chore(ansible): add RHEL 9.6 and RHEL 10 ppc64le boot images #3390
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
|
|
@@ -54,10 +54,16 @@ | |||||
| become: "{{ runtime_as_root }}" | ||||||
| shell: | ||||||
| cmd: | | ||||||
| mkdir -p ~/.docker/ | ||||||
| if [[ -f "${XDG_RUNTIME_DIR:-}/containers/auth.json" ]]; then | ||||||
| AUTH_FILE="${XDG_RUNTIME_DIR:-}/containers/auth.json" | ||||||
| elif [[ -f "/run/containers/0/auth.json" ]]; then | ||||||
|
Comment on lines
+58
to
+60
There was a problem hiding this comment. 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/sh
set -eu
readlink -f /bin/sh 2>/dev/null || true
/bin/sh -c '[[ -f /etc/hosts ]]'Repository: stackrox/collector Length of output: 170 🏁 Script executed: #!/bin/sh
set -eu
echo "Relevant task snippet:"
sed -n '1,130p' ansible/roles/run-test-target/tasks/test-docker.yml
echo
echo "Ansible shell usages in target file:"
rg -n "executable:|/bin/(sh|bash)|shell:" ansible/roles/run-test-target/tasks/test-docker.yml
echo
echo "Target file size:"
wc -l ansible/roles/run-test-target/tasks/test-docker.ymlRepository: stackrox/collector Length of output: 4640 🌐 Web query:
💡 Result: The Ansible shell module, specifically Citations:
🌐 Web query:
💡 Result: In Ubuntu 24.04, the system shell /bin/sh is a symbolic link to dash (the Debian Almquist Shell) [1][2][3]. Dash does not support the [[... ]] keyword, which is an extension found in Bash, KornShell (ksh), and Zsh [4][5][6][7]. If a script uses [[... ]] while being executed by /bin/sh (dash), the following behavior occurs: 1. Failure to Recognize Keyword: Dash treats [[ as a literal command name rather than a shell keyword [8][5][6]. It attempts to locate a command named [[ in the system's PATH [8]. 2. Execution Result: Since the command [[ is not found in the PATH, the shell typically reports that the command was not found (e.g., "[[: not found") and returns a non-zero exit status [8]. If the script logic relies on the exit status of this "command," it will fail as expected, though sometimes developers mistakenly interpret the lack of a syntax error as successful execution [8]. 3. Portability Requirement: To ensure scripts are portable and compatible with /bin/sh, you must use the standard [... ] (test) command [2][5][7]. When converting [[... ]] to the portable [... ] syntax, keep the following differences in mind: - Quoting: Always quote variables inside [ ] to prevent word splitting and globbing issues (e.g., [ "$var" = "value" ]) [5][9][10]. - Logical Operators: [ ] uses -a and -o for AND/OR, or preferably, the shell's && and || operators outside of the brackets (e.g., [ condition1 ] && [ condition2 ]) [9][11]. - Equality: Use the single = operator instead of the == extension supported by Bash [2][5]. Citations:
Use shell syntax supported by Ansible’s default shell. Ansible 🤖 Prompt for AI AgentsSource: Path instructions |
||||||
| AUTH_FILE="/run/containers/0/auth.json" | ||||||
| else | ||||||
| echo >&2 "No valid auth.json file found" | ||||||
| exit 1 | ||||||
| fi | ||||||
| cp "${AUTH_FILE}" ~/.docker/config.json | ||||||
|
There was a problem hiding this comment. 🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== locate relevant files =="
git ls-files | rg '(^|/)ansible/(roles/(run-test-target/tasks/test-docker\.yml|provision-vm/tasks/garden\.yml)|roles/.*)\.yml$' | head -200
echo
echo "== test-docker.yml outline/size =="
wc -l ansible/roles/run-test-target/tasks/test-docker.yml
sed -n '1,140p' ansible/roles/run-test-target/tasks/config-docker.yml 2>/dev/null || true
sed -n '1,140p' ansible/roles/run-test-target/tasks/test-docker.yml
echo
echo "== garden.yml relevant =="
rg -n -C 5 'config\.json|quay|auth|docker|containers' ansible/roles/provision-vm/tasks/garden.yml
sed -n '100,150p' ansible/roles/provision-vm/tasks/garden.yml
echo
echo "== search config.json lifecycle =="
rg -n -C 3 '~?/\.docker/config\.json|COPY_FILE|creates|quay\.io|XDG_RUNTIME_DIR|AUTH_FILE' ansible/rolesRepository: stackrox/collector Length of output: 14276 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== dependency pins for Ansible =="
git ls-files | rg '(^|/)(ansible|requirements|environment|galaxy|defaults).*ya?ml$|(^|/)galaxy_install|ansible.cfg' | sort
for f in $(git ls-files | rg '(^|/)(galaxy\.(yml|yaml|json)|requirements\.(yml|yaml|json)|galaxy_install\.sh|ansible\.cfg|environment.yml)$'); do
echo "--- $f"
sed -n '1,220p' "$f"
done
echo
echo "== ansible-role ordering / include order =="
rg -n -C 4 'roles/provision-vm|roles/run-test-target|include_tasks|import_tasks|provision-vm|run-test-target' ansible/roles ansible -g '*.yml'
echo
echo "== local ansible behavior probe for shell creates and cp overwrite =="
python3 - <<'PY'
import os, stat, json
from pathlib import Path
tmp = Path('/tmp/coderabbit_config_merge_probe')
tmp.mkdir(exist_ok=True)
(src, dst) = (tmp / 'src_auth.json', tmp / 'dst_config.json')
for p in (src, dst):
p.write_text('{}')
os.chmod(dst, 0o644)
cfg = json.load(src)
print('src=', cfg, 'dst_exists=', dst.exists(), 'dst_stat=', oct(stat.S_IMODE(dst.stat().st_mode)))
with open(dst, 'w') as f:
json.dump(cfg, f)
print('dst=', json.load(dst))
src = tmp / 'src_auth2.json'
dst = tmp / 'dst_config2.json'
src.write_text('{"auths": {"registry.example.test": {"auth": "a"}}}')
dst.write_text('{"auths": {"quay.io": {"auth": "q"}}}')
with open(dst, 'w') as f:
json.dump(json.load(src), f)
print('after overwrite dst=', json.load(dst))
PYRepository: stackrox/collector Length of output: 28809 🌐 Web query:
💡 Result: The Ansible shell module (ansible.builtin.shell) includes two specific parameters, creates and removes, designed to manage idempotent execution by performing pre-checks on the destination [1][2][3]. The creates parameter takes a filename as an argument [1][2]. If the specified file already exists, the task will be skipped [2][3]. This is useful for ensuring a command is only run when a specific output file or artifact has not yet been generated [3]. The removes parameter also takes a filename as an argument [1][2]. In this case, if the specified file does not exist, the task will be skipped [1][2]. This is useful for scenarios where you only want to run a command if a certain prerequisite file is present or if you want to ensure the command only executes if a previous process has not yet removed a file [1][2]. These options allow the shell module to behave more like a declarative module by checking the state of the target system before executing the shell command [3]. Citations:
Merge Podman auth into the Docker config instead of copying it as a single file.
🤖 Prompt for AI AgentsSource: Path instructions 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== locate files =="
git ls-files | rg 'ansible/roles/(run-test-target|provision-vm)/tasks/(test-docker|garden)\.yml' || true
echo "== target file context =="
if [ -f ansible/roles/run-test-target/tasks/test-docker.yml ]; then
nl -ba ansible/roles/run-test-target/tasks/test-docker.yml | sed -n '1,110p'
fi
echo "== upstream config context =="
if [ -f ansible/roles/provision-vm/tasks/garden.yml ]; then
nl -ba ansible/roles/provision-vm/tasks/garden.yml | sed -n '100,145p'
fi
echo "== cp behavior for permissions =="
tmp="$(mktemp -d)"
mkdir -p "$tmp/src" "$tmp/dst"
printf '{}' > "$tmp/src/config.json"
printf '{}' > "$tmp/dst/config.json"
chmod 0644 "$tmp/dst/config.json"
ls -l "$tmp/src/config.json" "$tmp/dst/config.json"
cp "$tmp/src/config.json" "$tmp/dst/config.json"
ls -l "$tmp/dst/config.json"
install -m 0600 "$tmp/src/config.json" "$tmp/dst/config.json"
ls -l "$tmp/dst/config.json"
rm -rf "$tmp"Repository: stackrox/collector Length of output: 337 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== target file context =="
cat -n ansible/roles/run-test-target/tasks/test-docker.yml | sed -n '1,110p'
echo "== upstream config context =="
cat -n ansible/roles/provision-vm/tasks/garden.yml | sed -n '100,145p'
echo "== cp behavior for permissions =="
tmp="$(mktemp -d)"
mkdir -p "$tmp/src" "$tmp/dst"
printf '{}' > "$tmp/src/config.json"
printf '{}' > "$tmp/dst/config.json"
chmod 0644 "$tmp/dst/config.json"
stat -c '%a' "$tmp/dst/config.json"
cat "$tmp/src/config.json" "$tmp/dst/config.json" > /tmp/old_dupe; cp "$tmp/src/config.json" "$tmp/dst/config.json"
stat -c '%a' "$tmp/dst/config.json"
install -m 0600 "$tmp/src/config.json" "$tmp/dst/config.json"
stat -c '%a' "$tmp/dst/config.json"
rm -rf "$tmp"Repository: stackrox/collector Length of output: 6183 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== copy/permission tools =="
command -v python3 || true
command -v perl || true
command -v install || true
echo "== python copy semantics probe =="
python3 - <<'PY'
import os, tempfile, shutil
old_umask = os.umask(0o022)
try:
with tempfile.TemporaryDirectory() as tmp:
os.makedirs(os.path.join(tmp, "src"))
os.makedirs(os.path.join(tmp, "dst"))
src = os.path.join(tmp, "src", "config.json")
dst = os.path.join(tmp, "dst", "config.json")
with open(dst, "w") as f:
f.write("{}")
os.chmod(dst, 0o644)
with open(src, "w") as f:
f.write("{}")
initial = oct(os.stat(dst).st_mode)[-4:]
shutil.copy(src, dst)
after = oct(os.stat(dst).st_mode)[-4:]
print(f"io_error={False}")
print(f"initial_perm={initial}")
print(f"after_perm={after}")
finally:
os.umask(old_umask)
PY
echo "== install -m 0600 available =="
if command -v install >/dev/null 2>&1; then
python3 - <<'PY'
import os, tempfile, shutil
old_umask = os.umask(0o022)
try:
with tempfile.TemporaryDirectory() as tmp:
os.makedirs(os.path.join(tmp, "src"))
os.makedirs(os.path.join(tmp, "dst"))
src = os.path.join(tmp, "src", "config.json")
dst = os.path.join(tmp, "dst", "config.json")
with open(dst, "w") as f:
f.write("{}")
os.chmod(dst, 0o644)
with open(src, "w") as f:
f.write("{}")
shutil.copy(src, dst)
print(f"pre_install_perm={oct(os.stat(dst).st_mode)[-4:]}")
os.system(f"install -m 0600 {src} {dst}")
print(f"post_install_perm={oct(os.stat(dst).st_mode)[-4:]}")
finally:
os.umask(old_umask)
PY
fiRepository: stackrox/collector Length of output: 330 Other Reachability: Internal Enforce private permissions on copied registry credentials.
Suggested fix- cp "${AUTH_FILE}" ~/.docker/config.json
+ install -m 0600 "${AUTH_FILE}" ~/.docker/config.json<security_category:sensitive_data_exposure> 📝 Committable suggestion
Suggested change
🤖 Prompt for AI AgentsSource: Path instructions |
||||||
| creates: ~/.docker/config.json | ||||||
| when: runtime_command == "podman" | ||||||
|
|
||||||
|
|
||||||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,6 +1,6 @@ | ||
| --- | ||
|
|
||
| # ppc64le VM configuration | ||
| pi_name: "{{ vm_name }}" | ||
| sys_type: s1022 | ||
| proc_type: shared | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
Do not ignore failure of the cockpit state change.
ignore_errors: trueallows provisioning to continue whencockpit.socketwas not stopped or disabled. The collector can then start with the same port conflict that this task is intended to prevent. Tolerate only an explicitly absent unit, and fail on other systemd errors.As per path instructions, focus on major issues impacting performance, readability, maintainability and security and avoid nitpicks.
🤖 Prompt for AI Agents
Source: Path instructions