Fix cve-fix version and image detection#2443
Conversation
|
🤖 Created branch: z_pr2443/dfarrell07/fix-state-expiring-ignores |
|
Warning Review limit reached
Next review available in: 37 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (10)
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughAdds optional auto-expiring CVE ignores, self-fix worktree support, version-aware stdlib and package handling, environment isolation for builds, and updated CVE review guidance. ChangesCVE fix workflow updates
Estimated code review effort: 4 (Complex) | ~45 minutes Possibly related PRs
Suggested reviewers: Caution Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional.
❌ Failed checks (1 error)
✅ Passed checks (4 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
facbc6d to
4ca5179
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/cve/review-prompt.md`:
- Around line 31-35: Run markdownlint on the changed markdown file
(scripts/cve/review-prompt.md) and fix any lint issues before committing;
specifically ensure line lengths, list formatting, code span/backtick usage, and
emphasis conventions comply with the project's markdownlint rules. Re-run
markdownlint until it reports no errors, then re-stage the file and update the
PR; reference the content that mentions CVE_SCRIPTS, ignore.sh, and STATE_FILE
while making the fixes to avoid altering meaning.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: c784d464-67ee-473d-803b-9a21a0d4c6c9
📒 Files selected for processing (4)
.agents/workflows/cve-fix.mdscripts/cve/ignore.shscripts/cve/lib.shscripts/cve/review-prompt.md
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/cve/fix-stdlib.sh`:
- Around line 34-35: The script currently forces GOTOOLCHAIN=auto even when the
caller explicitly set GOTOOLCHAIN (e.g., local); change the condition so we only
set GOTOOLCHAIN=auto when it is unset. Replace the test [[ "${GOTOOLCHAIN:-}" !=
*auto* ]] with an explicit unset check (e.g., [[ -z "${GOTOOLCHAIN:-}" ]]) while
keeping the existing OLD_MINOR==NEW_MINOR guard so that only when OLD_MINOR and
NEW_MINOR match and GOTOOLCHAIN is not set do we export GOTOOLCHAIN=auto.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 5ceaeef5-5f71-4101-958e-add487377300
📒 Files selected for processing (1)
scripts/cve/fix-stdlib.sh
dfarrell07
changed the title
|
This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further |
|
🤖 Closed branches: [z_pr2443/dfarrell07/fix-state-expiring-ignores] |
|
🤖 Created branch: z_pr2443/dfarrell07/fix-state-expiring-ignores |
8dfbdb2 to
bad9688
Compare
dfarrell07
changed the title
There was a problem hiding this comment.
♻️ Duplicate comments (1)
scripts/cve/fix-stdlib.sh (1)
63-65: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winDon't override an explicitly configured
GOTOOLCHAINvalue.This condition matches explicit values like
GOTOOLCHAIN=local, forcingautoeven when the caller intentionally set a different mode. Per the official Go documentation,GOTOOLCHAIN=localmeans the go command always runs the bundled toolchain—overriding this silently breaks offline and reproducible build environments. Additionally, the override at line 63 causes the host Go check at line 70 to be skipped (sinceautomatches*auto*), masking insufficient host Go versions.This was previously flagged in an earlier review commit and remains unaddressed.
🔧 Proposed fix
# Compiler already has the fix version — bump go.mod to match -if [[ "${GOTOOLCHAIN:-}" != *auto* ]]; then +if [[ -z "${GOTOOLCHAIN:-}" ]]; then export GOTOOLCHAIN=auto fi🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/cve/fix-stdlib.sh` around lines 63 - 65, The GOTOOLCHAIN handling in the stdlib fix script is overriding explicit caller configuration, especially GOTOOLCHAIN=local, by forcing auto. Update the check around the GOTOOLCHAIN export so it only sets auto when GOTOOLCHAIN is unset, and preserves any explicitly provided value in the script’s main flow before the host Go version check. Use the existing GOTOOLCHAIN guard logic near the compiler/version setup to keep the host Go check effective.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In `@scripts/cve/fix-stdlib.sh`:
- Around line 63-65: The GOTOOLCHAIN handling in the stdlib fix script is
overriding explicit caller configuration, especially GOTOOLCHAIN=local, by
forcing auto. Update the check around the GOTOOLCHAIN export so it only sets
auto when GOTOOLCHAIN is unset, and preserves any explicitly provided value in
the script’s main flow before the host Go version check. Use the existing
GOTOOLCHAIN guard logic near the compiler/version setup to keep the host Go
check effective.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 9722505b-a40f-46e6-a8b8-c89a59052616
📒 Files selected for processing (10)
.agents/workflows/cve-fix.mdscripts/cve/detect.shscripts/cve/fix-all.shscripts/cve/fix-package.shscripts/cve/fix-stdlib.shscripts/cve/ignore.shscripts/cve/lib.shscripts/cve/review-prompt.mdscripts/cve/scan.shscripts/cve/test-lib.sh
✅ Files skipped from review due to trivial changes (2)
- .agents/workflows/cve-fix.md
- scripts/cve/review-prompt.md
🚧 Files skipped from review as they are similar to previous changes (1)
- scripts/cve/ignore.sh
bad9688 to
3b153bb
Compare
The skill inferred the build image from branch names, but the source of truth is BASE_BRANCH in each repo's Makefile. This caused stdlib, breaking-change, and version checks to use the wrong Go version. Build image: read BASE_BRANCH from Makefile; unset leaked SHIPYARD_TAG before child make build/unit. stdlib: use build image compiler to pick fix version in the right minor stream; set GOTOOLCHAIN=auto. Packages: allow Go directive bumps when build image satisfies them; scope K8s check to root go.mod; use >= comparison (version_gte) for verification and pre-update; skip commit for transitive fixes; wrap long Fixes lines. Ignores: --no-fix flag for auto-expiring entries (fix-state: not-fixed). Review agent: one call per package; extract real NEEDS_REVIEW reason; UNRESOLVED for version upgrades; don't roll back validated Go bumps. Self-fix: git worktree when fixing the repo that contains the CVE scripts. Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
eea6171 to
992b8db
Compare
|
@coderabbitai review |
✅ Action performedReview finished.
|
3 participants
The skill inferred the build image from branch names, but
the source of truth is BASE_BRANCH in each repo's Makefile.
This caused stdlib, breaking-change, and version checks to
use the wrong Go version.
Build image: read BASE_BRANCH from Makefile; unset leaked
SHIPYARD_TAG before child make build/unit.
stdlib: use build image compiler to pick fix version in
the right minor stream; set GOTOOLCHAIN=auto.
Packages: allow Go directive bumps when build image
satisfies them; scope K8s check to root go.mod; use >=
comparison (version_gte) for verification and pre-update;
skip commit for transitive fixes; wrap long Fixes lines.
Ignores: --no-fix flag for auto-expiring entries
(fix-state: not-fixed).
Review agent: one call per package; extract real
NEEDS_REVIEW reason; UNRESOLVED for version upgrades;
don't roll back validated Go bumps.
Self-fix: git worktree when fixing the repo that contains
the CVE scripts.
Summary by CodeRabbit
New Features
--no-fixoption for CVE ignores so they can expire automatically when a fix is later published.Bug Fixes
Documentation
Tests