ROSAENG-61950 | chore: codecov configuration by gdbranco · Pull Request #82027 · openshift/release

gdbranco · 2026-07-16T17:17:21Z

Summary by CodeRabbit

Updates the OpenShift Online rosa-service-log CI workflow (ci-operator/config/openshift-online/rosa-service-log/openshift-online-rosa-service-log-master.yaml) to simplify how secrets/config are staged for unit and integration, and to add Codecov reporting for new coverage (presubmit) and publish-coverage (postsubmit) jobs.
For unit, integration, coverage, and publish-coverage, the workflow now creates /opt/app-root/src/rosa-service-log/secrets, copies /opt/app-root/osl-secrets/* into it, and symlinks both secrets and config into cmd/ocm-service-log, pkg/services, and test/integration before running the respective make targets (make test / make test-integration / make codecov).
Adds coverage and publish-coverage jobs (both in golang-plus) that set GOTOOLCHAIN=go1.25.10, stage secrets/config via the same symlink approach as above, and run make codecov with openshift-online-osl-secrets plus the Codecov token secret (rosa-service-log-codecov mounted at /var/run/codecov-secret); publish-coverage is marked postsubmit: true.
In CI orchestration rehearsal comments, the coverage job rehearsal (pull-ci-openshift-online-rosa-service-log-master-coverage) was requested four times: once for a combined rehearsal of coverage+integration+unit, followed by separate rehearsals for the integration job and unit job (with the unit job requested twice).

openshift-ci · 2026-07-16T17:17:54Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: gdbranco

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~ci-operator/config/openshift-online/rosa-service-log/OWNERS~~ [gdbranco]
~~ci-operator/jobs/openshift-online/rosa-service-log/OWNERS~~ [gdbranco]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

coderabbitai · 2026-07-16T17:18:23Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

Walkthrough

Updates ROSA service log test secret/config wiring and adds coverage and postsubmit publish-coverage CI jobs that run make codecov with Go environment setup and Codecov secrets.

Changes

ROSA service log CI

Layer / File(s)	Summary
Test secret and config wiring `ci-operator/config/openshift-online/rosa-service-log/openshift-online-rosa-service-log-master.yaml`	Updates unit and integration jobs to copy mounted secrets into the repository and symlink shared secret/config paths, removing local fallback-file creation.
Coverage job definitions `ci-operator/config/openshift-online/rosa-service-log/openshift-online-rosa-service-log-master.yaml`	Adds `coverage` and postsubmit `publish-coverage` jobs using `golang-plus`, Go environment variables, the Codecov secret, and `make codecov`.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

openshift/release#82021: Adds matching Codecov coverage and publishing jobs for another OpenShift Online component.

Suggested reviewers: lir10, davidleerh

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title matches the main change: updating Codecov configuration and coverage jobs for rosa-service-log.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR only updates ci-operator YAML; no Ginkgo It/Describe/Context/When titles changed, and the new job names are static.
Test Structure And Quality	✅ Passed	PR only changes ci-operator YAML; no Go/Ginkgo test files were modified, so the test-structure check is not applicable.
Microshift Test Compatibility	✅ Passed	Only CI/job YAML changed; no new Ginkgo tests or test code were added, so MicroShift API compatibility isn’t implicated.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The PR only changes ci-operator job/config YAML; no Go/Ginkgo test files or new It/Describe/Context/When definitions were added.
Topology-Aware Scheduling Compatibility	✅ Passed	Only CI operator/prow job configs changed; no deployment manifests/controllers or scheduling fields (nodeSelector/affinity/topologySpreadConstraints/PDB) were introduced.
Ote Binary Stdout Contract	✅ Passed	PR only edits ci-operator job YAML; no OTE binary process-level code or stdout writers were added.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PR only changes CI job YAML; no new Go/Ginkgo e2e tests or IPv4/public-internet test code were added.
No-Weak-Crypto	✅ Passed	The PR only changes CI YAML and secret wiring; no weak algorithms, custom crypto, or non-constant-time secret/token comparisons are introduced.
Container-Privileges	✅ Passed	Diff only changes secret handling and adds coverage jobs; no privileged, hostPID/network/ipc, SYS_ADMIN, or allowPrivilegeEscalation fields were added.
No-Sensitive-Data-In-Logs	✅ Passed	No new logging of secrets, tokens, PII, hostnames, or customer data; only benign Go version echoes and secret file copying/symlinks were added.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands.}

gdbranco · 2026-07-16T17:20:38Z

/pj-rehearse pull-ci-openshift-online-rosa-service-log-master-coverage

openshift-merge-bot · 2026-07-16T17:20:41Z

@gdbranco: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

gdbranco · 2026-07-16T17:24:22Z

/pj-rehearse pull-ci-openshift-online-rosa-service-log-master-coverage

openshift-merge-bot · 2026-07-16T17:25:39Z

@gdbranco: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@ci-operator/config/openshift-online/rosa-service-log/openshift-online-rosa-service-log-master.yaml`:
- Around line 136-140: Remove the rosa-service-log-codecov secret mount from the
presubmit coverage job configuration near the secrets list, while retaining it
only for the publish-coverage job. Update the coverage job invoked by the
PR-controlled Makefile to use a non-publishing coverage target that does not
require Codecov credentials.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: c5d38f52-cf43-4e03-926a-8ba0a5fcda10

📥 Commits

Reviewing files that changed from the base of the PR and between 3ed1ba2 and b5cbbbf.

⛔ Files ignored due to path filters (2)

ci-operator/jobs/openshift-online/rosa-service-log/openshift-online-rosa-service-log-master-postsubmits.yaml is excluded by !ci-operator/jobs/**
ci-operator/jobs/openshift-online/rosa-service-log/openshift-online-rosa-service-log-master-presubmits.yaml is excluded by !ci-operator/jobs/**

📒 Files selected for processing (1)

ci-operator/config/openshift-online/rosa-service-log/openshift-online-rosa-service-log-master.yaml

gdbranco · 2026-07-16T18:34:34Z

/pj-rehearse pull-ci-openshift-online-rosa-service-log-master-coverage, pull-ci-openshift-online-rosa-service-log-master-integration, pull-ci-openshift-online-rosa-service-log-master-unit

gdbranco · 2026-07-16T18:40:31Z

/pj-rehearse pull-ci-openshift-online-rosa-service-log-master-coverage

openshift-merge-bot · 2026-07-16T18:40:34Z

@gdbranco: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

gdbranco · 2026-07-16T18:40:47Z

/pj-rehearse pull-ci-openshift-online-rosa-service-log-master-integration

openshift-merge-bot · 2026-07-16T18:40:51Z

@gdbranco: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

gdbranco · 2026-07-16T18:40:59Z

/pj-rehearse pull-ci-openshift-online-rosa-service-log-master-unit

openshift-merge-bot · 2026-07-16T18:42:09Z

@gdbranco: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

gdbranco · 2026-07-16T19:03:29Z

/pj-rehearse pull-ci-openshift-online-rosa-service-log-master-unit

openshift-merge-bot · 2026-07-16T19:03:32Z

@gdbranco: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

coderabbitai

♻️ Duplicate comments (1)

ci-operator/config/openshift-online/rosa-service-log/openshift-online-rosa-service-log-master.yaml (1)
133-143: 🔒 Security & Privacy | 🔴 Critical | ⚡ Quick win

Codecov secret still mounted in the presubmit coverage job — exfiltration risk unresolved.

This job has no postsubmit field (defaults to presubmit), so it runs on every PR and executes make codecov from PR-controlled code (Line 136) while rosa-service-log-codecov is mounted at /var/run/codecov-secret (Lines 142-143). A malicious PR's Makefile/tooling can read and exfiltrate the token. This mirrors a previously raised concern: keep the Codecov secret only on publish-coverage, and make coverage run a non-publishing target without the secret.
🔒 Proposed fix
 - as: coverage
   commands: |
     unset GOFLAGS
     export GOPATH=/go
     export PATH="/usr/local/go/bin:/go/bin:${PATH}"
     export HOME=/tmp
     export GOCACHE=$(mktemp -d)
     export GOMODCACHE=$(mktemp -d)
     export GOTOOLCHAIN=go1.25.10
     echo "Go Version: $(go version)"
     mkdir -p /opt/app-root/src/rosa-service-log/secrets
     cp /opt/app-root/osl-secrets/* /opt/app-root/src/rosa-service-log/secrets/
     ln -sfn /opt/app-root/src/rosa-service-log/secrets /opt/app-root/src/rosa-service-log/pkg/services/secrets
-    make codecov
+    make codecov-report  # non-publishing target, no Codecov token required
   container:
     from: golang-plus
   secrets:
   - mount_path: /opt/app-root/osl-secrets
     name: openshift-online-osl-secrets
-  - mount_path: /var/run/codecov-secret
-    name: rosa-service-log-codecov
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@ci-operator/config/openshift-online/rosa-service-log/openshift-online-rosa-service-log-master.yaml`
around lines 133 - 143, Remove the rosa-service-log-codecov secret mount from
the presubmit coverage job and replace make codecov with the non-publishing
coverage target. Keep the Codecov secret available only to the publish-coverage
job, while preserving the existing secret setup required by the coverage job.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Duplicate comments:
In
`@ci-operator/config/openshift-online/rosa-service-log/openshift-online-rosa-service-log-master.yaml`:
- Around line 133-143: Remove the rosa-service-log-codecov secret mount from the
presubmit coverage job and replace make codecov with the non-publishing coverage
target. Keep the Codecov secret available only to the publish-coverage job,
while preserving the existing secret setup required by the coverage job.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 40176bf8-5f7f-444d-b5d1-4cb997ad2350

📥 Commits

Reviewing files that changed from the base of the PR and between b5cbbbf and f86cb34.

⛔ Files ignored due to path filters (2)

ci-operator/jobs/openshift-online/rosa-service-log/openshift-online-rosa-service-log-master-postsubmits.yaml is excluded by !ci-operator/jobs/**
ci-operator/jobs/openshift-online/rosa-service-log/openshift-online-rosa-service-log-master-presubmits.yaml is excluded by !ci-operator/jobs/**

📒 Files selected for processing (1)

ci-operator/config/openshift-online/rosa-service-log/openshift-online-rosa-service-log-master.yaml

gdbranco · 2026-07-16T20:37:48Z

/pj-rehearse pull-ci-openshift-online-rosa-service-log-master-unit

openshift-merge-bot · 2026-07-16T20:37:51Z

@gdbranco: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

gdbranco · 2026-07-16T20:50:10Z

/pj-rehearse pull-ci-openshift-online-rosa-service-log-master-coverage

openshift-merge-bot · 2026-07-16T20:50:13Z

@gdbranco: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

gdbranco · 2026-07-16T20:50:18Z

/pj-rehearse pull-ci-openshift-online-rosa-service-log-master-integration

openshift-merge-bot · 2026-07-16T20:50:21Z

@gdbranco: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

gdbranco · 2026-07-16T20:54:38Z

/pj-rehearse pull-ci-openshift-online-rosa-service-log-master-unit

openshift-merge-bot · 2026-07-16T20:54:41Z

@gdbranco: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

gdbranco · 2026-07-16T21:01:15Z

/pj-rehearse pull-ci-openshift-online-rosa-service-log-master-unit

openshift-merge-bot · 2026-07-16T21:01:17Z

@gdbranco: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

gdbranco · 2026-07-16T21:04:29Z

/pj-rehearse pull-ci-openshift-online-rosa-service-log-master-coverage

openshift-merge-bot · 2026-07-16T21:04:31Z

@gdbranco: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

gdbranco · 2026-07-16T21:04:38Z

/pj-rehearse pull-ci-openshift-online-rosa-service-log-master-integration

openshift-merge-bot · 2026-07-16T21:04:41Z

@gdbranco: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

openshift-ci · 2026-07-16T21:13:59Z

@gdbranco: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/rehearse/openshift-online/rosa-service-log/master/coverage	`b5cbbbf`	link	unknown	`/pj-rehearse pull-ci-openshift-online-rosa-service-log-master-coverage`
ci/rehearse/openshift-online/rosa-service-log/master/integration	`b5cbbbf`	link	unknown	`/pj-rehearse pull-ci-openshift-online-rosa-service-log-master-integration`
ci/rehearse/openshift-online/rosa-service-log/master/unit	`f86cb34`	link	unknown	`/pj-rehearse pull-ci-openshift-online-rosa-service-log-master-unit`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

gdbranco · 2026-07-16T21:15:52Z

/retest

gdbranco · 2026-07-16T22:27:28Z

/pj-rehearse pull-ci-openshift-online-rosa-service-log-master-unit

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 16, 2026

openshift-ci Bot requested review from Lir10 and davidleerh July 16, 2026 17:18

gdbranco force-pushed the chore/rosaeng-61950 branch from 733ea3b to 3ed1ba2 Compare July 16, 2026 17:24

gdbranco force-pushed the chore/rosaeng-61950 branch from 3ed1ba2 to b5cbbbf Compare July 16, 2026 18:27

coderabbitai Bot reviewed Jul 16, 2026

View reviewed changes

Comment thread ...rator/config/openshift-online/rosa-service-log/openshift-online-rosa-service-log-master.yaml

gdbranco force-pushed the chore/rosaeng-61950 branch from b5cbbbf to f86cb34 Compare July 16, 2026 19:02

coderabbitai Bot reviewed Jul 16, 2026

View reviewed changes

gdbranco force-pushed the chore/rosaeng-61950 branch from f86cb34 to db2c31c Compare July 16, 2026 20:37

ROSAENG-61950 | chore: codecov configuration

5b8ada3

gdbranco force-pushed the chore/rosaeng-61950 branch from db2c31c to 5b8ada3 Compare July 16, 2026 20:57

Uh oh!

Conversation

gdbranco commented Jul 16, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

openshift-ci Bot commented Jul 16, 2026

Uh oh!

coderabbitai Bot commented Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

Uh oh!

gdbranco commented Jul 16, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 16, 2026

Uh oh!

gdbranco commented Jul 16, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 16, 2026

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

gdbranco commented Jul 16, 2026

Uh oh!

gdbranco commented Jul 16, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 16, 2026

Uh oh!

gdbranco commented Jul 16, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 16, 2026

Uh oh!

gdbranco commented Jul 16, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 16, 2026

Uh oh!

gdbranco commented Jul 16, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 16, 2026

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

gdbranco commented Jul 16, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 16, 2026

Uh oh!

gdbranco commented Jul 16, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 16, 2026

Uh oh!

gdbranco commented Jul 16, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 16, 2026

Uh oh!

gdbranco commented Jul 16, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 16, 2026

Uh oh!

gdbranco commented Jul 16, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 16, 2026

Uh oh!

gdbranco commented Jul 16, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 16, 2026

Uh oh!

gdbranco commented Jul 16, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 16, 2026

Uh oh!

openshift-ci Bot commented Jul 16, 2026

Uh oh!

gdbranco commented Jul 16, 2026

Uh oh!

gdbranco commented Jul 16, 2026

gdbranco commented Jul 16, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 16, 2026 •

edited

Loading