USHIFT-6920: feat: add crypto_scan auto-rebase for cbom generation - #7051
Conversation
openshift-ci-robot
added
the
jira/valid-reference
|
@fracappa: This pull request references USHIFT-6920 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughThe PR adds an optional rebase-job crypto scan that stages selected MicroShift sources, runs a containerized scanner, generates CBOM and SPDX 2.3 JSON artifacts, and commits changed outputs. ChangesCryptographic artifact workflow
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant RebaseJob
participant CryptoScan
participant Podman
participant CryptoScanner
participant JQ
participant Git
RebaseJob->>CryptoScan: Run when CRYPTO_SCAN=true
CryptoScan->>Podman: Pull scanner image
CryptoScan->>CryptoScanner: Scan staged source trees
CryptoScanner-->>CryptoScan: Write CBOM JSON
CryptoScan->>JQ: Convert CBOM to SPDX 2.3
JQ-->>CryptoScan: Write SPDX JSON
RebaseJob->>Git: Stage and commit changed artifacts
Suggested reviewers: Caution Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional.
❌ Failed checks (1 error)
✅ Passed checks (14 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/auto-rebase/crypto_scan.sh`:
- Line 38: In scripts/auto-rebase/crypto_scan.sh, replace the CBOM status
command substitution at lines 38-38 with separate echo and ls commands, then
apply the same change to the SPDX status output at lines 79-79: echo the
generated-file label first and run ls -lh on the corresponding output variable
separately so failures propagate.
- Line 25: Update the EXIT trap command in crypto_scan.sh to preserve quoting
around SCAN_DIR when the deferred cleanup runs, ensuring rm -rf handles paths
containing spaces safely.
- Around line 1-5: Update the script header to use the /usr/bin/bash shebang,
remove the shellcheck disable directive, and consolidate the separate errexit,
nounset, and pipefail settings into a single set -euo pipefail command.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: a283846f-6ebb-4d10-89eb-1fb49d0e47df
📒 Files selected for processing (2)
scripts/auto-rebase/crypto_scan.shscripts/auto-rebase/rebase_job_entrypoint.sh
711e3fe to
494416a
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (1)
scripts/auto-rebase/crypto_scan.sh (1)
42-42: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winAvoid swallowed errors in command substitutions.
Both lines use command substitutions that mask failures because
errexitis not inherited by default. Based on learnings, restructure to avoid the substitution so errors are caught.
scripts/auto-rebase/crypto_scan.sh#L42-L42: Replace withecho "CBOM generated:"followed byls -lh "${CBOM_OUTPUT}"on a new line.scripts/auto-rebase/crypto_scan.sh#L83-L83: Replace withecho "SPDX generated:"followed byls -lh "${SPDX_OUTPUT}"on a new line.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/auto-rebase/crypto_scan.sh` at line 42, In scripts/auto-rebase/crypto_scan.sh at lines 42-42 and 83-83, remove the ls command substitutions from the CBOM and SPDX status messages. In the CBOM generation flow, print “CBOM generated:” first, then run ls -lh against CBOM_OUTPUT on the next line; similarly, print “SPDX generated:” first, then run ls -lh against SPDX_OUTPUT on the next line so failures propagate.Source: Learnings
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/auto-rebase/crypto_scan.sh`:
- Line 12: Update the EXIT trap command to use single quotes around the trap
body and double-quote IMAGE_DIR, SCANNER_DIR, and SCAN_DIR within it, preventing
early expansion and safely handling paths containing spaces.
---
Duplicate comments:
In `@scripts/auto-rebase/crypto_scan.sh`:
- Line 42: In scripts/auto-rebase/crypto_scan.sh at lines 42-42 and 83-83,
remove the ls command substitutions from the CBOM and SPDX status messages. In
the CBOM generation flow, print “CBOM generated:” first, then run ls -lh against
CBOM_OUTPUT on the next line; similarly, print “SPDX generated:” first, then run
ls -lh against SPDX_OUTPUT on the next line so failures propagate.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 5676ec02-b50f-4b9c-b3e5-1c493893d6e2
📒 Files selected for processing (1)
scripts/auto-rebase/crypto_scan.sh
d4b1e1d to
494416a
Compare
| "${SCANNER_IMAGE}" \ | ||
| /workspace > "${CBOM_OUTPUT}" | ||
|
|
||
| echo "CBOM generated: $(ls -lh "${CBOM_OUTPUT}")" |
There was a problem hiding this comment.
need some err handling if the scan fails
There was a problem hiding this comment.
@eslutsky thanks!
I added it, just let me know if any other change is required
|
|
||
| SCANNER_IMAGE="images.paas.redhat.com/exd-sp-guild-security/rh-crypto-scanner-image:latest" | ||
| REPOROOT="$(readlink -f "$(dirname "${BASH_SOURCE[0]}")/../..")" | ||
| CBOM_OUTPUT="${REPOROOT}/cbom-microshift.json" |
There was a problem hiding this comment.
do we want to commit it to the root ?
There was a problem hiding this comment.
I spoke with @pacevedom and we agreed to push it on the root directory, but feel free to provide any suggestion if you believe there could be better places
5b39562 to
b35283f
Compare
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/auto-rebase/crypto_scan.sh`:
- Line 25: Update the EXIT trap in crypto_scan.sh to quote the SCAN_DIR
expansion when removing the directory, ensuring paths containing spaces are
handled safely.
- Line 2: Update the shell options declaration at the start of crypto_scan.sh to
enable errexit by using set -euo pipefail, preserving the existing nounset and
pipefail behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: e1125759-c7f9-4cf4-af27-d44b3e1a0791
📒 Files selected for processing (2)
scripts/auto-rebase/crypto_scan.shscripts/auto-rebase/rebase_job_entrypoint.sh
🚧 Files skipped from review as they are similar to previous changes (1)
- scripts/auto-rebase/rebase_job_entrypoint.sh
76b6dbf to
4016fc6
Compare
|
/retest-required |
1 similar comment
|
/retest-required |
619a837 to
bf0bcf2
Compare
|
/test ci/prow/test-rebase |
|
/test pull-ci-openshift-microshift-main-test-rebase |
|
/pj-rehearse pull-ci-openshift-microshift-main-test-rebase |
df64b85 to
4524451
Compare
|
/pj-rehearse periodic-ci-openshift-microshift-release-5.0-rebase-on-nightlies |
|
/test test-rebase |
2 similar comments
|
/test test-rebase |
|
/test test-rebase |
|
/verified by @fracappa |
openshift-ci-robot
added
the
verified
|
@fracappa: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci-robot
removed
the
verified
30f01dc to
756b0c2
Compare
|
/test test-rebase |
3 similar comments
|
/test test-rebase |
|
/test test-rebase |
|
/test test-rebase |
openshift-ci
Bot
added
the
needs-rebase
5b52630 to
01ad592
Compare
added auto-rebase crypto_scan.sh script for cbom generation. This script uses crypto-scanner-iamge to generate a CycloneDX document. It also provides a SPDX one, by implementing the mapping suggested by the prod sec team.
01ad592 to
a309ac3
Compare
openshift-ci
Bot
removed
the
needs-rebase
|
@fracappa: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/verified by CI Running crypto scanner against MicroShift source...
Scanner image: images.paas.redhat.com/exd-sp-guild-security/rh-crypto-scanner-image:latest
Source directory: /go/src/github.com/openshift/microshift
Trying to pull images.paas.redhat.com/exd-sp-guild-security/rh-crypto-scanner-image:latest...
Getting image source signatures
Copying blob sha256:d46492c70c9ca8287b8061905cb78c62c5e27a7f499321c83c13682fb45a4c0f
Copying blob sha256:fa84e92aded1f99bf9799f6272da6aa325a0ec5833ce54b6067c83c51d373be1
Copying config sha256:4401301674c83235b7129d63ee42d212e804b2aef844ed6e117f3b643ef92bd8
Writing manifest to image destination
4401301674c83235b7129d63ee42d212e804b2aef844ed6e117f3b643ef92bd8
...
# Scan Summary
• Files with findings: 256
• Total crypto assets: 1072
• Output: <stdout>
CBOM generated:
-rw-r--r--. 1 user root 196K Aug 10 13:49 /go/src/github.com/openshift/microshift/cbom-microshift.json
SPDX generated:
-rw-r--r--. 1 user root 33K Aug 10 13:49 /go/src/github.com/openshift/microshift/sbom-microshift-crypto.spdx.json
Updating CBOM
[rebase-main-5.0.0-0.nightly-2026-08-10-064525_amd64-2026-08-10_arm64-2026-08-10 a58a24d11] update cbom
2 files changed, 5944 insertions(+)
create mode 100644 cbom-microshift.json
create mode 100644 sbom-microshift-crypto.spdx.json |
openshift-ci-robot
added
the
verified
|
@pacevedom: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: fracappa, pacevedom The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
4 participants
added auto-rebase crypto_scan.sh script for cbom generation. This script uses crypto-scanner-iamge to generate a CycloneDX document. It also provides a SPDX one, by implementing the mapping suggested by the prod sec team.
Summary by CodeRabbit