Conversation
…ckerfile.ci Add GitHub Actions infrastructure for running Cypress E2E tests on a persistent (hot) OpenShift cluster via ARC self-hosted runners: Workflows: - hot-cluster-e2e.yml: entry point with PR gating (fork trust via author_association or ok-to-test label), cluster health check - hot-cluster-e2e-run.yml: build plugin image to ttl.sh, provision test environment via ci-env-controller, run Cypress, collect diagnostics, tear down Composite actions: - ci-env-request: create trigger ConfigMap, wait for environment ready - ci-env-release: signal teardown, wait for cleanup, delete ConfigMap Docker: - Dockerfile.ci: multi-stage build using public UBI9 base images (not registry.ci.openshift.org which requires Prow auth) - .dockerignore: exclude CI/test files from image builds FIPS cluster support: - OPENSSL_FORCE_FIPS_MODE=0 and GOLANG_FIPS=0 for runner and oc CLI - KUBECONFIG set to writable path for non-root runners - oc CLI downloaded to RUNNER_TEMP on each job Depends on ci-scripts (openshift#489), ci-test-stack (openshift#490), ci-env-controller (openshift#491). Jira: OCPNETUI-56 Co-authored-by: Cursor <cursoragent@cursor.com>
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
openshift-ci-robot
added
the
jira/valid-reference
|
@lkladnit: This pull request references OCPNETUI-56 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.1.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: Repository: openshift/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Advanced Run ID: Comment |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: lkladnit The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
|
@lkladnit: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
| @@ -0,0 +1,18 @@ | |||
| FROM registry.access.redhat.com/ubi9/nodejs-18:latest AS build | |||
There was a problem hiding this comment.
Is it possible to re-use the image build for PROW by adding another step i.e. as it's done with existing steps. The main advantage would be to use the same base image as PROW and ART
If we need to run with a different image then let's:
- use image that already contains nginx
- pin version for both builder and runtime images
- use similar build commands as the production Dockerfile
CC: @sjd78
| @@ -0,0 +1,17 @@ | |||
| node_modules | |||
There was a problem hiding this comment.
adding the dockerignore is a very good idea! I'm not sure if the scope is right.
I'd rather keep the eslint and prettier ignore list. Not sure about git.
I.e. check https://github.com/konveyor/tackle2-ui/blob/main/.dockerignore and https://github.com/kubevirt-ui/kubevirt-plugin/blob/main/.dockerignore
| gate-pr: | ||
| name: Gate PR | ||
| if: >- | ||
| github.event_name == 'workflow_dispatch' || |
There was a problem hiding this comment.
IMHO we could simplify the conditions:
- manual workflow dispatch should be assigned to a user - so we can merge it with user checks
- not sure if same repo check alone is sufficient - we can use it as supplemental though
- author_association is not connected to actual write permissions. Using the permission check seems better.
| name: Hot Cluster E2E | ||
|
|
||
| on: | ||
| pull_request_target: |
There was a problem hiding this comment.
can we use different trigger?
this one is known to create problems - https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target and https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/
| steps: | ||
| - run: echo "PR is authorized for hot-cluster E2E" | ||
|
|
||
| cluster-health-check: |
There was a problem hiding this comment.
why we need that health check?
3 participants
Summary
GitHub Actions infrastructure for running Cypress E2E tests on a persistent (hot) OpenShift cluster via ARC self-hosted runners.
Workflows
hot-cluster-e2e.ymlhot-cluster-e2e-run.ymlComposite actions
ci-env-requestci-env-releaseDocker
Dockerfile.ci.dockerignoreFIPS cluster support
RHOS clusters with FIPS enabled cause segfaults in both the .NET-based GitHub Actions runner and the Go-based
ocCLI. Workarounds applied:OPENSSL_FORCE_FIPS_MODE=0for the runner processGOLANG_FIPS=0foroccommandsKUBECONFIG=/tmp/kubeconfigfor non-root writable pathCluster setup prerequisites
See
ci-scripts/README.md(from #489) for RHOS cluster preparation steps (ARC controller, runner scale set, ci-env-controller).Depends on #489 (ci-scripts), #490 (ci-test-stack), #491 (ci-env-controller).
Jira: OCPNETUI-56
Test plan
Made with Cursor