Only run default rules for running providers#866
Conversation
Signed-off-by: Emily McMullan <emcmulla@redhat.com>
📝 WalkthroughWalkthroughProvider-specific bundled ruleset directories are now resolved and propagated through analysis and local/container environments. Provider metadata gains a default subdirectory, resolution is validated and tested, and the Docker build and analysis fixture are updated. ChangesProvider-specific default rulesets
Container build setup
Analysis output fixture
Estimated code review effort: 3 (Moderate) | ~25 minutes Possibly related issues
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
eemcmullan
added
the
cherry-pick/release-0.10
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #866 +/- ##
==========================================
+ Coverage 56.31% 56.51% +0.20%
==========================================
Files 61 62 +1
Lines 5015 5041 +26
==========================================
+ Hits 2824 2849 +25
- Misses 1872 1873 +1
Partials 319 319 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
Dockerfile (1)
100-101: 🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick winClean the package manager cache to reduce image size.
To minimize the final image size, consider cleaning the package manager cache immediately after installing packages in the same
RUNstep.♻️ Proposed fix
RUN rpm -e --nodeps --justdb redhat-release && \ - microdnf -y install podman + microdnf -y install podman && \ + microdnf clean all🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@Dockerfile` around lines 100 - 101, Update the Dockerfile RUN step that installs podman with microdnf to clean the package manager cache immediately afterward in the same layer, preserving the existing redhat-release removal and installation commands.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Dockerfile`:
- Around line 93-98: Update the AlmaLinux repository configuration in the
Dockerfile so both repo entries use gpgcheck = 1 and include gpgkey =
https://repo.almalinux.org/almalinux/RPM-GPG-KEY-AlmaLinux-9. Preserve the
existing repository definitions and apply these settings consistently to both
entries.
---
Nitpick comments:
In `@Dockerfile`:
- Around line 100-101: Update the Dockerfile RUN step that installs podman with
microdnf to clean the package manager cache immediately afterward in the same
layer, preserving the existing redhat-release removal and installation commands.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 13896b9b-77f5-4d48-9985-ced41dd250a3
📒 Files selected for processing (11)
Dockerfilecmd/analyze/analyze.gocmd/analyze/run.gocmd/rules/test/runner.gopkg/provider/env_container.gopkg/provider/env_local.gopkg/provider/env_local_test.gopkg/provider/environment.gopkg/provider/rulesets.gopkg/provider/rulesets_test.gotest-data/analysis/analysis-output.yaml
💤 Files with no reviewable changes (1)
- test-data/analysis/analysis-output.yaml
| "\ngpgcheck = 0" \ | ||
| "\n[almalinux9-baseos]" \ | ||
| "\nname = almalinux9-baseos" \ | ||
| "\nbaseurl = https://repo.almalinux.org/almalinux/9/BaseOS/\$basearch/os/" \ | ||
| "\nenabled = 1" \ | ||
| "\ngpgcheck = 0" > /etc/yum.repos.d/almalinux.repo |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Locate the Dockerfile and inspect the relevant section with line numbers.
file=$(git ls-files | rg '(^|/)Dockerfile$' | head -n 1)
echo "FILE=$file"
wc -l "$file"
sed -n '80,115p' "$file" | cat -nRepository: konveyor/kantra
Length of output: 2036
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Read the surrounding install commands to understand the repo configuration and cleanup flow.
file=$(git ls-files | rg '(^|/)Dockerfile$' | head -n 1)
rg -n -C 3 'gpgcheck|gpgkey|microdnf clean all|podman|almalinux' "$file"Repository: konveyor/kantra
Length of output: 853
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Check whether the Dockerfile already performs package-manager cleanup elsewhere.
file=$(git ls-files | rg '(^|/)Dockerfile$' | head -n 1)
rg -n 'microdnf clean all|dnf clean all|yum clean all|clean all' "$file" || trueRepository: konveyor/kantra
Length of output: 153
🌐 Web query:
AlmaLinux 9 RPM-GPG-KEY-AlmaLinux-9 official repo documentation gpgcheck baseurl
💡 Result:
For AlmaLinux 9, the official GPG key used to sign packages and repositories is RPM-GPG-KEY-AlmaLinux-9 [1][2]. Repository Configuration When configuring repositories in AlmaLinux 9, it is standard practice to enable security checks to ensure the authenticity of packages [1][3]. The relevant settings within a repository file (typically located in /etc/yum.repos.d/) are: gpgcheck=1: This setting enables signature verification for individual packages [4][5]. It is recommended to always keep this set to 1 in production environments [4][3]. repo_gpgcheck=1: This optional but recommended setting in dnf.conf or individual repository files ensures that the repository metadata itself is verified [6]. gpgkey: This directive points to the location of the GPG public key [4]. For official AlmaLinux repositories, this is often set to a file path such as file:///etc/pki/rpm-gpg/RPM-GPG-KEY-AlmaLinux-9 [1][7]. Key Location and Import The official key file, RPM-GPG-KEY-AlmaLinux-9, is available from the official AlmaLinux repositories [8]. When manually importing the key to your system's keyring (which allows rpm and dnf to verify packages signed by that key), you can use the following command [9][10][5]: sudo rpm --import https://repo.almalinux.org/almalinux/RPM-GPG-KEY-AlmaLinux-9 If you encounter issues where the system cannot verify a package, ensure the key is correctly imported [5][11]. You can temporarily bypass verification for troubleshooting purposes using --nogpgcheck (e.g., sudo dnf install --nogpgcheck), but this is not recommended for production systems due to the security risks of installing unverified software [4][5].
Citations:
- 1: https://almalinux.org/security/
- 2: https://wiki.almalinux.org/release-notes/9.0
- 3: https://www.tenable.com/audits/items/CIS_AlmaLinux_OS_9_v1.0.0_L1_Workstation.audit:e5c3f8d8e5365cfd16faa4fe45f12be8
- 4: https://reintech.io/blog/configuring-yum-repositories-almalinux-9
- 5: https://krython.com/post/managing-package-repositories-dnf-config-almalinux/
- 6: https://www.tenable.com/audits/items/DISA_STIG_Cloud_Linux_AlmaLinux_OS_9_v1r6.audit:1d3136ddef3a413a200c5fcbede803a2
- 7: AlmaLinux/leapp-data@d05efce
- 8: https://repo.almalinux.org/almalinux/9/BaseOS/x86_64/os/
- 9: https://wiki.almalinux.org/documentation/installation-guide.html?roistat_visit=1657302
- 10: https://wiki.almalinux.org/release-notes/9.7
- 11: https://forums.almalinux.org/t/dnf-update-y-issue-gpg-check-failed/3552
🌐 Web query:
site:almalinux.org RPM-GPG-KEY-AlmaLinux-9 repo.almalinux.org AlmaLinux 9 official key URL
💡 Result:
The official URL for the AlmaLinux 9 GPG key is https://repo.almalinux.org/almalinux/RPM-GPG-KEY-AlmaLinux-9 [1][2][3]. On AlmaLinux 9 systems, this key is typically already installed and located at /etc/pki/rpm-gpg/RPM-GPG-KEY-AlmaLinux-9 [4][3]. If you need to manually import or verify the key, the official AlmaLinux documentation provides the following fingerprint for verification: BF18AC2876178908D6E71267D36CB86CB86B3716 [3].
Citations:
- 1: https://wiki.almalinux.org/documentation/installation-guide.html?roistat_visit=1657302
- 2: https://wiki.almalinux.org/release-notes/9.0
- 3: https://wiki.almalinux.org/cloud/Generic-cloud
- 4: https://almalinux.org/security/
Enable GPG checks for the AlmaLinux repos.
gpgcheck = 0 disables package signature verification for both repo entries; switch both to gpgcheck = 1 and set gpgkey = https://repo.almalinux.org/almalinux/RPM-GPG-KEY-AlmaLinux-9.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Dockerfile` around lines 93 - 98, Update the AlmaLinux repository
configuration in the Dockerfile so both repo entries use gpgcheck = 1 and
include gpgkey = https://repo.almalinux.org/almalinux/RPM-GPG-KEY-AlmaLinux-9.
Preserve the existing repository definitions and apply these settings
consistently to both entries.
mguetta1
left a comment
mguetta1
left a comment
There was a problem hiding this comment.
LGTM. Just one point is to make sure the corresponding change is in the hub if needed and that it doesn't break the koncur hub tests. Thank you!
2 participants
Koncur PR: 101
Fixes #865
Relies on konveyor/koncur#101
Summary by CodeRabbit
New Features
Bug Fixes
Tests