quay-dast: migrate to in-cluster RapiDAST for Quay 3.17#79693
quay-dast: migrate to in-cluster RapiDAST for Quay 3.17#79693LiZhang19817 wants to merge 2 commits into
Conversation
…Quay 3.17 Replace the legacy ZAP-based DAST step with the quay-rapidast scripts that deploy RapiDAST as Kubernetes Jobs. Update the test config for Quay 3.17 on OCP 4.21 with AWS S3 storage and FBC operator catalog. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
WalkthroughThis PR upgrades the Quay DAST testing infrastructure from OpenShift 4.17 to 4.21, consolidates multiple scheduled test jobs into a single ChangesQuay DAST Test Infrastructure Update
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Suggested labels
Suggested reviewers
🚥 Pre-merge checks | ✅ 12✅ Passed checks (12 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: LiZhang19817 The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
|
[REHEARSALNOTIFIER]
Prior to this PR being merged, you will need to either run and acknowledge or opt to skip these rehearsals. Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@ci-operator/step-registry/quay-tests/test-quay-dast/quay-tests-test-quay-dast-commands.sh`:
- Line 28: The cp invocation using the glob "*-scan.yaml" can expand to a name
starting with a dash and be parsed as an option; update the cp command that
writes to ARTIFACT_DIR so it protects against option-like filenames by adding
the POSIX option terminator and prefixing the glob with ./ (i.e., use cp with --
and ./*-scan.yaml to ensure filenames like "-scan.yaml" are treated as paths
rather than flags), keeping the original 2>/dev/null || true best-effort
behavior; locate the cp line referencing "*-scan.yaml" and ARTIFACT_DIR to make
this change.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 0e9c1d93-2e18-4e82-ab27-cb456f0735b7
⛔ Files ignored due to path filters (3)
ci-operator/jobs/quay/quay-tests/quay-quay-tests-master-periodics.yamlis excluded by!ci-operator/jobs/**ci-operator/jobs/quay/quay-tests/quay-quay-tests-master-postsubmits.yamlis excluded by!ci-operator/jobs/**ci-operator/jobs/quay/quay-tests/quay-quay-tests-master-presubmits.yamlis excluded by!ci-operator/jobs/**
📒 Files selected for processing (3)
ci-operator/config/quay/quay-tests/quay-quay-tests-master__quay-dast.yamlci-operator/step-registry/quay-tests/test-quay-dast/quay-tests-test-quay-dast-commands.shci-operator/step-registry/quay-tests/test-quay-dast/quay-tests-test-quay-dast-ref.yaml
| fi | ||
| bash generate-quay-config ./quay-credentials.yaml | ||
|
|
||
| cp *-scan.yaml "${ARTIFACT_DIR}/" 2>/dev/null || true |
There was a problem hiding this comment.
Prefix the glob before copying scan artifacts.
*-scan.yaml can expand to an option-like filename such as -scan.yaml, which cp will parse as a flag. Because this command is best-effort, that failure gets hidden by || true and silently drops the artifact.
Proposed fix
-cp *-scan.yaml "${ARTIFACT_DIR}/" 2>/dev/null || true
+cp -- ./*-scan.yaml "${ARTIFACT_DIR}/" 2>/dev/null || true📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| cp *-scan.yaml "${ARTIFACT_DIR}/" 2>/dev/null || true | |
| cp -- ./*-scan.yaml "${ARTIFACT_DIR}/" 2>/dev/null || true |
🧰 Tools
🪛 Shellcheck (0.11.0)
[info] 28-28: Use ./glob or -- glob so names with dashes won't become options.
(SC2035)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@ci-operator/step-registry/quay-tests/test-quay-dast/quay-tests-test-quay-dast-commands.sh`
at line 28, The cp invocation using the glob "*-scan.yaml" can expand to a name
starting with a dash and be parsed as an option; update the cp command that
writes to ARTIFACT_DIR so it protects against option-like filenames by adding
the POSIX option terminator and prefixing the glob with ./ (i.e., use cp with --
and ./*-scan.yaml to ensure filenames like "-scan.yaml" are treated as paths
rather than flags), keeping the original 2>/dev/null || true best-effort
behavior; locate the cp line referencing "*-scan.yaml" and ARTIFACT_DIR to make
this change.
|
/pj-rehearse periodic-ci-quay-quay-tests-master-quay-dast-quay-dast-test-quay317 |
|
@LiZhang19817: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
@LiZhang19817: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
1 participant
Summary
quay-rapidastin-cluster RapiDAST framework for Quay 3.17quay-dast-test-quay317periodic jobquay-tests-test-quay-dastto use the in-cluster scanning scripts (generate-quay-config,run-quay-scan) instead of running ZAP directlyquay-tests-qbo-qe-test,quay-tests-cso-qe-test) to the DAST pipelineaws-qetoaws-quay-qeTest plan
make update(done locally, no errors)🤖 Generated with Claude Code