feat: onboard FullSend JIRA integration - #324
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Enterprise Run ID: ⛔ Files ignored due to path filters (3)
📒 Files selected for processing (1)
WalkthroughChangesFullsend Jira integration
Estimated code review effort: 3 (Moderate) | ~15–30 minutes Sequence Diagram(s)sequenceDiagram
participant GitHubActions
participant Fullsend
participant Jira
participant GitHubCLI
GitHubActions->>Fullsend: Run Jira poll with credentials and JQL
Fullsend->>Jira: Query matching issues
Jira-->>Fullsend: Return issue records
Fullsend-->>GitHubActions: Write dispatches.json and .fullsend
GitHubActions->>GitHubCLI: Resolve workflows by fullsend-stage marker
GitHubCLI-->>GitHubActions: Return matching workflows
GitHubActions->>GitHubCLI: Dispatch stage workflows with issue metadata
Suggested reviewers: Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error, 1 warning)
✅ Passed checks (13 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: samanthajayasinghe The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
🤖 Finished Review · ✅ Success · Started 11:09 PM UTC · Completed 11:26 PM UTC |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/fullsend-poll-jira.yaml:
- Line 19: Update the actions/checkout step in the workflow to reference a
reviewed full commit SHA instead of the floating v4 tag, while preserving the
existing checkout configuration.
- Line 19: Update the actions/checkout step in the workflow to set
persist-credentials to false and replace the floating `@v4` reference with the
full commit SHA for the selected checkout release.
- Around line 28-42: Add a pinned SAST/SCA scanner action or reusable security
workflow between the “Poll Jira” and “Dispatch agent workflows” steps. Configure
it to scan the checked-out repository and fail the job when vulnerabilities or
scan errors are detected, while preserving the existing dispatch step only after
a successful scan.
- Around line 73-89: Add a workflow with a `workflow_dispatch` trigger and mark
it using `# fullsend-stage: <stage>` so the discovery loop in the dispatcher can
find it. Define dispatch inputs named `event_type`, `source_repo`, and
`event_payload`, matching the values passed by `gh workflow run`; use the
appropriate stage marker expected by the Jira records.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 7fde4b81-670d-4d6a-9c12-a30dcd8e5681
📒 Files selected for processing (1)
.github/workflows/fullsend-poll-jira.yaml
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #324 +/- ##
=======================================
Coverage 65.03% 65.03%
=======================================
Files 23 23
Lines 1570 1570
=======================================
Hits 1021 1021
Misses 471 471
Partials 78 78 🚀 New features to boost your workflow:
|
ReviewFindingsHigh
Medium
Low
Next steps:
Previous runReviewFindingsHigh
Medium
Low
Next steps:
Previous run (2)ReviewFindingsMedium
Low
Next steps:
Previous run (3)ReviewFindingsHigh
Medium
Low
Labels: PR adds new feature: JIRA polling integration workflow Next steps:
|
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
openshift-ci
Bot
added
the
needs-rebase
5d9b69c to
69f620c
Compare
openshift-ci
Bot
removed
the
needs-rebase
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
|
🤖 Review · |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/fullsend-poll-jira.yaml:
- Line 37: Update the JQL generated for the FullSend Jira poll so the label
exclusion condition also matches issues with no labels by grouping the existing
labels-not-in filter with an OR labels-is-EMPTY clause. Apply this in the
generator or template that produces the workflow, preserving the other project,
issue type, and status filters.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 22753c41-081c-4b65-9f27-53eb09531d1c
📒 Files selected for processing (1)
.github/workflows/fullsend-poll-jira.yaml
|
🤖 Review · ❌ Terminated · Started 11:26 PM UTC · Ended 11:45 PM UTC |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
🤖 Finished Review · ✅ Success · Started 11:26 PM UTC · Completed 11:44 PM UTC |
Adds a scheduled GitHub Actions workflow that polls JIRA for issues matching the ocm-agent-operator component in ROSAENG, excluding security-sensitive issues (Vulnerability, Weakness types and security/cve/embargo labels). Closes openshift#323 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
69f620c to
5550879
Compare
|
🤖 Finished Review · ✅ Success · Started 3:01 AM UTC · Completed 3:17 AM UTC Commit: |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
🤖 Review · ❌ Terminated · Started 3:29 AM UTC · Ended 3:46 AM UTC Commit: |
|
@samanthajayasinghe: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
| GH_TOKEN: ${{ github.token }} | ||
| run: | | ||
| gh release download --repo fullsend-ai/fullsend -p 'fullsend_*_linux_amd64.tar.gz' -O - | tar xz | ||
| sudo mv fullsend /usr/local/bin/ |
There was a problem hiding this comment.
[high] supply-chain
Unpinned third-party binary download and execution. The workflow downloads the fullsend binary from fullsend-ai/fullsend GitHub releases using a glob pattern without pinning to a specific version or verifying a checksum/signature. This binary runs with access to JIRA_TOKEN and JIRA_USER_EMAIL secrets. A compromised release could exfiltrate credentials. The existing fullsend.yaml pins its reference with a SHA, making this inconsistency more concerning.
Suggested fix: Pin to a specific release tag (e.g., 'gh release download v0.32.0 --repo fullsend-ai/fullsend') AND verify checksum against a known-good hash before execution.
| done | ||
| if [[ -z "$WORKFLOW_NAME" ]]; then | ||
| echo "::warning::No workflow found for stage ${STAGE}, skipping ${RESOURCE_KEY}" | ||
| continue |
There was a problem hiding this comment.
[medium] injection
GHA workflow command injection via unsanitized RESOURCE_KEY. RESOURCE_KEY is extracted from Jira-sourced data and interpolated directly into a ::warning:: workflow command without sanitization. If a Jira resource_key contains %0A/%0D sequences or :: delimiters, an attacker with write access to the ROSAENG Jira project could inject workflow commands.
Suggested fix: Sanitize RESOURCE_KEY before interpolating into workflow commands by stripping or encoding :: sequences, %0A/%0D, and control characters.
| [[ -f "$wf" ]] || continue | ||
| if grep -qxF "# fullsend-stage: ${STAGE}" "$wf"; then | ||
| WORKFLOW_NAME=$(basename "$wf") | ||
| break |
There was a problem hiding this comment.
[medium] runtime mechanism failure
The dispatch loop searches for workflow files containing a comment matching exactly '# fullsend-stage: ${STAGE}' (grep -qxF), but no existing workflow file in the repository contains any 'fullsend-stage:' comment. This means the dispatch loop will always hit the 'No workflow found' warning and skip every record, making the poll-and-dispatch pipeline a no-op until stage-specific workflow files are added.
Suggested fix: Either add workflow files with '# fullsend-stage: ' comments for each role defined in .fullsend/config.yaml, or document that this is scaffolding that depends on future stage-specific workflow files.
| workflow_dispatch: {} | ||
|
|
||
| permissions: | ||
| actions: write |
There was a problem hiding this comment.
[low] permission-expansion
New workflow grants actions:write permission on a schedule trigger. While needed for gh workflow run dispatches and consistent with the existing fullsend.yaml (which has even broader permissions), noted for awareness.
| ISSUE_ID=$(echo "$record" | jq -r '.iid // 0') | ||
|
|
||
| ISSUE_KEY="${RESOURCE_KEY#issue-}" | ||
| ISSUE_URL="${JIRA_BASE_URL}/browse/${ISSUE_KEY}" |
There was a problem hiding this comment.
[low] error-handling-gap
ISSUE_ID is extracted with jq -r '.iid // 0' and passed via --argjson. If .iid holds a non-numeric value, --argjson will fail to parse it, causing the script to abort under set -euo pipefail and skipping all remaining dispatches in the batch.
Suggested fix: Use --arg instead of --argjson if the downstream consumer can accept a string, or add explicit type coercion.
|
🤖 Finished Review · ✅ Success · Started 3:29 AM UTC · Completed 3:45 AM UTC Commit: |
2 participants
Summary
.github/workflows/fullsend-poll-jira.yaml) that polls JIRA every 5 minutes forocm-agent-operatorissuesPrerequisites
The following secrets/variables must be configured in the repo (Settings > Secrets and variables > Actions):
JIRA_TOKENJIRA_USER_EMAILJIRA_BASE_URLhttps://issues.redhat.com)Test plan
workflow_dispatchand confirm it runs without errorsCloses #323
🤖 Generated with Claude Code
Summary by CodeRabbit