Skip to content

[DNM] Add dummy task, pipeline, and ITS for EC-2011 POC #3476

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
simonbaird wants to merge 6 commits into
base: main
Choose a base branch
from
+537 −240
Draft

[DNM] Add dummy task, pipeline, and ITS for EC-2011 POC #3476

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
21a331d
DNM: Skip CI test jobs for POC branch
simonbaird Aug 7, 2026
af738f7
Add dummy task, pipeline, and ITS for EC-2011
simonbaird Aug 26, 2026
8bb6ae1
Surface attestation ARTIFACT_OUTPUTS for Chains provenance
simonbaird Aug 26, 2026
2371d4e
DNM: Faster builds while hacking
simonbaird Aug 26, 2026
a9b6c18
Emit attestation uri/digest as strings, assemble object in pipeline
simonbaird Aug 27, 2026
f78bd2d
Surface attestation uri/digest via Task result value mechanism
simonbaird Aug 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .github/workflows/benchmark.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,7 @@ jobs:

stress:
name: Stress Benchmark
if: false # skipped for POC branch

@fullsend-ai-review fullsend-ai-review Bot Aug 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] scope-creep

Disabling all GitHub Actions CI jobs and removing ~240 lines of Tekton security scanning tasks are not part of the stated EC-2011 scope. The POC-specific files could be added without modifying production CI/CD configuration.

Suggested fix: Remove if: false additions from workflow files. Revert Tekton pipeline deletions and create a separate PipelineRun.

@fullsend-ai-review fullsend-ai-review Bot Aug 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] scope-creep

Disabling all GitHub Actions CI jobs goes beyond the stated POC goal of dog-fooding a required task in an ITS. Blanket CI suppression is orthogonal scope.

runs-on: ubuntu-latest
timeout-minutes: 15
continue-on-error: true
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/checks-codecov.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,7 @@ permissions:
jobs:

Test:
if: false # skipped for POC branch

@coderabbitai coderabbitai Bot Aug 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Replace the constant job conditions with one lint-valid POC gate.

actionlint rejects each constant if: false condition. Use the same non-constant repository or workflow variable gate for all three jobs. Keep the gate false for the POC.

  • .github/workflows/checks-codecov.yaml#L37-L37: update the Test job condition.
  • .github/workflows/checks-codecov.yaml#L100-L100: update the Acceptance job condition.
  • .github/workflows/checks-codecov.yaml#L169-L169: update the Upload job condition.
🧰 Tools
🪛 actionlint (1.7.12)

[error] 37-37: constant expression "false" in condition. remove the if: section

(if-cond)

📍 Affects 1 file
  • .github/workflows/checks-codecov.yaml#L37-L37 (this comment)
  • .github/workflows/checks-codecov.yaml#L100-L100
  • .github/workflows/checks-codecov.yaml#L169-L169
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/checks-codecov.yaml at line 37, Replace the constant if:
false conditions for the Test, Acceptance, and Upload jobs with the same
non-constant repository or workflow variable gate that evaluates false for the
POC, ensuring actionlint accepts all three conditions. Update
.github/workflows/checks-codecov.yaml at lines 37-37, 100-100, and 169-169.

Source: Linters/SAST tools

@fullsend-ai-review fullsend-ai-review Bot Aug 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] CI coverage regression

The if: false additions unconditionally disable the Test, Acceptance, and Upload jobs in the checks-codecov workflow. This is the only workflow that runs make test and make acceptance. The PR targets main, so merging this disables all unit test, acceptance test, and coverage gating for every subsequent PR and push to main/release-* branches.

Suggested fix: Remove the if: false additions, or use a branch-conditional expression (e.g., if: github.ref != 'refs/heads/reqd-task-its-poc') to limit the skip to the POC branch only.

@fullsend-ai-review fullsend-ai-review Bot Aug 8, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] CI coverage regression

Adding if: false to the Test, Acceptance, and Upload jobs disables all test and coverage CI for every PR and push to main. The release workflow (release.yaml) triggers on workflow_run with conclusion=='success'. Since the Tools job still runs and skipped jobs do not fail the workflow, the overall conclusion will be 'success', meaning releases could proceed on every main push without any test validation.

Suggested fix: Do not merge if: false on the main branch. Keep these changes on a separate POC branch, use path-based conditions, or disable the release workflow trigger as well.

@fullsend-ai-review fullsend-ai-review Bot Aug 8, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] scope-creep

Disabling all three CI jobs is beyond the stated intent of adding a dummy task/pipeline. The PR is marked [DNM] but is not a draft, increasing the risk of accidental merge. No documented cleanup plan or expiration date exists for the POC artifacts.

Suggested fix: Remove CI workflow changes from this PR, or convert to a draft PR.

@fullsend-ai-review fullsend-ai-review Bot Aug 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] CI coverage regression

All three CI jobs (Test, Acceptance, Upload) are unconditionally disabled with if: false. This workflow runs on PRs and pushes to main and release-* branches. If merged, all Go unit tests, integration tests, acceptance tests, code generation checks, and code coverage uploads would be permanently disabled for all future PRs and pushes to main.

Suggested fix: Do not merge the if: false changes to main. If this POC branch needs to skip these checks, use a branch-specific condition or keep this change on a non-main branch only.

@fullsend-ai-review fullsend-ai-review Bot Aug 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] protected-path

This PR modifies a file under the .github/ protected path. The PR has no linked GitHub issue and the description does not explain why CI jobs need to be disabled. Changes to governance and infrastructure files require human approval.

Suggested fix: Create a linked GitHub issue explaining the rationale for disabling CI jobs, or move this change to a non-main branch.

@fullsend-ai-review fullsend-ai-review Bot Aug 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] CI coverage regression

All three CI jobs (Test, Acceptance, Upload) are unconditionally disabled with if: false. The PR is not marked as draft and targets main. If merged, all unit tests, integration tests, acceptance tests, and code coverage uploads from this workflow are disabled for subsequent PRs. The [DNM] title convention is not enforced by branch protection.

Suggested fix: Mark this PR as a draft to prevent accidental merge, or remove the CI-disabling changes from this PR entirely.

@fullsend-ai-review fullsend-ai-review Bot Aug 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] CI coverage regression

All three CI jobs (Test, Acceptance, Upload) are unconditionally disabled with 'if: false'. This workflow runs on pull_request and push to main and release-* branches. If merged to main, all subsequent PRs will lack unit test, acceptance test, and code-coverage CI signal. No other workflow provides equivalent coverage.

Suggested fix: Do not merge these 'if: false' guards to main. Either scope the skip to the POC branch with a conditional expression, or remove the guards before merging.

@fullsend-ai-review fullsend-ai-review Bot Aug 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] CI coverage regression

Adding if: false unconditionally disables the Test, Acceptance, and Upload jobs for all branches, including PRs to main. The comment says 'skipped for POC branch' but if: false is not branch-scoped — if merged, all automated testing and coverage gates are removed.

Suggested fix: Scope the skip to the POC branch only (e.g., if: github.ref != 'refs/heads/reqd-task-its-poc'), or do not merge these workflow changes to main.

@fullsend-ai-review fullsend-ai-review Bot Aug 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] ci-safety-guard-disabled

All CI test jobs (Test, Acceptance, Upload) are unconditionally disabled with if: false. If accidentally merged or cherry-picked, CI protection for the repository is silently removed.

Suggested fix: Use a branch-conditional guard (e.g., if: github.ref != 'refs/heads/reqd-task-its-poc') instead of if: false.

@fullsend-ai-review fullsend-ai-review Bot Aug 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] CI coverage regression

Adding if: false unconditionally disables the Test, Acceptance, and Upload jobs in the checks-codecov workflow. This workflow gates unit tests, acceptance tests, and code coverage on PR and push to main/release branches. If merged, all subsequent changes would land without these checks. The PR is not in draft state and targets main.

Suggested fix: Mark the PR as draft or use a branch-scoped condition (e.g., if: github.head_ref != 'reqd-task-its-poc') instead of unconditional false.

@fullsend-ai-review fullsend-ai-review Bot Aug 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] protected-path

Files under the protected .github/ path are modified (.github/workflows/checks-codecov.yaml, .github/workflows/codeql.yaml). The PR has no linked GitHub issue and does not provide explicit justification for modifying governance/infrastructure files. Human approval is required for all protected-path changes.

Suggested fix: Link a GitHub issue that authorizes the CI workflow modifications, or remove the .github/ changes from this PR.

@fullsend-ai-review fullsend-ai-review Bot Aug 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] CI-coverage-regression

Adding if: false unconditionally disables the Test, Acceptance, and Upload jobs for all pull requests and pushes to main/release branches. If merged, every subsequent PR would lose unit test, acceptance test, and code coverage CI signal.

Suggested fix: Use a branch-scoped condition such as if: github.head_ref != 'reqd-task-its-poc', or remove the CI changes entirely.

@fullsend-ai-review fullsend-ai-review Bot Aug 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] scope-creep

Disabling all CI quality gates via if: false is a significant scope expansion beyond what a POC for testing pipelines and artifacts in Konflux would require.

Suggested fix: Remove the if: false additions from the CI workflow files.

@fullsend-ai-review fullsend-ai-review Bot Aug 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] CI coverage regression

Adding if: false to the Test, Acceptance, and Upload jobs unconditionally disables all unit tests, acceptance tests, and code coverage uploads. If merged, code could land on main without test or coverage signal. The if: false approach is branch-unaware.

Suggested fix: Replace if: false with a branch-conditional guard or move POC artifacts to a separate branch without modifying shared CI workflows.

@fullsend-ai-review fullsend-ai-review Bot Aug 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] CI coverage regression

Adding if: false unconditionally disables the Test, Acceptance, and Upload Coverage jobs. This workflow provides unit test, integration test, acceptance test, and code coverage gate signal on PRs and pushes to main/release-* branches. If merged, all PRs and pushes to main would land without these CI checks.

Suggested fix: Use a branch-name condition instead of if: false, or move CI-disabling to a separate workflow file on the POC branch.

@fullsend-ai-review fullsend-ai-review Bot Aug 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] scope-coherence

Disabling CI jobs with if: false is scope creep beyond the POC's stated purpose of testing Tekton pipelines and artifacts in Konflux.

Suggested fix: Remove the if: false additions or use branch-level filtering in workflow triggers.

@fullsend-ai-review fullsend-ai-review Bot Aug 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] protected-path

Protected path modified: .github/workflows/checks-codecov.yaml and .github/workflows/codeql.yaml are under the .github/ protected path. The PR has no linked GitHub issue and does not explain why CI workflow files need to be modified. Human approval is always required for changes to governance and infrastructure files.

Suggested fix: Link a GitHub issue authorizing the CI workflow changes, or remove the if: false modifications from the protected workflow files.

@fullsend-ai-review fullsend-ai-review Bot Aug 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] CI coverage regression

if: false unconditionally disables the Test, Acceptance, and Upload jobs. These guards are not branch-scoped, so accidental merge would disable all tests and coverage for the repository.

Suggested fix: Use a branch-scoped condition like if: github.head_ref != reqd-task-its-poc rather than if: false.

@fullsend-ai-review fullsend-ai-review Bot Aug 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] scope-creep

Disabling CI workflows is outside the PRs stated scope of add dummy task, pipeline, and ITS for EC-2011 POC.

Suggested fix: Remove the if: false guards. Use [skip ci] in individual commit messages if CI is too slow for iteration.

@fullsend-ai-review fullsend-ai-review Bot Aug 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] protected-path

PR modifies files under the protected .github/ path (.github/workflows/checks-codecov.yaml, .github/workflows/codeql.yaml). No linked issue exists and the PR description does not specifically explain why CI workflow files are being modified. Human approval is always required for protected-path changes.

Suggested fix: Link a GitHub issue authorizing the CI workflow changes, or remove the workflow modifications from this PR.

@fullsend-ai-review fullsend-ai-review Bot Aug 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] CI coverage regression

Adding if: false unconditionally disables the Test, Acceptance, and Upload jobs for all branches. The comment says 'skipped for POC branch' but if: false is not branch-conditional, so if merged it would disable CI for all branches.

Suggested fix: Replace if: false with a branch-scoped condition or keep these changes out of the workflow files entirely.

@fullsend-ai-review fullsend-ai-review Bot Aug 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] scope-mismatch

CI disabling is a significant scope expansion beyond the stated intent of adding dummy task/pipeline/ITS. The CI changes are unnecessary for the POC goal.

Suggested fix: Remove the if: false additions. Use per-commit skip mechanisms instead.

@fullsend-ai-review fullsend-ai-review Bot Aug 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] CI coverage regression

All three jobs (Test, Acceptance, Upload) are unconditionally disabled with if: false, removing unit tests, acceptance tests, and code coverage uploads for all PRs and pushes to main/release branches.

Suggested fix: Remove the CI workflow changes. CI failures on a draft POC branch are acceptable; blanket if: false is unnecessary.

@fullsend-ai-review fullsend-ai-review Bot Aug 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] scope-creep

Disabling all CI checks goes beyond the stated intent of adding a dummy task, pipeline, and ITS for EC-2011 POC. CI disabling is a separate concern from adding test pipeline artifacts.

Suggested fix: Remove the if: false additions from the CI workflow files.

@fullsend-ai-review fullsend-ai-review Bot Aug 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] CI-coverage-regression

All three jobs (Test, Acceptance, Upload) are disabled with if: false, removing unit test, integration test, and acceptance test CI gates for PRs targeting main and release branches. If merged, PRs to main would lose test and coverage CI signal.

Suggested fix: Use branch-scoped conditions (e.g., if: github.head_ref != 'poc-branch-name') or keep these changes out of the PR.

@fullsend-ai-review fullsend-ai-review Bot Aug 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] scope-creep

Disabling all CI jobs (tests, coverage, CodeQL) goes beyond the stated scope of 'add dummy task, pipeline, and ITS.' This represents significant scope expansion.

Suggested fix: Remove the CI-disabling changes or use branch-level workflow filtering.

@fullsend-ai-review fullsend-ai-review Bot Aug 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] CI-coverage-regression

Adding if: false unconditionally disables the Test, Acceptance, and Upload jobs. These jobs gate unit tests, acceptance tests, code generation checks, and coverage uploads. If merged, subsequent PRs to main would land without this CI signal.

@fullsend-ai-review fullsend-ai-review Bot Aug 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] CI coverage regression

if: false unconditionally disables the Test, Acceptance, and Upload Coverage jobs for all PRs and pushes to main/release-* branches.

@fullsend-ai-review fullsend-ai-review Bot Aug 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] CI coverage regression

All CI jobs (Test, Acceptance, Coverage Upload, CodeQL, Lint) are unconditionally disabled via if: false across four workflow files. If merged to main, removes all CI signal from the merge gate. The guard is not branch-scoped.

Suggested fix: Scope the skip to the POC branch only, or remove the if: false additions entirely.

@fullsend-ai-review fullsend-ai-review Bot Aug 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] CI coverage regression

All CI jobs across four workflow files (benchmark, checks-codecov, codeql, lint) are unconditionally disabled with 'if: false'. This removes unit tests, acceptance tests, linting, CodeQL security analysis, and coverage uploads for every PR and push to main. If merged, PRs could land without any CI signal.

Suggested fix: Do not merge with 'if: false'. Remove or replace with branch-scoped conditions.

@fullsend-ai-review fullsend-ai-review Bot Aug 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] CI-coverage-regression

Adding if: false unconditionally disables the Test, Acceptance, and Upload jobs for all PRs and pushes to main/release-*. If merged, PRs land on main without any test or coverage signal.

Suggested fix: Use a branch-name condition (e.g., if: github.head_ref != 'reqd-task-its-poc') or remove the CI-disabling changes.

runs-on: ubuntu-latest
steps:
- name: Harden Runner
Expand Down Expand Up @@ -96,6 +97,7 @@ jobs:
retention-days: 1

Acceptance:
if: false # skipped for POC branch
runs-on: ubuntu-latest
steps:
# Disabled until we figure out the "Could not resolve host: github.com" in
Expand Down Expand Up @@ -164,6 +166,7 @@ jobs:

Upload:
name: "Upload Coverage Statistics"
if: false # skipped for POC branch
runs-on: ubuntu-latest
needs: [Test, Acceptance]
steps:
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/codeql.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,7 @@ permissions:

jobs:
analyze:

@fullsend-ai-review fullsend-ai-review Bot Aug 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] CI security checks disabled

CodeQL and all GHA CI quality/security gates are disabled with if: false across benchmark.yaml, checks-codecov.yaml, codeql.yaml, and lint.yaml. This removes all CI test, coverage, lint, and security analysis gates from this branch.

Suggested fix: Use a branch-conditional if instead of if: false, or do not modify these workflow files.

if: false # skipped for POC branch

@fullsend-ai-review fullsend-ai-review Bot Aug 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] CI coverage regression / Security scanning bypass

Adding if: false unconditionally disables CodeQL security analysis for all branches and the weekly schedule, removing automated SAST scanning coverage.

Suggested fix: Scope the condition to the POC branch or do not merge this workflow change to main.

@fullsend-ai-review fullsend-ai-review Bot Aug 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] ci-safety-guard-disabled

CodeQL security scanning is disabled via if: false on the analyze job. If merged, the repository would lose automated SAST for Go code on pushes, pull requests, and scheduled scans.

Suggested fix: Use a branch-conditional guard instead of if: false, or leave the workflow unmodified.

@fullsend-ai-review fullsend-ai-review Bot Aug 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] CI coverage regression

Adding if: false unconditionally disables the CodeQL security analysis job, removing SAST scanning for all PRs and pushes to main plus the weekly scheduled scan. If merged, Go code changes would land without CodeQL security analysis.

Suggested fix: Use a branch-scoped condition or mark PR as draft to prevent accidental merge.

@fullsend-ai-review fullsend-ai-review Bot Aug 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] CI-coverage-regression

The if: false unconditionally disables CodeQL security analysis for all PRs and pushes to main, as well as the weekly scheduled scan.

Suggested fix: Scope the skip condition to this branch only, or remove the CI modification.

@fullsend-ai-review fullsend-ai-review Bot Aug 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] CI-security-regression

Disabling CodeQL removes automated static analysis security scanning for the repository if merged.

Suggested fix: Do not disable CodeQL scanning on the main branch. Use branch-specific conditions or keep changes on a non-protected branch.

@fullsend-ai-review fullsend-ai-review Bot Aug 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] CI coverage regression

The CodeQL security analysis job is unconditionally disabled with if: false. This removes static security scanning for any branch carrying this commit, including the weekly scheduled scan on main.

Suggested fix: Use a branch-conditional guard or avoid modifying shared CI workflows in POC branches.

@fullsend-ai-review fullsend-ai-review Bot Aug 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] CI coverage regression

Adding if: false disables the CodeQL security analysis job. This workflow runs on PRs to main, pushes to main, and on a weekly schedule. If merged, it would eliminate static analysis security scanning and the weekly scheduled scan entirely.

Suggested fix: Use a branch-specific condition or keep CI modifications out of the PR entirely.

@fullsend-ai-review fullsend-ai-review Bot Aug 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] CI coverage regression

if: false unconditionally disables CodeQL security analysis. Same accidental-merge risk as the checks-codecov workflow.

Suggested fix: Use a branch-scoped condition or remove this change entirely.

@fullsend-ai-review fullsend-ai-review Bot Aug 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] CI coverage regression

Adding if: false unconditionally disables the CodeQL security analysis job for all triggers including the weekly cron.

Suggested fix: Use a branch-conditional skip or remove this change.

@fullsend-ai-review fullsend-ai-review Bot Aug 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] CI coverage regression

The CodeQL security analysis job is unconditionally disabled with if: false, removing SAST coverage for all PRs, pushes to main, and the scheduled weekly scan.

Suggested fix: Remove this change from the PR.

@fullsend-ai-review fullsend-ai-review Bot Aug 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] CI-coverage-regression

CodeQL security analysis job disabled with if: false, removing static security analysis for all PRs and pushes to main, including scheduled weekly scans.

Suggested fix: Use branch-scoped conditions or keep this change off the PR.

@fullsend-ai-review fullsend-ai-review Bot Aug 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] CI-coverage-regression

Adding if: false unconditionally disables the CodeQL security analysis job. If merged, no CodeQL scanning would run for future PRs, pushes, or the weekly schedule.

@fullsend-ai-review fullsend-ai-review Bot Aug 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] CI coverage regression

if: false disables CodeQL security scanning for all branches and the weekly schedule.

@fullsend-ai-review fullsend-ai-review Bot Aug 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] CI-coverage-regression

Adding if: false disables CodeQL security analysis for all PRs, pushes to main, and the scheduled weekly scan.

Suggested fix: Use a branch-name condition or remove this change.

name: Analyze
runs-on: ubuntu-latest
permissions:
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/lint.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,7 @@ permissions:
jobs:
lint:
name: Lint
if: false # skipped for POC branch

@fullsend-ai-review fullsend-ai-review Bot Aug 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] CI-coverage-regression

Adding if: false unconditionally disables linting for all PRs and pushes. Removes the lint merge gate.

Suggested fix: Use a branch-name condition or remove this change.

runs-on: ubuntu-latest
permissions:
contents: read
Expand Down
240 changes: 0 additions & 240 deletions .tekton/cli-main-pull-request.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -287,32 +287,6 @@ spec:
- name: kind
value: task
resolver: bundles
- name: build-source-image
params:
- name: BINARY_IMAGE
value: "$(tasks.build-image-index.results.IMAGE_URL)"
- name: BINARY_IMAGE_DIGEST
value: "$(tasks.build-image-index.results.IMAGE_DIGEST)"
- name: SOURCE_ARTIFACT
value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
- name: CACHI2_ARTIFACT
value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
runAfter:
- build-image-index
taskRef:
params:
- name: name
value: source-build-oci-ta
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta:0.3@sha256:c7ecd1e518007e31e19188333a17dd3558e222ce2e3b2a484a1e59ec069799cf
- name: kind
value: task
resolver: bundles
when:
- input: $(params.build-source-image)
operator: in
values:
- "true"
- name: build-tekton-bundle
params:
- name: IMAGE
Expand Down Expand Up @@ -365,220 +339,6 @@ spec:
operator: in
values:
- "false"
- matrix:
params:
- name: image-platform
value:
- $(params.build-platforms)
name: clair-scan
params:
- name: image-digest
value: $(tasks.build-image-index.results.IMAGE_DIGEST)
- name: image-url
value: $(tasks.build-image-index.results.IMAGE_URL)
runAfter:
- build-image-index
taskRef:
params:
- name: name
value: clair-scan
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.3.2@sha256:f5b4415db9ac1fba3e11d993a617e0b275d1f0ed2fc669b12c400ed848c39174
- name: kind
value: task
resolver: bundles
when:
- input: $(params.skip-checks)
operator: in
values:
- "false"
- name: ecosystem-cert-preflight-checks
params:
- name: image-url
value: $(tasks.build-image-index.results.IMAGE_URL)
runAfter:
- build-image-index
taskRef:
params:
- name: name
value: ecosystem-cert-preflight-checks
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:4619769705d4999e129b779d7699d89d33c47f7ab80d73ad6e3dcd8a6a4e43a7
- name: kind
value: task
resolver: bundles
when:
- input: $(params.skip-checks)
operator: in
values:
- "false"
- name: sast-snyk-check
params:
- name: image-digest
value: $(tasks.build-image-index.results.IMAGE_DIGEST)
- name: image-url
value: $(tasks.build-image-index.results.IMAGE_URL)
- name: SOURCE_ARTIFACT
value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
- name: CACHI2_ARTIFACT
value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
runAfter:
- build-image-index
taskRef:
params:
- name: name
value: sast-snyk-check-oci-ta
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.5@sha256:b78e9c05c5126613eddee53f2f3534a9b86bfca17d903599f2fa465b7938e241
- name: kind
value: task
resolver: bundles
when:
- input: $(params.skip-checks)
operator: in
values:
- "false"
- name: clamav-scan
params:
- name: image-digest
value: $(tasks.build-image-index.results.IMAGE_DIGEST)
- name: image-url
value: $(tasks.build-image-index.results.IMAGE_URL)
runAfter:
- build-image-index
taskRef:
params:
- name: name
value: clamav-scan
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3.1@sha256:53a02326bfb930ca5ef6bfa7a33acca833d57752f34f3cb79255fe2e25e7d217
- name: kind
value: task
resolver: bundles
when:
- input: $(params.skip-checks)
operator: in
values:
- "false"
matrix:
params:
- name: image-arch
value:
- $(params.build-platforms)
- name: sast-shell-check
params:
- name: image-digest
value: $(tasks.build-image-index.results.IMAGE_DIGEST)
- name: image-url
value: $(tasks.build-image-index.results.IMAGE_URL)
- name: SOURCE_ARTIFACT
value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
- name: CACHI2_ARTIFACT
value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
runAfter:
- build-image-index
taskRef:
params:
- name: name
value: sast-shell-check-oci-ta
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:beb05ae2fad733783b3b17e05871e0eaf527a07c904cf3fb2cb551025007eec1
- name: kind
value: task
resolver: bundles
when:
- input: $(params.skip-checks)
operator: in
values:
- "false"
- name: sast-unicode-check
params:
- name: image-digest
value: $(tasks.build-image-index.results.IMAGE_DIGEST)
- name: image-url
value: $(tasks.build-image-index.results.IMAGE_URL)
- name: SOURCE_ARTIFACT
value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
- name: CACHI2_ARTIFACT
value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT)
runAfter:
- build-image-index
taskRef:
params:
- name: name
value: sast-unicode-check-oci-ta
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.4@sha256:d09f717cb84f0699a531773bc498745deef2c006a81918aa73b3be6d2f4778bd
- name: kind
value: task
resolver: bundles
when:
- input: $(params.skip-checks)
operator: in
values:
- "false"
- name: apply-tags
params:
- name: IMAGE_URL
value: $(tasks.build-image-index.results.IMAGE_URL)
- name: IMAGE_DIGEST
value: $(tasks.build-image-index.results.IMAGE_DIGEST)
runAfter:
- build-image-index
taskRef:
params:
- name: name
value: apply-tags
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.3@sha256:f89a59d4d043fd3c545a9cb5e89b53396f1e04017c6f68da1e50626715c2d423
- name: kind
value: task
resolver: bundles
- name: push-dockerfile
params:
- name: IMAGE
value: $(tasks.build-image-index.results.IMAGE_URL)
- name: IMAGE_DIGEST
value: $(tasks.build-image-index.results.IMAGE_DIGEST)
- name: DOCKERFILE
value: $(params.dockerfile)
- name: CONTEXT
value: $(params.path-context)
- name: SOURCE_ARTIFACT
value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT)
runAfter:
- build-image-index
taskRef:
params:
- name: name
value: push-dockerfile-oci-ta
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.3.1@sha256:ee041e2bdf5638faaca60baa171c3e13927097a0e69ed2172ccf1de5e5ee711a
- name: kind
value: task
resolver: bundles
- name: rpms-signature-scan
params:
- name: image-url
value: $(tasks.build-image-index.results.IMAGE_URL)
- name: image-digest
value: $(tasks.build-image-index.results.IMAGE_DIGEST)
runAfter:
- build-image-index
taskRef:
params:
- name: name
value: rpms-signature-scan
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2.1@sha256:cc5133504ff03909ae970db81a986cb25a5532b2faf62a8ede5c60f28b716f54
- name: kind
value: task
resolver: bundles
when:
- input: $(params.skip-checks)
operator: in
values:
- "false"
workspaces:
- name: git-auth
optional: true
Expand Down
Loading
Loading