OPCT-403: rebase release-0.6 from main for v0.6.6 release - #92
Merged
openshift-merge-bot[bot] merged 4 commits intoJul 24, 2026
Merged
Conversation
…data cleaning (#88) ## Summary - Embed [must-gather-clean](https://github.com/openshift/must-gather-clean) v0.0.5 in the artifacts-collector plugin image - Run it against must-gather directory (omit Secrets/MachineConfig, redact sha256~ tokens and JWTs) before packing - Run it against e2e metadata tar.gz archives (redact sha256~ tokens and JWTs) before final packing - Falls back to existing sed-based cleaning if must-gather-clean fails This prevents leaktk-gcs-filter from removing OPCT CI archives from GCS. The bulk of findings (3070 of 3157) are sha256~ OAuth tokens inside `artifacts_e2e-metadata-*.tar.gz` from openshift-tests output. Verified locally: must-gather-clean with regex config reduces sha256~ findings in e2e metadata from 1212 to 0. Related: redhat-openshift-ecosystem/opct#223 (non-nested scanner improvements, defense in depth) ## Test plan - [ ] Build artifacts-collector image with changes - [ ] Run must-gather-clean against extracted e2e metadata, confirm sha256~ count drops to 0 - [ ] Run must-gather-clean against extracted must-gather, confirm Secrets/MachineConfig omitted - [ ] Run leaktk scan against cleaned archive, confirm 0 findings - [ ] Full OPCT run on a cluster to verify no regressions /cc @mtulio 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
…her (#89) ## Summary - Add mco-sanitize to the artifacts-collector plugin to redact pull secrets and JWTs from machineconfig ignition configs in must-gather - Same tool CI gather-must-gather step uses ## Root Cause leaktk-gcs-filter was redacting the entire OPCT archive (76 bytes) because machineconfigs (00-master.yaml, 00-worker.yaml) inside the OPCT must-gather contained real pull secrets and JWTs in the ignition config. CI standalone must-gather.tar in the same job was NOT redacted because the gather-must-gather step runs mco-sanitize after collection. OPCT artifacts-collector was missing this step. Evidence from same CI job (2076734326464057344): - Standalone must-gather 00-master.yaml (17 KB): _REDACTED: This field has been redacted - OPCT must-gather 00-master.yaml (151 KB): real auths with base64 registry credentials leaktk self-service form confirmed 25 findings, 6 from machineconfigs (the trigger). ## Changes ### artifacts-collector/Containerfile - New build stage to download mco-sanitize binary (16 MB) from CI mirror - COPY into main image at /usr/bin/mco-sanitize ### artifacts-collector/collector.sh - Run mco-sanitize on must-gather directory after sed and before must-gather-clean - Fallback to manual REDACTED if mco-sanitize fails (same pattern as CI) ## Verification Needs integration test: run OPCT with this image, retrieve archive, run leaktk scan - machineconfig findings should be 0. Jira: https://redhat.atlassian.net/browse/OPCT-428 --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
## Summary - Bump tools image from v0.5.0 to v0.6.0 (includes mco-sanitize from PR #89) - Bump Fedora base from 41 to 42 to fix security vulnerabilities (per Marco request) - Bump tools/VERSION to v0.6.0 Tools image v0.6.0 already built and pushed to quay.io/opct/tools:v0.6.0 Fixes CI build failure from PR #89 merge: https://github.com/redhat-openshift-ecosystem/provider-certification-plugins/actions/runs/29445777176 --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Fix CI release-latest build failure on arm64. The tools:v0.6.0 arm64 image does not have mco-sanitize (not published for aarch64). Use wildcard glob so COPY succeeds silently on arm64. collector.sh already handles the missing binary with manual redaction fallback. Fixes: https://github.com/redhat-openshift-ecosystem/provider-certification-plugins/actions/runs/29516430669 Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Collaborator
|
/lgtm |
Collaborator
|
/approve |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: vr4manta The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Rebase release-0.6 from main to include OPCT-428 fixes for v0.6.6 release.
New commits since v0.6.5
Fixes: https://redhat.atlassian.net/browse/OPCT-403
Epic: https://redhat.atlassian.net/browse/OPCT-421
🤖 Generated with Claude Code