CNTRLPLANE-3020: Adopt coreos/stream-metadata-go upstream library#8673
Draft
sdminonne wants to merge 1 commit into
Draft
CNTRLPLANE-3020: Adopt coreos/stream-metadata-go upstream library#8673sdminonne wants to merge 1 commit into
sdminonne wants to merge 1 commit into
Conversation
Contributor
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
openshift-ci-robot
added
the
jira/valid-reference
|
@sdminonne: This pull request references CNTRLPLANE-3020 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
Contributor
|
Skipping CI for Draft Pull Request. |
Contributor
📝 WalkthroughWalkthroughThis PR migrates the HyperShift release image metadata schema from a custom internal implementation to the industry-standard 🚥 Pre-merge checks | ✅ 4 | ❌ 7❌ Failed checks (7 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
openshift-ci
Bot
added
do-not-merge/needs-area
area/control-plane-operator
Contributor
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: sdminonne The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
openshift-ci
Bot
added
area/hypershift-operator
|
I now have all the evidence needed. The root cause is clear. Test Failure Analysis CompleteJob Information
Test Failure AnalysisErrorSummaryThe gitlint check failed because the commit message title uses Root CauseThe commit message title is: The repository's The prefix RecommendationsAmend the commit message title to use a valid Conventional Commits prefix. Since this PR is a pure refactoring that replaces custom types with upstream equivalents, the appropriate prefix is Or more simply: To fix, run: git commit --amend -m "refactor(releaseinfo): adopt coreos/stream-metadata-go upstream library" --no-edit
git push --force-with-leaseEither format is valid — Evidence
|
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #8673 +/- ##
==========================================
- Coverage 41.44% 41.42% -0.02%
==========================================
Files 756 756
Lines 93644 93668 +24
==========================================
- Hits 38807 38805 -2
- Misses 52114 52137 +23
- Partials 2723 2726 +3
... and 3 files with indirect coverage changes
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
Replace 18 custom CoreOS stream metadata Go types with canonical equivalents from github.com/coreos/stream-metadata-go v0.4.11. This eliminates duplicated type definitions and gains upstream helper methods (e.g. GetAMI(), URN()), laying groundwork for the dual-stream RHEL NodePool feature. Key type mappings: - CoreOSStreamMetadata -> stream.Stream - CoreOSArchitecture -> stream.Arch - CoreRHCOSImage -> *rhcos.Extensions (pointer) - CoreOSAWSImages -> *stream.AwsImage (pointer) - CoreOSGCPImage -> *stream.GcpImage (pointer) - CoreOSPowerVSImage -> *stream.SingleObject - CoreOSKubevirtImages -> *stream.ContainerImage (pointer) - HyperVGen1/HyperVGen2 -> Gen1/Gen2 - SHA256 -> Sha256, URL -> Url (PowerVS) Pure refactor with no behavioral changes. All platform controllers updated with nil checks for pointer-typed upstream fields. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
sdminonne
force-pushed
the
CNTRLPLANE-3020
branch
from
63d6ec6 to
aeff6d5
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 45: The dependency entry github.com/coreos/stream-metadata-go v0.4.11 in
go.mod has been reviewed for supply-chain and licensing; verify that the Apache
License in the module's LICENSE file complies with your org's approved-license
policy and then either (a) document approval by adding a note to your
dependency/security tracker referencing github.com/coreos/stream-metadata-go
v0.4.11 and the SPDX identifier Apache-2.0, or (b) if it is not approved,
replace or remove the dependency (update go.mod to a compliant alternative or
open an RFC/PR to remove usage in the codebase such as functions/types
referencing the module) and record the decision in your dependency policy
tracker.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 1dff7c90-272c-4f48-b407-ea45ed058fb8
⛔ Files ignored due to path filters (7)
go.sumis excluded by!**/*.sumvendor/github.com/coreos/stream-metadata-go/LICENSEis excluded by!vendor/**,!**/vendor/**vendor/github.com/coreos/stream-metadata-go/stream/artifact_utils.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/coreos/stream-metadata-go/stream/rhcos/rhcos.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/coreos/stream-metadata-go/stream/stream.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/coreos/stream-metadata-go/stream/stream_utils.gois excluded by!vendor/**,!**/vendor/**vendor/modules.txtis excluded by!vendor/**,!**/vendor/**
📒 Files selected for processing (20)
go.modhypershift-operator/controllers/nodepool/aws.gohypershift-operator/controllers/nodepool/aws_test.gohypershift-operator/controllers/nodepool/azure.gohypershift-operator/controllers/nodepool/azure_test.gohypershift-operator/controllers/nodepool/gcp_test.gohypershift-operator/controllers/nodepool/kubevirt/kubevirt.gohypershift-operator/controllers/nodepool/kubevirt/kubevirt_test.gohypershift-operator/controllers/nodepool/nodepool_controller.gohypershift-operator/controllers/nodepool/openstack/openstack.gohypershift-operator/controllers/nodepool/openstack/openstack_test.gohypershift-operator/controllers/nodepool/powervs.gohypershift-operator/controllers/nodepool/token_test.gosupport/releaseinfo/deserialize.gosupport/releaseinfo/deserialize_test.gosupport/releaseinfo/fake/fake.gosupport/releaseinfo/registry_image_content_policies_test.gosupport/releaseinfo/releaseinfo.gosupport/releaseinfo/releaseinfo_test.gosupport/releaseinfo/testutils/testutils.go
✅ Files skipped from review due to trivial changes (1)
- hypershift-operator/controllers/nodepool/nodepool_controller.go
🚧 Files skipped from review as they are similar to previous changes (14)
- support/releaseinfo/registry_image_content_policies_test.go
- hypershift-operator/controllers/nodepool/kubevirt/kubevirt.go
- hypershift-operator/controllers/nodepool/openstack/openstack.go
- hypershift-operator/controllers/nodepool/kubevirt/kubevirt_test.go
- support/releaseinfo/deserialize.go
- support/releaseinfo/testutils/testutils.go
- support/releaseinfo/fake/fake.go
- support/releaseinfo/releaseinfo.go
- hypershift-operator/controllers/nodepool/azure_test.go
- hypershift-operator/controllers/nodepool/gcp_test.go
- support/releaseinfo/deserialize_test.go
- hypershift-operator/controllers/nodepool/azure.go
- hypershift-operator/controllers/nodepool/powervs.go
- hypershift-operator/controllers/nodepool/aws_test.go
| github.com/clarketm/json v1.17.1 | ||
| github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf | ||
| github.com/coreos/ignition/v2 v2.25.1 | ||
| github.com/coreos/stream-metadata-go v0.4.11 |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Verify stream-metadata-go v0.4.11 for CVEs, license, and stability
echo "=== Checking GitHub Security Advisories ==="
gh api graphql -f query='
{
securityVulnerabilities(first: 10, ecosystem: GO, package: "github.com/coreos/stream-metadata-go") {
nodes {
advisory {
summary
severity
publishedAt
}
vulnerableVersionRange
firstPatchedVersion {
identifier
}
}
}
}'
echo ""
echo "=== Checking Package Metadata from pkg.go.dev ==="
curl -s "https://pkg.go.dev/github.com/coreos/stream-metadata-go@v0.4.11" | grep -E "(License|Deprecated|Retracted)" || echo "No deprecation/retraction found"
echo ""
echo "=== Checking if v0.4.11 exists on GitHub releases ==="
gh api repos/coreos/stream-metadata-go/releases --jq '.[] | select(.tag_name == "v0.4.11") | {tag_name, prerelease, draft, published_at}'Repository: openshift/hypershift
Length of output: 491
🏁 Script executed:
#!/bin/bash
set -euo pipefail
MOD="github.com/coreos/stream-metadata-go"
VER="v0.4.11"
echo "=== Checking OSV for known vulnerabilities ==="
curl -s "https://api.osv.dev/v1/query" \
-H "content-type: application/json" \
-d `@-` <<JSON | jq -c '.'
{
"package": { "name": "'"$MOD"'" },
"version": "'"$VER"'"
}
JSON
echo ""
echo "=== Extracting license(s) from pkg.go.dev ==="
# Fetch only the relevant part of the licenses tab (best-effort)
curl -s "https://pkg.go.dev/$MOD@$VER?tab=licenses" \
| rg -o -m 5 'License:\s*</[^>]+>\s*<[^>]+>([^<]+)' || true
# Also output any "License:" lines to avoid missing formatting changes
curl -s "https://pkg.go.dev/$MOD@$VER?tab=licenses" \
| rg -n "License:" | head -n 20 || trueRepository: openshift/hypershift
Length of output: 291
🏁 Script executed:
#!/bin/bash
set -euo pipefail
MOD="github.com/coreos/stream-metadata-go"
VER="v0.4.11"
echo "=== Checking OSV for known vulnerabilities (package + version) ==="
payload="$(jq -n --arg name "$MOD" --arg version "$VER" '{package: {name: $name}, version: $version}')"
curl -s "https://api.osv.dev/v1/query" \
-H "content-type: application/json" \
-d "$payload" | jq -c '.'
echo ""
echo "=== Checking pkg.go.dev license for v0.4.11 ==="
# Fetch HTML and extract license labels (best-effort; pkg.go.dev markup can vary)
curl -s -L -A "Mozilla/5.0" "https://pkg.go.dev/$MOD@$VER?tab=licenses" \
| rg -n "License:" | head -n 20
curl -s -L -A "Mozilla/5.0" "https://pkg.go.dev/$MOD@$VER?tab=licenses" \
| rg -o -m 10 "License:\s*[^<]+" || trueRepository: openshift/hypershift
Length of output: 183
🏁 Script executed:
#!/bin/bash
set -euo pipefail
MOD="github.com/coreos/stream-metadata-go"
VER="v0.4.11"
echo "=== OSV raw query response ==="
payload="$(jq -n --arg name "$MOD" --arg version "$VER" '{package: {name: $name}, version: $version}')"
curl -sS -D /tmp/osv_headers.txt -o /tmp/osv_body.json \
-H "content-type: application/json" \
--data "$payload" \
https://api.osv.dev/v1/query || true
echo "--- HTTP ---"
cat /tmp/osv_headers.txt
echo "--- Body (first 500 chars) ---"
python3 - <<'PY'
import json, pathlib
p=pathlib.Path("/tmp/osv_body.json")
b=p.read_text(errors="ignore")
print(b[:500])
# try parse if possible
try:
j=json.loads(b)
print("\n--- Parsed keys ---")
print(list(j.keys()))
print("vulns_count=", len(j.get("vulns", [])) if isinstance(j.get("vulns"), list) else None)
except Exception:
pass
PY
echo ""
echo "=== pkg.go.dev license tab (presence check) ==="
# Just check whether the page contains "License:" text to avoid brittle parsing
curl -sS -L -A "Mozilla/5.0" "https://pkg.go.dev/$MOD@$VER?tab=licenses" \
| rg -n "License:" | head -n 20 || true
echo ""
echo "=== Check if module version is yanked via Go proxy ==="
curl -sS -D /tmp/proxy_headers.txt -o /tmp/proxy_info.json \
"https://proxy.golang.org/$MOD/@v/$VER.info" || true
cat /tmp/proxy_headers.txt
python3 - <<'PY'
import pathlib, json
p=pathlib.Path("/tmp/proxy_info.json")
b=p.read_text(errors="ignore")
print("\n--- proxy info body (first 300 chars) ---")
print(b[:300])
try:
j=json.loads(b)
print("\nParsed:", j)
except Exception:
pass
PY
echo ""
echo "=== Determine upstream license by scanning LICENSE files in module source ==="
tmpdir="$(mktemp -d)"
zip="/tmp/module_src.zip"
curl -sS -L -o "$zip" "https://proxy.golang.org/$MOD/@v/$VER.zip"
python3 - <<'PY'
import zipfile, re, pathlib, io, os, sys
zip_path="/tmp/module_src.zip"
z=zipfile.ZipFile(zip_path)
candidates=[]
for name in z.namelist():
low=name.lower()
if any(k in low for k in ["license", "copying", "licence"]):
if low.endswith((".txt",".md",".rst",".html")) or "license" in low or "copying" in low:
candidates.append(name)
# Prefer top-level / typical filenames
preferred=[]
for n in candidates:
base=os.path.basename(n).lower()
if base in ["license","license.txt","license.md","copying","copying.txt","licence","licence.txt"]:
preferred.append(n)
for n in preferred + candidates:
if n not in candidates[:10]:
pass
top = (preferred + candidates)[:10]
print("License-like file candidates:", top)
keywords = [
("Apache License", re.compile(r"Apache License", re.I)),
("MIT License", re.compile(r"\bMIT License\b", re.I)),
("BSD 2-Clause", re.compile(r"\bRedistribution and use in source and binary forms\b.*\bBSD\b", re.I|re.S)),
("BSD 3-Clause", re.compile(r"\bNeither the name of\b.*\bmay be used to endorse\b", re.I|re.S)),
("GPLv2", re.compile(r"\bGNU GENERAL PUBLIC LICENSE\b.*Version 2", re.I|re.S)),
("GPLv3", re.compile(r"\bGNU GENERAL PUBLIC LICENSE\b.*Version 3", re.I|re.S)),
("MPL 2.0", re.compile(r"\bMozilla Public License\b.*2\.0", re.I|re.S)),
]
def classify(text):
hits=[]
for label, rx in keywords:
if rx.search(text):
hits.append(label)
# also capture "SPDX-License-Identifier" if present
spdx=re.findall(r"SPDX-License-Identifier:\s*([^\s]+)", text)
return hits, spdx
for name in top:
try:
data=z.read(name)
except Exception:
continue
# limit amount
chunk=data[:200000]
try:
text=chunk.decode("utf-8", errors="ignore")
except Exception:
text=str(chunk)
hits, spdx=classify(text)
if hits or spdx:
print(f"\n--- {name} ---")
if spdx:
print("SPDX:", spdx[:5])
print("Matches:", hits[:10])
# show first relevant line
m=re.search(r"(SPDX-License-Identifier[^\n]*|Apache License[^\n]*|MIT License[^\n]*|Mozilla Public License[^\n]*|GNU GENERAL PUBLIC LICENSE[^\n]*)", text, re.I)
if m:
print("Example:", m.group(1).strip())
PYRepository: openshift/hypershift
Length of output: 2296
🏁 Script executed:
#!/bin/bash
set -euo pipefail
MOD="github.com/coreos/stream-metadata-go"
VER="v0.4.11"
echo "=== License header snippet from module source ==="
zip="/tmp/module_src.zip"
curl -sS -L -o "$zip" "https://proxy.golang.org/$MOD/@v/$VER.zip"
python3 - <<'PY'
import zipfile, re
zip_path="/tmp/module_src.zip"
z=zipfile.ZipFile(zip_path)
# Prefer LICENSE at root
names=[n for n in z.namelist() if n.lower().endswith('/license') or n.lower().endswith('license')]
if not names:
names=[n for n in z.namelist() if 'license' in n.lower()]
for n in names[:5]:
data=z.read(n)
text=data.decode('utf-8', errors='ignore')
# show a tight snippet around "Apache License"
m=re.search(r"(Apache License[^\n]{0,200})", text)
print("\nFILE:", n)
if m:
print("SNIPPET:", m.group(1).strip())
# SPDX line if present
spdx=re.search(r"SPDX-License-Identifier:\s*([^\n]+)", text)
if spdx:
print("SPDX:", spdx.group(1).strip())
# show first 30 lines (best effort)
first="\n".join(text.splitlines()[:30])
print("FIRST_LINES:\n", first)
break
PY
echo ""
echo "=== Go proxy zip availability (yank check) ==="
curl -sS -I "https://proxy.golang.org/$MOD/@v/$VER.zip" | rg -i "HTTP/|Content-Type|x-goog-stored-content-length" || trueRepository: openshift/hypershift
Length of output: 1962
🏁 Script executed:
#!/bin/bash
set -euo pipefail
MOD="github.com/coreos/stream-metadata-go"
VER="v0.4.11"
payload="$(jq -n --arg name "$MOD" --arg version "$VER" \
'{package:{name:$name, ecosystem:"Go"}, version:$version}')"
curl -sS -H "content-type: application/json" \
-d "$payload" https://api.osv.dev/v1/query | jq -c '.vulns'Repository: openshift/hypershift
Length of output: 1962
Supply-chain checks for github.com/coreos/stream-metadata-go v0.4.11
- No CVEs reported for
v0.4.11(GitHub Security Advisories / OSV came back empty). - License: module root
LICENSEindicates the Apache License. - Version stability:
v0.4.11is a published non-prerelease GitHub release andhttps://proxy.golang.org/.../@v/v0.4.11.zipis available (not yanked).
Confirm the Apache license fits your repo/org’s approved-license policy.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 45, The dependency entry github.com/coreos/stream-metadata-go
v0.4.11 in go.mod has been reviewed for supply-chain and licensing; verify that
the Apache License in the module's LICENSE file complies with your org's
approved-license policy and then either (a) document approval by adding a note
to your dependency/security tracker referencing
github.com/coreos/stream-metadata-go v0.4.11 and the SPDX identifier Apache-2.0,
or (b) if it is not approved, replace or remove the dependency (update go.mod to
a compliant alternative or open an RFC/PR to remove usage in the codebase such
as functions/types referencing the module) and record the decision in your
dependency policy tracker.
10 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does / why we need it:
Replaces 18 custom CoreOS stream metadata Go types in
support/releaseinfo/releaseinfo.gowith canonical equivalents fromgithub.com/coreos/stream-metadata-gov0.4.11. This eliminates duplicated type definitions, gains upstream helper methods (e.g.GetAMI(),URN()), and lays the groundwork for the dual-stream RHEL NodePool feature.Scope: Pure refactor — no behavioral changes.
Key type mappings:
CoreOSStreamMetadatastream.StreamCoreOSArchitecturestream.ArchCoreRHCOSImage*rhcos.ExtensionsCoreOSAWSImages*stream.AwsImageCoreOSGCPImage*stream.GcpImageCoreOSPowerVSImage*stream.SingleObjectCoreOSKubevirtImages*stream.ContainerImageHyperVGen1/HyperVGen2Gen1/Gen2SHA256/URL(PowerVS)Sha256/UrlWhich issue(s) this PR fixes:
Fixes CNTRLPLANE-3020
Special notes for your reviewer:
Formatsmap changed frommap[string]map[string]CoreOSFormattomap[string]stream.ImageFormat— access to disk artifacts changed fromartifact["disk"]toartifact.Diskmake lint-fixChecklist:
🤖 Generated with Claude Code
Summary by CodeRabbit
Bug Fixes
Refactor