-test.yml at line 19, Update all workflow action
references in the e2e test workflow, including actions/checkout and
osac-test-infra/e2e-prepare, to immutable 40-character commit SHAs instead of
tags or branches. Apply this consistently to the action references at the
indicated locations while preserving their existing inputs and behavior.
Sources: Path instructions, Linters/SAST tools
| - name: Build execution environment | ||
| run: | | ||
| uv tool run ansible-builder build -vvv \ | ||
| --container-runtime podman \ | ||
| --tag "${{ steps.meta.outputs.image }}" \ | ||
| -f "./execution-environment/execution-environment.yaml" | ||
|
|
||
| - name: Push PR image | ||
| run: podman push "${{ steps.meta.outputs.image }}" |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
Add SAST/SCA gates before publishing.
This workflow installs PR dependencies, builds an execution environment, and pushes it without any SAST or SCA step. Add or require the repository’s existing static-analysis, dependency, and image-scanning checks before the push.
As per path instructions: SAST/SCA steps in pipeline.
🧰 Tools
🪛 zizmor (1.28.0)
[info] 46-46: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[info] 50-50: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/e2e-test.yml around lines 42 - 50, Add the repository’s
existing SAST, dependency/SCA, and container-image scanning checks between the
“Build execution environment” step and the “Push PR image” step in the workflow.
Ensure the push is gated on all scans completing successfully, reusing
established pipeline checks and image reference symbols such as
steps.meta.outputs.image.
Source: Path instructions
| - name: Push PR image | ||
| run: podman push "${{ steps.meta.outputs.image }}" |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "## Locate workflow files"
git ls-files .github/workflows || true
echo
echo "## e2e-test.yml outline and relevant lines"
if [ -f .github/workflows/e2e-test.yml ]; then
wc -l .github/workflows/e2e-test.yml
nl -ba .github/workflows/e2e-test.yml | sed -n '1,140p'
fi
echo
echo "## Search for cosign/keyless/signing/id-token in workflows"
rg -n "cosign|sigstore|sign|id-token|prerequisites|verify|required-checks|push|e2e" .github/workflows || trueRepository: osac-project/osac-aap
Length of output: 1931
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "## Locate workflow files"
git ls-files .github/workflows || true
echo
echo "## e2e-test.yml relevant lines"
if [ -f .github/workflows/e2e-test.yml ]; then
wc -l .github/workflows/e2e-test.yml
nl -ba .github/workflows/e2e-test.yml | sed -n '1,140p'
fi
echo
echo "## Search for signing, token grants, and artifact/dependency verification"
rg -n "cosign|sigstore|sign|verify|id-token|permissions:|pull_request_target|needs:|uses: actions/checkout|podman push|dependencies|dependency|SCA|SAST|artifacts|att" .github/workflows || trueRepository: osac-project/osac-aap
Length of output: 1931
Sign the pushed image before E2E consumes it.
.github/workflows/e2e-test.yml pushes the PR image without a Sigstore/cosign signature. Add a signing job that signs by digest with keyless cosign, grant id-token: write only to that job, and have the E2E workflow verify the signature before using the image.
🧰 Tools
🪛 zizmor (1.28.0)
[info] 50-50: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/e2e-test.yml around lines 49 - 50, Add a dedicated
image-signing job after the PR image push that signs the pushed image by digest
using keyless cosign and requests only the id-token: write permission. Update
the E2E workflow’s image-consumption step to verify that signature before
running tests, preserving the existing image reference and push flow.
Source: Path instructions
| e2e: | ||
| needs: build-pr-image | ||
| uses: osac-project/osac-test-infra/.github/workflows/e2e.yml@main |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== candidate workflow files =="
git ls-files '.github/workflows/*' | sed -n '1,120p'
echo
echo "== target workflow relevant content =="
if [ -f .github/workflows/e2e-test.yml ]; then
nl -ba .github/workflows/e2e-test.yml | sed -n '1,130p'
else
echo ".github/workflows/e2e-test.yml not found"
fi
echo
echo "== reusable workflow references =="
rg -n "uses:|permissions:|GITHUB_TOKEN|github\\.token|e2e-test|e2e\\s*:" .github/workflows -S || true
echo
echo "== git diff stat/name-only for reference =="
git diff --stat HEAD~1..HEAD 2>/dev/null || git diff --stat 2>/dev/null || true
git diff -- '.github/workflows/e2e-test.yml' | sed -n '1,220p' || trueRepository: osac-project/osac-aap
Length of output: 1931
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== check gh availability =="
(type -p gh && gh --version | sed -n '1,4p') || echo "github-cli not available"
echo
echo "== inspect workflow ref sha availability using gh if available =="
if command -v gh >/dev/null 2>&1; then
# Attempt to inspect the reusable workflow ref if API access allows.
for ref in main; do
echo "--- ref $ref ---"
gh api repos/osac-project/osac-test-infra/.github/workflows/e2e.yml?ref=$ref 2>&1 | sed -n '1,60p' || echo "gh api failed"
gh api repos/osac-project/osac-test-infra/git/ref/heads/$ref 2>&1 | sed -n '1,80p' || echo "gh api head ref failed"
done
fiRepository: osac-project/osac-aap
Length of output: 1931
Declare least-privilege permissions for the reusable workflow.
The e2e reusable workflow invocation omits permissions, so it receives repository-default token permissions. Add workflow-wide permissions: {} and grant only the scopes the referenced workflow needs, such as packages: read if it pulls the private image.
🧰 Tools
🪛 zizmor (1.28.0)
[warning] 52-60: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block
(excessive-permissions)
[error] 54-54: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/e2e-test.yml around lines 52 - 54, Update the e2e job
invoking the reusable workflow to explicitly set least-privilege permissions:
apply workflow-wide permissions: {} and grant only the required scope, such as
packages: read when the private image is pulled.
Source: Path instructions
2 participants
Summary
e2e-test.ymlcaller workflow for PR-triggered E2E testing via GitHub Actionsubuntu-latest, pushes to GHCR withpr-<number>tage2e.ymlfromosac-test-infrawith:osac-aap)aap-git-branch(PR head SHA) andaap-git-uri(fork URL for fork PRs)workflow_dispatchfor manual executionDepends on: osac-project/osac-test-infra PR (OSAC-1678) for the
component-imageandaap-git-branchinputs one2e.ymlJira
Test plan
Summary by CodeRabbit