feat: onboard FullSend JIRA integration - #324
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughChangesFullsend Jira integration
Estimated code review effort: 3 (Moderate) | ~15–30 minutes Sequence Diagram(s)sequenceDiagram
participant GitHubActions
participant Fullsend
participant Jira
participant GitHubCLI
GitHubActions->>Fullsend: Run Jira poll with credentials and JQL
Fullsend->>Jira: Query matching issues
Jira-->>Fullsend: Return issue records
Fullsend-->>GitHubActions: Write dispatches.json and .fullsend
GitHubActions->>GitHubCLI: Resolve workflows by fullsend-stage marker
GitHubCLI-->>GitHubActions: Return matching workflows
GitHubActions->>GitHubCLI: Dispatch stage workflows with issue metadata
Suggested reviewers: Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error, 1 warning)
✅ Passed checks (13 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
🤖 Finished Review · ✅ Success · Started 11:09 PM UTC · Completed 11:26 PM UTC |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/fullsend-poll-jira.yaml:
- Line 19: Update the actions/checkout step in the workflow to reference a
reviewed full commit SHA instead of the floating v4 tag, while preserving the
existing checkout configuration.
- Line 19: Update the actions/checkout step in the workflow to set
persist-credentials to false and replace the floating `@v4` reference with the
full commit SHA for the selected checkout release.
- Around line 28-42: Add a pinned SAST/SCA scanner action or reusable security
workflow between the “Poll Jira” and “Dispatch agent workflows” steps. Configure
it to scan the checked-out repository and fail the job when vulnerabilities or
scan errors are detected, while preserving the existing dispatch step only after
a successful scan.
- Around line 73-89: Add a workflow with a `workflow_dispatch` trigger and mark
it using `# fullsend-stage: <stage>` so the discovery loop in the dispatcher can
find it. Define dispatch inputs named `event_type`, `source_repo`, and
`event_payload`, matching the values passed by `gh workflow run`; use the
appropriate stage marker expected by the Jira records.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 7fde4b81-670d-4d6a-9c12-a30dcd8e5681
📒 Files selected for processing (1)
.github/workflows/fullsend-poll-jira.yaml
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #324 +/- ##
=======================================
Coverage 65.39% 65.39%
=======================================
Files 23 23
Lines 1598 1598
=======================================
Hits 1045 1045
Misses 473 473
Partials 80 80 🚀 New features to boost your workflow:
|
ReviewFindingsMedium
Low
Previous runReviewFindingsMedium
Low
Next steps:
Previous run (2)ReviewFindingsHigh
Medium
Low
Next steps:
Previous run (3)ReviewFindingsHigh
Medium
Low
Next steps:
Previous run (4)ReviewFindingsMedium
Low
Next steps:
Previous run (5)ReviewFindingsHigh
Medium
Low
Labels: PR adds new feature: JIRA polling integration workflow Next steps:
|
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
openshift-ci
Bot
added
the
needs-rebase
5d9b69c to
69f620c
Compare
openshift-ci
Bot
removed
the
needs-rebase
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
|
🤖 Review · |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/fullsend-poll-jira.yaml:
- Line 37: Update the JQL generated for the FullSend Jira poll so the label
exclusion condition also matches issues with no labels by grouping the existing
labels-not-in filter with an OR labels-is-EMPTY clause. Apply this in the
generator or template that produces the workflow, preserving the other project,
issue type, and status filters.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 22753c41-081c-4b65-9f27-53eb09531d1c
📒 Files selected for processing (1)
.github/workflows/fullsend-poll-jira.yaml
|
🤖 Review · ❌ Terminated · Started 11:26 PM UTC · Ended 11:45 PM UTC |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
🤖 Finished Review · ✅ Success · Started 11:26 PM UTC · Completed 11:44 PM UTC |
69f620c to
5550879
Compare
|
🤖 Finished Review · ✅ Success · Started 3:01 AM UTC · Completed 3:17 AM UTC Commit: |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
🤖 Review · ❌ Terminated · Started 3:29 AM UTC · Ended 3:46 AM UTC Commit: |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
🤖 Finished Review · ✅ Success · Started 3:29 AM UTC · Completed 3:45 AM UTC Commit: |
|
🤖 Finished Review · ✅ Success · Started 5:29 AM UTC · Completed 5:48 AM UTC Commit: |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
🤖 Review · Commit: |
ee32bfe to
9342d73
Compare
|
🤖 Review · Commit: |
Adds a scheduled GitHub Actions workflow that polls JIRA for issues matching the ocm-agent-operator component in ROSAENG, excluding security-sensitive issues (Vulnerability, Weakness types and security/cve/embargo labels). Closes openshift#323 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Pin actions/checkout to a full commit SHA (v4.2.2) and set persist-credentials: false (supply-chain / artipacked) - Pin the fullsend binary to v0.36.0 and checksum-verify the download before it is granted the Jira credentials (supply-chain) - Fix the JQL label filter so issues with no labels are included - Validate every Jira-derived value (stage, event_type, issue key) against strict allowlists before it reaches a gh CLI arg, URL, or workflow command, blocking GHA command injection - Drop the grep -x flag so stage markers match at any indentation - Coerce iid with tonumber, strip a trailing slash from JIRA_BASE_URL, validate JIRA_BASE_URL is set, and don't let one dispatch failure abort the remaining records - Add a header comment block, YAML doc marker, and lowercase locals for consistency with fullsend.yaml Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
9342d73 to
8689dbd
Compare
|
🤖 Finished Review · ✅ Success · Started 6:22 AM UTC · Completed 6:37 AM UTC Commit: |
Superseded by updated review
| issue_key="${resource_key#issue-}" | ||
|
|
||
| # Validate every Jira-derived value against a strict allowlist before | ||
| # it reaches a gh CLI arg, URL, or workflow command. This fails |
There was a problem hiding this comment.
[low] edge-case
When a dispatch record has a null or missing iid field, the expression (.iid // 0) | tonumber silently falls back to 0, producing issue.number = 0 in the event payload. While issue_key is the primary routing identifier and is validated, passing an invalid numeric ID to downstream consumers may cause confusion.
Suggested fix: Add a validation check that skips the record (with a warning) if issue_id is 0 after coercion.
| # "# fullsend-stage: <stage>" marker line at any indentation. | ||
| workflow_name="" | ||
| for wf in .github/workflows/*.yml .github/workflows/*.yaml; do | ||
| [[ -f "$wf" ]] || continue |
There was a problem hiding this comment.
[low] logic-error
grep -qF performs a fixed-string substring match on the fullsend-stage marker. If two workflow files contain stage markers with a prefix relationship (e.g., plan and plan-review), the shorter stage name could incorrectly match the longer one. Currently no consumer workflows exist, making this theoretical.
Suggested fix: Use a regex with a word boundary or end-of-line anchor for exact matching.
| gh release download "$FULLSEND_VERSION" --repo fullsend-ai/fullsend \ | ||
| -p "$asset" -p checksums.txt | ||
| sha256sum --ignore-missing -c checksums.txt | ||
| tar xzf "$asset" fullsend |
There was a problem hiding this comment.
[low] supply-chain
The fullsend binary checksum verification downloads checksums.txt from the same GitHub release as the binary. This guards against download corruption but not upstream compromise. Consistent with the existing trust model (the repo already trusts fullsend-ai/fullsend via SHA-pinned reusable workflow).
Suggested fix: Consider pinning a known-good SHA256 hash directly in the workflow rather than relying on the release-hosted checksums.txt.
fullsend-ai-review
Bot
added
the
requires-manual-review
|
@samanthajayasinghe: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/approve |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: krishvoor, samanthajayasinghe The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
3 participants
Summary
.github/workflows/fullsend-poll-jira.yaml) that polls JIRA every 5 minutes forocm-agent-operatorissuesPrerequisites
The following secrets/variables must be configured in the repo (Settings > Secrets and variables > Actions):
JIRA_TOKENJIRA_USER_EMAILJIRA_BASE_URLhttps://issues.redhat.com)Test plan
workflow_dispatchand confirm it runs without errorsCloses #323
🤖 Generated with Claude Code
Summary by CodeRabbit