Add oape-review-handler Prow presubmit job#81200
Conversation
Adds a new `/test oape-review-handler` command that triggers an AI-driven review comment handler. When invoked on a PR, the job: - Builds a review-handler-agent image with Node.js + Claude CLI - Fetches unresolved review threads from the PR - Invokes Claude Code per thread to push fixes or post explanations - Runs as optional, manual-trigger-only (always_run: false) Prerequisite: openshift-eng/oape-ai-e2e#63 must be merged to main before this job can function, as the image clones scripts from main. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
WalkthroughReplaces the Changesreview-handler-agent image and CI task
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes 🚥 Pre-merge checks | ✅ 14 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (14 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: neha037 The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
ci-operator/config/openshift/must-gather-operator/openshift-must-gather-operator-master.yaml (1)
18-25: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winMake runtime tool dependencies explicit.
The Dockerfile installs
jq, but the test script invokescurl,openssl, andpython3. If those are only inherited from the base image, a base refresh can break auth or PR detection. Either install them explicitly or use the already-installedjqfor JSON parsing.Localized robustness tweak
- RUN dnf install -y git make jq && \ + RUN dnf install -y git make jq curl openssl python3 && \Also applies to: 243-275
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@ci-operator/config/openshift/must-gather-operator/openshift-must-gather-operator-master.yaml` around lines 18 - 25, The Dockerfile setup in the image build block installs jq but the test flow also relies on curl, openssl, and python3, so make those runtime dependencies explicit in the same install sequence or remove the extra dependency by reworking the script to use jq for JSON parsing. Update the image build steps that configure the runtime environment so the tools used by the test script are guaranteed available regardless of the base image, keeping the existing install logic around dnf, gh, and nodejs/claude-code intact.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@ci-operator/config/openshift/must-gather-operator/openshift-must-gather-operator-master.yaml`:
- Around line 23-34: The image build is still consuming mutable external inputs,
so update the RUN steps that install `@anthropic-ai/claude-code`, clone
oape-ai-e2e, and fetch golangci-lint to use immutable pinned versions or commit
SHAs instead of latest/main. Replace the network-piped golangci-lint installer
flow with a safer, pinned install method, and keep the build reproducible by
locking every remote dependency referenced in the Dockerfile snippet.
---
Nitpick comments:
In
`@ci-operator/config/openshift/must-gather-operator/openshift-must-gather-operator-master.yaml`:
- Around line 18-25: The Dockerfile setup in the image build block installs jq
but the test flow also relies on curl, openssl, and python3, so make those
runtime dependencies explicit in the same install sequence or remove the extra
dependency by reworking the script to use jq for JSON parsing. Update the image
build steps that configure the runtime environment so the tools used by the test
script are guaranteed available regardless of the base image, keeping the
existing install logic around dnf, gh, and nodejs/claude-code intact.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: e7e046dc-9f0b-4b99-98c0-ed1a0db7d799
⛔ Files ignored due to path filters (1)
ci-operator/jobs/openshift/must-gather-operator/openshift-must-gather-operator-master-presubmits.yamlis excluded by!ci-operator/jobs/**
📒 Files selected for processing (1)
ci-operator/config/openshift/must-gather-operator/openshift-must-gather-operator-master.yaml
| RUN dnf module enable -y nodejs:20 && \ | ||
| dnf install -y nodejs npm && \ | ||
| npm install -g @anthropic-ai/claude-code && \ | ||
| dnf clean all | ||
| WORKDIR /app | ||
| RUN git clone --depth 1 -b main https://github.com/openshift-eng/oape-ai-e2e.git /tmp/oape && \ | ||
| cp -r /tmp/oape/scripts /app/scripts && \ | ||
| cp -r /tmp/oape/plugins /plugins && \ | ||
| mkdir -p /config && cp -r /tmp/oape/deploy/config/* /config/ && \ | ||
| rm -rf /tmp/oape | ||
| RUN go install golang.org/x/tools/cmd/goimports@v0.33.0 && \ | ||
| curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/v2.1.6/install.sh | sh -s -- -b /usr/local/bin v2.1.6 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE='ci-operator/config/openshift/must-gather-operator/openshift-must-gather-operator-master.yaml'
echo "== file exists =="
git ls-files "$FILE"
echo
echo "== size =="
wc -l "$FILE"
echo
echo "== relevant excerpt =="
sed -n '1,120p' "$FILE"Repository: openshift/release
Length of output: 3977
Pin the agent image’s external inputs
ci-operator/config/openshift/must-gather-operator/openshift-must-gather-operator-master.yaml:23-34 still pulls executable code from mutable network locations: @anthropic-ai/claude-code without a version, oape-ai-e2e from main, and the golangci-lint installer script via curl. Since this image later runs with GitHub/GCP credentials, lock these to immutable versions/SHAs and avoid piping the installer straight from the network.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@ci-operator/config/openshift/must-gather-operator/openshift-must-gather-operator-master.yaml`
around lines 23 - 34, The image build is still consuming mutable external
inputs, so update the RUN steps that install `@anthropic-ai/claude-code`, clone
oape-ai-e2e, and fetch golangci-lint to use immutable pinned versions or commit
SHAs instead of latest/main. Replace the network-piped golangci-lint installer
flow with a safer, pinned install method, and keep the build reproducible by
locking every remote dependency referenced in the Dockerfile snippet.
|
@neha037: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
@neha037: job(s): oape-review-handler either don't exist or were not found to be affected, and cannot be rehearsed |
Switch the review-handler-agent dockerfile_literal to clone from neha037/oape-ai-e2e branch oape-review-handler instead of openshift-eng/oape-ai-e2e main, matching the pattern used by ci-monitor-agent in PR openshift#80727. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
/pj-rehearse oape-review-handler |
|
@neha037: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
@neha037: job(s): oape-review-handler either don't exist or were not found to be affected, and cannot be rehearsed |
|
/pj-rehearse pull-ci-openshift-must-gather-operator-master-oape-review-handler |
|
@neha037: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
The ubi9/go-toolset base image has nodejs stream 22 already enabled. dnf module enable nodejs:20 fails because DNF refuses to switch streams without an explicit reset. Add dnf module reset -y nodejs before enabling stream 20. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
[REHEARSALNOTIFIER]
Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
/pj-rehearse pull-ci-openshift-must-gather-operator-master-oape-review-handler |
|
@neha037: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
/pj-rehearse pull-ci-openshift-must-gather-operator-master-oape-review-handler |
|
@neha037: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
@neha037: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
1 participant
Summary
review-handler-agentimage (Node.js 20 + Claude CLI + Go tooling) that clones scripts frommainofopenshift-eng/oape-ai-e2eoape-review-handlerpresubmit test step triggered by/test oape-review-handleralways_run: false,optional: true— manual trigger onlyPrerequisite
openshift-eng/oape-ai-e2e#63 must be merged to
mainbefore this job can function, since thedockerfile_literalclones scripts from themainbranch.Usage
On any PR in
openshift/must-gather-operator:For rehearsal from this PR:
Test plan
make jobsregenerates the presubmits YAML correctly/pj-rehearse oape-review-handlerto validate job definition/test oape-review-handleron a real PR with review comments🤖 Generated with Claude Code
Summary by CodeRabbit
This PR updates OpenShift CI configuration for
openshift/must-gather-operatorby introducing a new optional, manually triggered Prow presubmit test (/test oape-review-handler, job namepull-ci-openshift-must-gather-operator-master-oape-review-handler, withrerun_command: /test oape-review-handler;always_run: false,optional: true).In practical terms, the job enables an AI-assisted review-reply workflow that, when run, fetches unresolved GitHub PR review threads and uses Claude Code to generate either code fixes (pushed back to the PR) or explanatory replies.
To support this, the PR adds a new
review-handler-agentcontainer image built inline fromregistry.access.redhat.com/ubi9/go-toolset. The image installs required tooling (git,make,jq,gh), enables Node.js 20 and installs@anthropic-ai/claude-code, and includes Go tooling (goimports,golangci-lint). It clonesopenshift-eng/oape-ai-e2efrommain(prerequisite:openshift-eng/oape-ai-e2e#63must be merged tomain) to copyscripts,plugins, anddeploy/config. It also applies a Node.js module stream conflict fix by runningdnf module reset -y nodejsbefore enablingnodejs:20. The image is configured to run as user1001.The test task also supports rehearsal (
/pj-rehearse oape-review-handler), including rehearsal from anopenshift/releasecontext by switching toopenshift/must-gather-operatorand selecting the first open PR number via the GitHub API, settingPULL_NUMBERaccordingly.When executed, the task:
/var/run/github-app/app-idand/var/run/github-app/private-key.pemare present, otherwise falls back toGITHUB_TOKEN/GH_TOKEN;PR_URL, configuresghauth, and runs/app/scripts/pr-agent/review-handler.sh --pr-url "$PR_URL"using thereview-handler-agentimage;Finally, the PR updates release promotion for integration
5.0to excludereview-handler-agentfrom promoted images.