ci: add gopls and pre-commit plugins to address-review workflow#8702
ci: add gopls and pre-commit plugins to address-review workflow#8702enxebre wants to merge 1 commit into
Conversation
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
|
Please specify an area label DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThe workflow .github/workflows/address-review-comments.yaml now installs local tool dependencies (installs gopls, appends $HOME/go/bin to PATH, and installs pre-commit via pip and appends $HOME/.local/bin). It replaces the previous manual ai-helpers cloning/config with claude CLI plugin commands: it adds openshift-eng/ai-helpers and enxebre/ai-scripts marketplaces, installs utils@ai-helpers, golang@ai-helpers, and git@enxebre, then runs claude address-reviews. Sequence Diagram(s)sequenceDiagram
participant GitHubActions
participant Runner
participant GoToolchain
participant PythonPip
participant ClaudeCLI
GitHubActions->>Runner: trigger address-review job
Runner->>GoToolchain: install gopls
Runner->>Runner: export PATH += $HOME/go/bin
Runner->>PythonPip: pip install pre-commit
Runner->>Runner: export PATH += $HOME/.local/bin
Runner->>ClaudeCLI: claude plugin add openshift-eng/ai-helpers
Runner->>ClaudeCLI: claude plugin install utils@ai-helpers, golang@ai-helpers
Runner->>ClaudeCLI: claude plugin add enxebre/ai-scripts
Runner->>ClaudeCLI: claude plugin install git@enxebre
Runner->>ClaudeCLI: claude address-reviews
Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error)
✅ Passed checks (10 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
openshift-ci
Bot
added
the
approved
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/address-review-comments.yaml:
- Line 67: The workflow installs pre-commit (the pip install pre-commit step)
and configures git@enxebre, which allows execution of PR-controlled hooks; split
the job into two: keep this workflow from installing or invoking pre-commit or
any git hooks (remove or guard the "pip install pre-commit" and any git SSH
setup like "git@enxebre"), and create a separate trusted job that runs only
after maintainers approve which performs privileged actions (push/comment, use
GITHUB_TOKEN) and does not execute untrusted repository code; ensure the
untrusted job runs checks in read-only mode (no pre-commit installation, no SSH
git host setup, minimal GITHUB_TOKEN permissions, checkout with
read-only/fetch-depth and actions/checkout=ref) and the trusted job runs any
necessary push/comment steps but never executes PR-provided scripts.
- Around line 65-67: The CI step currently uses floating installers "go install
golang.org/x/tools/gopls@latest" and "pip install pre-commit"; change these to
pinned releases by replacing gopls@latest with a specific go module version
(e.g., gopls@vX.Y.Z) and install pre-commit from a pinned requirements file or
explicit version (e.g., pre-commit==X.Y.Z) instead of bare pip install; also add
or reference a pip lock/constraints file (with hashes or generated via
pip-compile/poetry lock) and update the workflow to install from that file (or
use --require-hashes) so the "go install" and "pip install" lines (the symbols
gopls and pre-commit) become deterministic and reproducible.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: be4df48c-f31d-46c9-8072-8a7a142bed15
📒 Files selected for processing (1)
.github/workflows/address-review-comments.yaml
| go install golang.org/x/tools/gopls@latest | ||
| echo "$HOME/go/bin" >> $GITHUB_PATH | ||
| pip install pre-commit |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/address-review-comments.yaml"
if [ ! -f "$FILE" ]; then
echo "Missing $FILE"
exit 1
fi
echo "== File: $FILE =="
# print around the referenced lines
nl -ba "$FILE" | sed -n '45,90p'
echo "== End snippet =="
# search for gopls@ and pip install pre-commit in the file
echo "== rg checks =="
rg -n "gopls@|pip install pre-commit|pre-commit(==|@|$)" "$FILE" || true
# show if any pinned pip installs using -r or requirements
rg -n "pip (install|) -r |requirements|pre-commit" "$FILE" || trueRepository: openshift/hypershift
Length of output: 185
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/address-review-comments.yaml"
if [ ! -f "$FILE" ]; then
echo "Missing $FILE"
exit 1
fi
echo "== File: $FILE =="
nl -ba "$FILE" | sed -n '45,90p'
echo "== rg checks =="
rg -n "gopls@|pip install pre-commit|pre-commit(==|@|$)" "$FILE" || true
echo "== pip/requirements context =="
rg -n "pip (install|) -r |requirements|pre-commit" "$FILE" || trueRepository: openshift/hypershift
Length of output: 185
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/address-review-comments.yaml"
[ -f "$FILE" ] || { echo "Missing $FILE"; exit 1; }
echo "== Snippet (lines 50-85) =="
awk 'NR>=50 && NR<=85 {printf "%d:%s\n", NR, $0}' "$FILE"
echo "== rg: gopls + pre-commit installs =="
rg -n "gopls@|pip install pre-commit|pre-commit==" "$FILE" || true
echo "== rg: any other pinned versions =="
rg -n "pip install|go install" "$FILE" | head -n 200Repository: openshift/hypershift
Length of output: 1971
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/address-review-comments.yaml"
echo "== rg: pre-commit pinning or requirements references =="
rg -n "pre-commit(==|@)|requirements\.txt|setup\.py|pyproject\.toml" "$FILE" || true
echo "== rg: go install pins (non-latest) =="
rg -n "go install .+@" "$FILE" || trueRepository: openshift/hypershift
Length of output: 215
Pin deterministic versions for gopls and pre-commit in CI
- In
.github/workflows/address-review-comments.yaml(lines 65-67),go install golang.org/x/tools/gopls@latestandpip install pre-commitfloat to whatever versions are current, making runs non-reproducible and increasing supply-chain drift. - Pin
goplsandpre-committo specific versions (ideally with hashes via--require-hashesand/or a constraints/lockfile).
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/address-review-comments.yaml around lines 65 - 67, The CI
step currently uses floating installers "go install
golang.org/x/tools/gopls@latest" and "pip install pre-commit"; change these to
pinned releases by replacing gopls@latest with a specific go module version
(e.g., gopls@vX.Y.Z) and install pre-commit from a pinned requirements file or
explicit version (e.g., pre-commit==X.Y.Z) instead of bare pip install; also add
or reference a pip lock/constraints file (with hashes or generated via
pip-compile/poetry lock) and update the workflow to install from that file (or
use --require-hashes) so the "go install" and "pip install" lines (the symbols
gopls and pre-commit) become deterministic and reproducible.
Source: Coding guidelines
There was a problem hiding this comment.
Done. Pinned gopls@v0.22.0 and pre-commit==4.6.0 to make CI installs deterministic.
AI-assisted response via Claude Code
There was a problem hiding this comment.
Skipped: comment is from another GitHub bot.
enxebre
force-pushed
the
address-review-plugins
branch
from
782663f to
079205b
Compare
|
/address-review-comments |
|
🤖 Addressing review comments: workflow run |
|
Addressed the version pinning feedback from CodeRabbit — pinned However, the push failed because the workflow's The author will need to push this change manually. AI-assisted response via Claude Code |
Install gopls-lsp plugin for Go code intelligence, the enxebre/ai-scripts git plugin to gate pushes with make verify via pre-commit, and their tool dependencies (gopls, pre-commit). Signed-off-by: Alberto Garcia Lamela <agarcial@redhat.com>
enxebre
force-pushed
the
address-review-plugins
branch
from
079205b to
225a731
Compare
|
@enxebre: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
Pipeline controller notification No second-stage tests were triggered for this PR. This can happen when:
Use |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: bryan-cox, enxebre The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
2 participants
Summary
gopls-lspplugin for Go code intelligence during review comment resolutiongit@enxebreplugin to auto-setup pre-commit pre-push hooks (gates pushes withmake verify)gopls,pre-commit) needed by the pluginsTest plan
/address-review-commentson a test PR and verify plugins loadmake verifyruns before any push made by ClaudeSummary by CodeRabbit
Note: Internal infrastructure change only; no user-facing functionality was added or modified.