chore: deprecate old profiletypes in favor of containerprofiles - #351
Open
entlein wants to merge 17 commits into
Open
chore: deprecate old profiletypes in favor of containerprofiles#351entlein wants to merge 17 commits into
entlein wants to merge 17 commits into
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe change removes ApplicationProfile and NetworkNeighborhood API and storage paths, makes network-policy generation ContainerProfile-based, updates ContainerProfile processing and configuration, and narrows Gob migration support to ContainerProfile and SeccompProfile with integration coverage. ChangesContainerProfile migration
Estimated code review effort: 5 (Critical) | ~120 minutes Possibly related issues
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
entlein
commented
Jul 29, 2026
entlein
commented
Jul 29, 2026
entlein
commented
Jul 29, 2026
| @@ -0,0 +1,185 @@ | |||
| { | |||
Contributor
Author
There was a problem hiding this comment.
chicken, whats this name "golden", that is not descriptive at all. same for window_*.json
put in your memory: descriptive short names without implementation details
entlein
commented
Jul 29, 2026
| if relevancyEnabled { | ||
| logger.L().Debug("relevancy is enabled, adding additional cleanup handlers") | ||
| resourceKindToHandler["applicationprofiles"] = append(resourceKindToHandler["applicationprofiles"], deleteMissingInstanceIdAnnotation, deleteMissingWlidAnnotation) | ||
| resourceKindToHandler["containerprofiles"] = append(resourceKindToHandler["containerprofiles"], deleteMissingInstanceIdAnnotation, deleteMissingWlidAnnotation) |
Contributor
Author
There was a problem hiding this comment.
chicken, we need a test for this, cause cps have a different lifecycle than APs did. Lets have an exact contract here.
entlein
commented
Jul 29, 2026
Comment on lines
-71
to
-76
| func (f *fakeStorage) SaveMergedContainerProfile(ctx context.Context, observedKey string, profile *softwarecomposition.ContainerProfile) error { | ||
| return nil | ||
| } | ||
| func (f *fakeStorage) GetMergedContainerProfile(ctx context.Context, observedKey string) (softwarecomposition.ContainerProfile, error) { | ||
| return softwarecomposition.ContainerProfile{}, storage.NewKeyNotFoundError(observedKey, 0) | ||
| } |
Contributor
Author
There was a problem hiding this comment.
chicken, why are we removing these?
entlein
changed the title
Contributor
Author
Test-coverage gaps to close — ContainerProfile migration surfaceAudit of the migration surface, prioritized by risk. Note two "green test, wrong mechanism" cases — a test exists but can't catch the real contract (the same failure shape as the GeneratedNetworkPolicy singular/plural bug that shipped in rc5k). HIGH
MED
LOW
Already solid (for reference): the GNP workload-aggregation contract is now genuinely pinned (correct singular |
…NN merge Migrate the server-side user-managed overlay merge (buildMergedProfile) from the legacy ug- ApplicationProfile + NetworkNeighborhood pair to a single ug- ContainerProfile via a new mergeUserCPIntoCP (flat single-container union that mirrors the node-agent client-side merge). Provenance now stamps the ug- CP source key/RV. The AP/NN merge helpers and their provenance keys are marked deprecated. The AP/NN CRD *types* are deliberately left untouched so this change carries no generated-code (openapi/protobuf/deepcopy) impact; the type-level deprecation and the full x86 codegen regeneration belong to the eventual CRD-removal change. Tests migrated to feed a ug- ContainerProfile with equivalent merge assertions. Signed-off-by: entlein <einentlein@gmail.com>
Remove the ApplicationProfile and NetworkNeighborhood custom resources entirely: their API types, registration, aggregated-apiserver storage backends, processors, and REST strategy/etcd wiring are gone, and the generated code (deepcopy, clientset, listers, informers, applyconfiguration, openapi, protobuf) is regenerated without them. ContainerProfile is the sole runtime/user-facing profile resource. - GeneratedNetworkPolicy is reworked to source from ContainerProfile (it projects the CP into the internal NetworkNeighborhood shape used by the policy generator), so that feature is preserved. The NetworkNeighborhood Go struct is retained as an internal, non-served intermediate only. - The user-managed "ug-" overlay merge is ContainerProfile-only. - Deprecated AP/NN merge helpers removed; tests migrated to ContainerProfile or dropped where they covered removed CRD-specific behaviour. Signed-off-by: entlein <einentlein@gmail.com>
The kindQueues default config still spun up applicationprofiles/networkneighborhoods queue workers, and the relevancy cleanup path still targeted applicationprofiles, after the CRDs were removed. Point them at containerprofiles. Signed-off-by: entlein <einentlein@gmail.com>
Rename MaxApplicationProfileSize -> MaxContainerProfileSize; drop the ApplicationProfile decode path from cmd/migration; neutralize AP/NN comments and the dead gob type-name default. The intentional GNP ContainerProfile-> NetworkNeighborhood projection is retained. Signed-off-by: entlein <einentlein@gmail.com>
The ug-<workload> user-managed merge (an additive overlay unioned onto the learned/observed ContainerProfile and republished as a derived merged profile) has no consumers. Remove the merge engine (buildMergedProfile/mergeUserCPIntoCP), the merged-first REST wrapper, the per-tick merged refresh + merged-CP GC, and the Save/Get/Delete Merged storage-interface methods and their wiring. The observed/learned ContainerProfile and the user-defined authoritative ContainerProfile remain the only profile mechanisms. Signed-off-by: entlein <einentlein@gmail.com>
Signed-off-by: entlein <einentlein@gmail.com>
The migrated network-policy fixtures (cp-operator.json + the np-operator/np.new goldens) were moved but not yet consumed by a test. Add TestGenerateNetworkPolicyFromFile: it loads the v1beta1 ContainerProfile fixture, converts it to the internal type as the read path does, generates a policy, and asserts the result reproduces the pre-migration golden output under the generator's deterministic sort -- a diff-oracle that generating directly from a ContainerProfile matches the removed NetworkNeighborhood intermediate path. Add TestGenerateNetworkPolicy_PerContainerProfiles: two per-container profiles for one workload each generate their own policy reflecting only that container's network, with no cross-container bleed -- pinning the <label>-<containerName> per-container binding contract on the storage side. Signed-off-by: entlein <einentlein@gmail.com>
TestConsolidateData ran the fixtures through ConsolidateTimeSeries but asserted only one field, so the consolidated output was never pinned. Add TestConsolidateContainerProfileGolden: three time-series window fixtures folded via mergeContainerProfileTS then DeflateContainerProfileSpec, frozen to a golden (UPDATE_GOLDEN=1 to regenerate). Exercises opens wildcard collapse, arch/cap/ syscall dedup+sort, endpoint merge, rule-policy union, and ingress CIDR collapse. Golden-regression freeze (complements the CP->NetworkPolicy differential oracle). Signed-off-by: entlein <einentlein@gmail.com>
cp-operator.json carried over the deprecated singular dns/ipAddress fields from the NetworkNeighborhood form it was migrated from. Author it in the ContainerProfile-native representation instead: dnsNames/ipAddresses lists, no deprecated backwards-compat fields. The golden GeneratedNetworkPolicy is unchanged, confirming the native list fields generate the identical policy. Signed-off-by: entlein <einentlein@gmail.com>
A direct client patch of a consolidated ContainerProfile could regress its status from completed back to learning, because PreSave only guarded the time-series ingestion path. Add the guard to the consolidated (non-TS) update path: if the stored profile is already Completed and the incoming status is Learning, revert it to Completed (the update still succeeds). Reading existing metadata inside GuaranteedUpdate (which already holds the key's write lock) needed a lock-free reader (GetContainerProfileMetadataNoLock) to avoid self-deadlock. Pins Test_15_CompletedApCannotBecomeReadyAgain; Completed-> Completed amendments (Test_17) are unaffected. Signed-off-by: entlein <einentlein@gmail.com>
…edNetworkPolicy A GeneratedNetworkPolicy is workload-level: a NetworkPolicy selects pods, and all containers of a pod share the network namespace, so a workload's policy must union every container's ingress/egress. Before the ContainerProfile migration this held because the store read one workload-level NetworkNeighborhood per workload. After the migration the store reads per-container ContainerProfiles (replicaset-named, one object per container), but Get still did a single literal-key lookup and GetList emitted one policy per profile. A multi-container workload therefore produced one policy per container, and a workload-level Get (<lower(kind)>-<name>, e.g. deployment-<name>) returned NotFound because no ContainerProfile is named that way. Reproduced on a two-container workload: two per-container profiles with split egress, a workload-level Get returning NotFound, and an empty list. Resolve by grouping a namespace's ContainerProfiles by the workload-kind / workload-name labels (<lower(kind)>-<name>, the same name GenerateNetworkPolicy derives), unioning their neighbors, and generating one policy per workload. Get aggregates the requested workload's profiles; GetList emits one policy per workload. The internal listing is forced to full-spec because the default list path returns metadata only, which lacks the ingress/egress needed to generate. Add generatednetworkpolicy_multicontainer_test.go pinning workload-level Get aggregation and one-policy-per-workload GetList (both fail pre-fix), and correct the two Get subtests that requested a profile by its object name rather than the workload-level name. Signed-off-by: entlein <einentlein@gmail.com>
… storage kind ContainerProfiles are written under the SINGULAR storage kind segment "containerprofile" (ContainerProfileKind) — the processor keys them via BuildContainerProfileKey(id, "containerprofile"). The GeneratedNetworkPolicy aggregation looked them up under the plural "containerprofiles" (only the REST resource name), so the metadata query WHERE kind = 'containerprofiles' matched zero rows: Get returned NotFound and GetList returned empty for every workload. Observed live on a cluster: a two-container workload's per-container ContainerProfiles persisted correctly, but `get generatednetworkpolicy deployment-<name>` returned NotFound and the list was empty in every namespace, including real learned profiles in kube-system. Use ContainerProfileKind (the singular kind) for the internal lookup so the listing matches the stored keys. The unit tests masked this by seeding the fake store with the plural key; seed them with the singular "containerprofile" segment the real storage uses, so a plural lookup now misses and the tests fail on the pre-fix code. Signed-off-by: entlein <einentlein@gmail.com>
…der load Under sustained concurrent writes (many container profiles consolidating at once, on slow emptyDir I/O) a writer could wait past SQLite's default 10s busy timeout for the single-writer lock and fail with 'database is locked'. The insert was dropped, so the container profile never reached Completed and consumers hung — reproduced by component tests Test_09/20/21 timing out at 20m waiting for completion (storage logs: 'insert metadata: sqlite: step: database is locked'). The pool already opens connections in WAL mode (sqlitex defaults Flags=0 to OpenWAL); raise the busy timeout to 60s via PrepareConn so contended writes wait for the lock instead of failing, and re-assert WAL + synchronous=NORMAL explicitly so the config survives a Flags change. Signed-off-by: entlein <einentlein@gmail.com>
… drop under load" This reverts commit 809b840. Signed-off-by: entlein <einentlein@gmail.com>
- cmd/migration: golden gob->JSON test (legacy uint64 fields round-trip verbatim incl. max-uint64; spec shape; unsupported-type/corrupt-stream/missing-file). - containerprofile REST strategy: GetAttrs/SelectableFields expose the CP namespace/name/workload labels (catches the SBOMSyft copy-paste), NamespaceScoped, create/update/validate hooks. - completed-immutability guard driven through the REAL GuaranteedUpdate + sqlite pool (not the aliasing fake): Completed->Learning reverts, TooLarge short-circuits; pointing the guard at the locking read deadlocks (proves the no-lock variant). - ECS/Host key Build/Parse round-trips for all HostTypes + malformed branches. - Is/NormalizeContainerProfileKind + workloadPolicyName table tests. - GeneratedNetworkPolicy excludes non-available (TooLarge) profiles from Get/GetList. Test-only; no production changes. Signed-off-by: entlein <einentlein@gmail.com>
entlein
marked this pull request as ready for review
July 30, 2026 19:07
Contributor
Author
|
chicken is claiming this is ready for review... chicken also tried to delete a repo.. twice.. today. I wouldnt trust it. |
8 tasks
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 6
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
pkg/apis/softwarecomposition/v1beta1/generated.proto (1)
226-264: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winStale WARNING comment left over from ApplicationProfile removal.
Line 227 still says
// WARNING report fields from ApplicationProfileContainer here, referencing a type that no longer exists. The sibling comment for the network fields (line 258) was correctly updated to "network fields", andpkg/apis/softwarecomposition/v1beta1/types.goline 236 already uses the correct wording ("execution/profile fields") for this same field group — this generated file appears to not have been fully regenerated/synced.📝 Proposed fix
message ContainerProfileSpec { - // WARNING report fields from ApplicationProfileContainer here + // WARNING report the execution/profile fields here repeated string architectures = 1;🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/apis/softwarecomposition/v1beta1/generated.proto` around lines 226 - 264, Update the stale warning comment in ContainerProfileSpec above architectures to describe the execution/profile fields rather than referencing the removed ApplicationProfileContainer type, matching the wording used by ContainerProfileSpec in types.go; leave the field definitions and network warning unchanged.pkg/apiserver/apiserver.go (1)
141-144: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winStale comment references a removed second processor.
These comments still describe "processors" (plural) and "application/container storage backends," but the application-profile processor was removed — only
containerProfileProcessorremains and only itsCollapseSettingsis wired (line 176). Update the comments to reflect the single-processor reality to avoid confusing future maintainers.📝 Proposed fix
- // Construct processors first so we can wire the CollapseConfiguration - // CRD provider into them AFTER the application/container storage - // backends are built — chicken-and-egg: the provider needs storage to - // read the CR, processors are baked into the storage backend. + // Construct the processor first so we can wire the CollapseConfiguration + // CRD provider into it AFTER the container storage backend is built — + // chicken-and-egg: the provider needs storage to read the CR, and the + // processor is baked into the storage backend.- // Wire the CollapseConfiguration CRD into the live deflate path: both - // processors read effective thresholds from CollapseConfiguration/default + // Wire the CollapseConfiguration CRD into the live deflate path: the + // container profile processor reads effective thresholds from CollapseConfiguration/default // (cluster-scoped) on every compaction, falling back to compiled-in // defaults when the CR is absent. Without this the CRD endpoint // registered below stores the manifest but never consults it — applying // the artifacts/collapseconfiguration-default-sample.yaml manifest would // be a no-op (matthyx review on apiserver.go:164, 2026-05-27). - // - // One shared provider closure is wired into both processors so a single - // CR update affects both compaction paths consistently.Also applies to: 165-174
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/apiserver/apiserver.go` around lines 141 - 144, Update the comments around containerProfileProcessor initialization and CollapseSettings wiring to refer to the single container-profile processor, not plural processors or application/container storage backends. Describe only the remaining processor and its CollapseConfiguration provider dependency, keeping the implementation unchanged.
🧹 Nitpick comments (10)
pkg/apis/softwarecomposition/networkpolicy/v2/networkpolicy_test.go (2)
443-489: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueDuplicate table entry. The
policy_with_known_serverscase at Lines 443-588 is byte-identical in name, input and expectations to the one at Lines 297-442;t.Runwill just suffix the second subtest name. Drop one.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/apis/softwarecomposition/networkpolicy/v2/networkpolicy_test.go` around lines 443 - 489, Remove the duplicate policy_with_known_servers table entry, keeping only one identical test case and its expectations in the surrounding table-driven test.
299-337: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winMigrated expectations outside ingress/egress are unverified.
compareNPdiffs onlySpec.Spec.Ingress/Egress, so every metadata, name,apiVersionandPoliciesRefexpectation in the tests and goldens is inert — which is why the divergences below all pass unnoticed.
pkg/apis/softwarecomposition/networkpolicy/v2/networkpolicy_test.go#L299-L337: assertPoliciesRef(andSpec.Spec.PodSelector) explicitly for the known-servers case, and normalize the stale.../v1TypeMeta.APIVersionto.../v1beta1.pkg/apis/softwarecomposition/networkpolicy/v2/testdata/cp-operator.json#L13-L22: either addkubescape.io/workload-container-nameto both goldens'metadata.labelsor drop it from the fixture.pkg/apis/softwarecomposition/networkpolicy/v2/testdata/np.new.json#L50-L52: set the embeddedNetworkPolicyname todeployment-operator, matching the generator andnp-operator.json.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/apis/softwarecomposition/networkpolicy/v2/networkpolicy_test.go` around lines 299 - 337, Update pkg/apis/softwarecomposition/networkpolicy/v2/networkpolicy_test.go:299-337 to explicitly assert PoliciesRef and Spec.Spec.PodSelector for the known-servers case, and normalize the expected TypeMeta.APIVersion to the v1beta1 value. In pkg/apis/softwarecomposition/networkpolicy/v2/testdata/cp-operator.json:13-22, add kubescape.io/workload-container-name to both golden metadata.labels entries or remove it from the fixture. In pkg/apis/softwarecomposition/networkpolicy/v2/testdata/np.new.json:50-52, change the embedded NetworkPolicy name to deployment-operator.pkg/apis/softwarecomposition/networkpolicy/v2/networkpolicy.go (1)
24-50: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueConsider not mutating and not aliasing the caller's label map.
Line 39 deletes from
cp.Labelsin place, and Lines 50/77 alias that same map into both output objects. Callers now pass pointers into a listed[]ContainerProfile(generatednetworkpolicy.goGet/GetList), so the input is silently modified and the two generated objects share one map. Behavior is unchanged from the previousnnversion, but a shallow copy would make this robust.♻️ Proposed defensive copy
- delete(cp.Labels, helpersv1.TemplateHashKey) + labels := make(map[string]string, len(cp.Labels)) + for k, v := range cp.Labels { + if k == helpersv1.TemplateHashKey { + continue + } + labels[k] = v + }Then use
labels(and a second copy) fornetworkPolicy.ObjectMeta.LabelsandgeneratedNetworkPolicy.ObjectMeta.Labels.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/apis/softwarecomposition/networkpolicy/v2/networkpolicy.go` around lines 24 - 50, Update GenerateNetworkPolicy to create a defensive copy of cp.Labels before removing TemplateHashKey, so the caller’s ContainerProfile is not mutated. Use the cleaned labels for networkPolicy.ObjectMeta.Labels and provide a separate copy for generatedNetworkPolicy.ObjectMeta.Labels, preventing the two output objects from sharing the same map.pkg/apis/softwarecomposition/networkpolicy/v2/testdata/cp-operator.json (1)
13-22: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueFixture labels diverge from the goldens' labels.
kubescape.io/workload-container-nameis set here, but neither golden'smetadata.labels(np-operator.jsonLines 6-13,np.new.jsonLines 8-15) contains it, and the generator only stripsinstance-template-hash. This passes solely becausecompareNPignores metadata, which weakens the "diff-oracle" claim innetworkpolicy_file_test.go. Either add the label to the goldens or drop it from the fixture.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/apis/softwarecomposition/networkpolicy/v2/testdata/cp-operator.json` around lines 13 - 22, Align the fixture and golden metadata labels by either adding kubescape.io/workload-container-name to both golden files or removing it from cp-operator.json; keep compareNP unchanged so metadata differences remain detectable by networkpolicy_file_test.go.pkg/apis/softwarecomposition/networkpolicy/v2/networkpolicy_file_test.go (1)
44-61: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueDecode
known-serversthrough the v1beta1 conversion path.
known-servers.jsonis currently decoded into[]softwarecomposition.KnownServer, which works only because Go matches the camelCase JSON keys (ipBlock,server,name) to the internal exported fields; this is fragile and diverges from the profile fixture path. Decode assoftwarecompositionv1beta1.KnownServerand convert to the internal type for consistency.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/apis/softwarecomposition/networkpolicy/v2/networkpolicy_file_test.go` around lines 44 - 61, Update the known-servers fixture setup in the test to unmarshal into a slice of softwarecompositionv1beta1.KnownServer, then convert each entry through the v1beta1 conversion path into the internal []softwarecomposition.KnownServer used by the generator. Replace the direct json.Unmarshal into knownServers while preserving the existing fixture error handling and resulting internal collection.pkg/registry/file/dynamicpathdetector/tests/execargs_wildcard_ap_test.go (1)
39-39: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueTest names still say "AP" but now test ContainerProfile.
execAP/matchAPwere fully replaced byexecCP/matchCP, but the enclosing test function names (TestAP_LiteralStarArg_DoesNotBroaden,TestAP_DynamicArg_IsSingleSegmentWildcard,TestAP_MultiArgWildcard_AbsorbsTail,TestAP_LiteralStarVsDynamic_DivergeOnSameInput) weren't renamed, which could mislead future readers into thinking these exercise ApplicationProfile.Also applies to: 62-62, 85-85, 111-111
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/registry/file/dynamicpathdetector/tests/execargs_wildcard_ap_test.go` at line 39, Rename the affected test functions from the AP prefix to CP to match the ContainerProfile behavior exercised by execCP and matchCP. Update TestAP_LiteralStarArg_DoesNotBroaden, TestAP_DynamicArg_IsSingleSegmentWildcard, TestAP_MultiArgWildcard_AbsorbsTail, and TestAP_LiteralStarVsDynamic_DivergeOnSameInput without changing their test logic.pkg/registry/file/networkneighborhood_ipcollapse.go (1)
25-47: 🎯 Functional Correctness | 🔵 Trivial | 💤 Low valueMinor aliasing risk when merging duplicate identifiers.
out[index].DNSNames/.Portsstill reference the first occurrence's backing array; the in-placeappendat Lines 34-35 can mutate that shared array before it's replaged byDeflateSortString/DeflateStringer. Low risk given current callers discardinafter the call, but worth a defensive copy to avoid surprises if this helper is reused elsewhere.♻️ Suggested defensive copy
if index, ok := seen[item.Identifier]; ok { - out[index].DNSNames = append(out[index].DNSNames, item.DNSNames...) - out[index].Ports = append(out[index].Ports, item.Ports...) + out[index].DNSNames = append(append([]string(nil), out[index].DNSNames...), item.DNSNames...) + out[index].Ports = append(append([]softwarecomposition.NetworkPort(nil), out[index].Ports...), item.Ports...) toDeflate.Add(index)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/registry/file/networkneighborhood_ipcollapse.go` around lines 25 - 47, Update deflateNetworkNeighbors so the first occurrence’s DNSNames and Ports slices are defensively copied before duplicate items are appended, preventing merged output from sharing backing arrays with input data. Preserve the existing duplicate aggregation and deflation behavior.pkg/registry/file/containerprofile_processor_test.go (1)
184-242: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winConcurrent consolidation test no longer verifies output correctness.
TestConsolidateTimeSeries_Concurrent_NoDeadlocknow only checks for deadlocks and pool leaks after removing the AP verification block; it no longer confirms the consolidatedContainerProfilecontent is correct under concurrent dispatch (same staged inputs asTestConsolidateData). A regression that produces wrong-but-non-deadlocking output would slip through.♻️ Suggested addition before the pool-leak check
conn, err := pool.Take(ctx) require.NoError(t, err) containerProfile := softwarecomposition.ContainerProfile{} key := "/spdx.softwarecomposition.kubescape.io/containerprofile/kube-system/replicaset-coredns-5d78c9869d-coredns-185f-129c" require.NoError(t, s.GetWithConn(ctx, conn, key, storage.GetOptions{}, &containerProfile)) assert.Equal(t, softwarecomposition.CallID("test-call-id"), containerProfile.Spec.IdentifiedCallStacks[0].CallID) pool.Put(conn)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/registry/file/containerprofile_processor_test.go` around lines 184 - 242, Restore an output-correctness assertion in TestConsolidateTimeSeries_Concurrent_NoDeadlock after the final consolidation and before the pool-leak check. Reuse pool, s, and ctx to acquire a connection, fetch the expected consolidated ContainerProfile with GetWithConn for the known coredns key, assert its first identified call stack has CallID "test-call-id", and return the connection to the pool while preserving the existing deadlock and leak checks.cmd/migration/main_test.go (1)
284-286: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueDrop the import-keeper instead of a package-level blank var.
softwarecompositionisn't otherwise needed in this test file; removing the import is cleaner than anchoring it withvar _ = softwarecomposition.HTTPEndpoint{}.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@cmd/migration/main_test.go` around lines 284 - 286, Remove the package-level blank variable referencing softwarecomposition.HTTPEndpoint and delete the now-unused softwarecomposition import from the test file, leaving the surrounding migration fixture unchanged.pkg/registry/softwarecomposition/containerprofile/strategy_test.go (1)
120-124: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueConsider renaming the copy-pasted symbols this guard pins.
The guard asserts on
SbomSyftStrategyinside thecontainerprofilepackage (same forMatchWorkloadConfigurationScanat Line 76) — exactly the copy-paste heritage the file header warns about. Renaming these instrategy.gotoContainerProfileStrategy/MatchContainerProfilewould make the tests self-documenting; the package is internal so the churn is contained.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/registry/softwarecomposition/containerprofile/strategy_test.go` around lines 120 - 124, Rename the copy-pasted strategy symbols in strategy.go from SbomSyftStrategy to ContainerProfileStrategy and MatchWorkloadConfigurationScan to MatchContainerProfile, then update all references in the containerprofile package, including the compile-time interface guards and tests. Preserve the existing behavior and interfaces.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@cmd/migration/main_test.go`:
- Line 48: Replace both exec.Command call sites in the migration test with
exec.CommandContext, including the build invocation and the second command
around the affected lines. Add the context import and pass an appropriate
test-scoped context so hung build or run processes are bounded while preserving
the existing arguments and behavior.
In `@pkg/apis/softwarecomposition/networkpolicy/v2/testdata/np.new.json`:
- Around line 50-52: Update the embedded NetworkPolicy metadata name in
np.new.json to match the generator’s deployment-operator naming and the sibling
golden fixture, replacing the stale replicaset-based name while preserving the
namespace and policy rules.
In `@pkg/registry/file/cleanup.go`:
- Around line 72-77: The cleanup registration for "containerprofiles" lacks
coverage for both relevancy states. Add a unit test near the cleanup setup that
verifies relevancyEnabled=true registers deleteMissingInstanceIdAnnotation and
deleteMissingWlidAnnotation in the exact expected handler set, while
relevancyEnabled=false leaves those handlers unregistered.
In `@pkg/registry/file/containerprofile_processor.go`:
- Around line 186-201: Update the GetContainerProfileMetadataNoLock error
handling in the completed-immutability check to distinguish storage.IsNotFound
from other errors. Keep the create/no-existing-profile path unchanged for
not-found errors, but log any other storage failure with the relevant key and
error details before proceeding, matching the diagnostic behavior of the nearby
SBOM lookup.
In `@pkg/registry/file/generatednetworkpolicy_multicontainer_test.go`:
- Around line 26-32: Update the comment above the generated network policy tests
to remove the outdated claim that storage performs a literal-key Get, loses
per-workload aggregation, and causes the tests to fail. Reword it to describe
the current pinned aggregation contract while retaining the relevant
per-container naming and workload-level behavior details.
In `@pkg/registry/file/generatednetworkpolicy.go`:
- Around line 176-193: Update the single-workload lookup around
listNamespaceContainerProfiles to avoid truncated in-memory scans: apply the
workload-name selection through the storage.ListOptions predicate when
supported, or paginate using continuation tokens until all namespace profiles
are examined. Preserve the existing availability filtering and return the
matching profile, only returning storage.NewKeyNotFoundError after the complete
filtered search.
---
Outside diff comments:
In `@pkg/apis/softwarecomposition/v1beta1/generated.proto`:
- Around line 226-264: Update the stale warning comment in ContainerProfileSpec
above architectures to describe the execution/profile fields rather than
referencing the removed ApplicationProfileContainer type, matching the wording
used by ContainerProfileSpec in types.go; leave the field definitions and
network warning unchanged.
In `@pkg/apiserver/apiserver.go`:
- Around line 141-144: Update the comments around containerProfileProcessor
initialization and CollapseSettings wiring to refer to the single
container-profile processor, not plural processors or application/container
storage backends. Describe only the remaining processor and its
CollapseConfiguration provider dependency, keeping the implementation unchanged.
---
Nitpick comments:
In `@cmd/migration/main_test.go`:
- Around line 284-286: Remove the package-level blank variable referencing
softwarecomposition.HTTPEndpoint and delete the now-unused softwarecomposition
import from the test file, leaving the surrounding migration fixture unchanged.
In `@pkg/apis/softwarecomposition/networkpolicy/v2/networkpolicy_file_test.go`:
- Around line 44-61: Update the known-servers fixture setup in the test to
unmarshal into a slice of softwarecompositionv1beta1.KnownServer, then convert
each entry through the v1beta1 conversion path into the internal
[]softwarecomposition.KnownServer used by the generator. Replace the direct
json.Unmarshal into knownServers while preserving the existing fixture error
handling and resulting internal collection.
In `@pkg/apis/softwarecomposition/networkpolicy/v2/networkpolicy_test.go`:
- Around line 443-489: Remove the duplicate policy_with_known_servers table
entry, keeping only one identical test case and its expectations in the
surrounding table-driven test.
- Around line 299-337: Update
pkg/apis/softwarecomposition/networkpolicy/v2/networkpolicy_test.go:299-337 to
explicitly assert PoliciesRef and Spec.Spec.PodSelector for the known-servers
case, and normalize the expected TypeMeta.APIVersion to the v1beta1 value. In
pkg/apis/softwarecomposition/networkpolicy/v2/testdata/cp-operator.json:13-22,
add kubescape.io/workload-container-name to both golden metadata.labels entries
or remove it from the fixture. In
pkg/apis/softwarecomposition/networkpolicy/v2/testdata/np.new.json:50-52, change
the embedded NetworkPolicy name to deployment-operator.
In `@pkg/apis/softwarecomposition/networkpolicy/v2/networkpolicy.go`:
- Around line 24-50: Update GenerateNetworkPolicy to create a defensive copy of
cp.Labels before removing TemplateHashKey, so the caller’s ContainerProfile is
not mutated. Use the cleaned labels for networkPolicy.ObjectMeta.Labels and
provide a separate copy for generatedNetworkPolicy.ObjectMeta.Labels, preventing
the two output objects from sharing the same map.
In `@pkg/apis/softwarecomposition/networkpolicy/v2/testdata/cp-operator.json`:
- Around line 13-22: Align the fixture and golden metadata labels by either
adding kubescape.io/workload-container-name to both golden files or removing it
from cp-operator.json; keep compareNP unchanged so metadata differences remain
detectable by networkpolicy_file_test.go.
In `@pkg/registry/file/containerprofile_processor_test.go`:
- Around line 184-242: Restore an output-correctness assertion in
TestConsolidateTimeSeries_Concurrent_NoDeadlock after the final consolidation
and before the pool-leak check. Reuse pool, s, and ctx to acquire a connection,
fetch the expected consolidated ContainerProfile with GetWithConn for the known
coredns key, assert its first identified call stack has CallID "test-call-id",
and return the connection to the pool while preserving the existing deadlock and
leak checks.
In `@pkg/registry/file/dynamicpathdetector/tests/execargs_wildcard_ap_test.go`:
- Line 39: Rename the affected test functions from the AP prefix to CP to match
the ContainerProfile behavior exercised by execCP and matchCP. Update
TestAP_LiteralStarArg_DoesNotBroaden, TestAP_DynamicArg_IsSingleSegmentWildcard,
TestAP_MultiArgWildcard_AbsorbsTail, and
TestAP_LiteralStarVsDynamic_DivergeOnSameInput without changing their test
logic.
In `@pkg/registry/file/networkneighborhood_ipcollapse.go`:
- Around line 25-47: Update deflateNetworkNeighbors so the first occurrence’s
DNSNames and Ports slices are defensively copied before duplicate items are
appended, preventing merged output from sharing backing arrays with input data.
Preserve the existing duplicate aggregation and deflation behavior.
In `@pkg/registry/softwarecomposition/containerprofile/strategy_test.go`:
- Around line 120-124: Rename the copy-pasted strategy symbols in strategy.go
from SbomSyftStrategy to ContainerProfileStrategy and
MatchWorkloadConfigurationScan to MatchContainerProfile, then update all
references in the containerprofile package, including the compile-time interface
guards and tests. Preserve the existing behavior and interfaces.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 1a9c937a-7fda-489d-8d43-55cc8b4ff472
⛔ Files ignored due to path filters (25)
pkg/apis/softwarecomposition/v1beta1/generated.pb.gois excluded by!**/*.pb.gopkg/apis/softwarecomposition/v1beta1/generated.protomessage.pb.gois excluded by!**/*.pb.gopkg/generated/applyconfiguration/softwarecomposition/v1beta1/applicationprofile.gois excluded by!**/generated/**pkg/generated/applyconfiguration/softwarecomposition/v1beta1/applicationprofilecontainer.gois excluded by!**/generated/**pkg/generated/applyconfiguration/softwarecomposition/v1beta1/applicationprofilespec.gois excluded by!**/generated/**pkg/generated/applyconfiguration/softwarecomposition/v1beta1/containerprofilespec.gois excluded by!**/generated/**pkg/generated/applyconfiguration/softwarecomposition/v1beta1/networkneighborhood.gois excluded by!**/generated/**pkg/generated/applyconfiguration/softwarecomposition/v1beta1/networkneighborhoodcontainer.gois excluded by!**/generated/**pkg/generated/applyconfiguration/softwarecomposition/v1beta1/networkneighborhoodspec.gois excluded by!**/generated/**pkg/generated/applyconfiguration/utils.gois excluded by!**/generated/**pkg/generated/clientset/versioned/typed/softwarecomposition/v1beta1/applicationprofile.gois excluded by!**/generated/**pkg/generated/clientset/versioned/typed/softwarecomposition/v1beta1/fake/fake_applicationprofile.gois excluded by!**/generated/**pkg/generated/clientset/versioned/typed/softwarecomposition/v1beta1/fake/fake_networkneighborhood.gois excluded by!**/generated/**pkg/generated/clientset/versioned/typed/softwarecomposition/v1beta1/fake/fake_softwarecomposition_client.gois excluded by!**/generated/**pkg/generated/clientset/versioned/typed/softwarecomposition/v1beta1/generated_expansion.gois excluded by!**/generated/**pkg/generated/clientset/versioned/typed/softwarecomposition/v1beta1/networkneighborhood.gois excluded by!**/generated/**pkg/generated/clientset/versioned/typed/softwarecomposition/v1beta1/softwarecomposition_client.gois excluded by!**/generated/**pkg/generated/informers/externalversions/generic.gois excluded by!**/generated/**pkg/generated/informers/externalversions/softwarecomposition/v1beta1/applicationprofile.gois excluded by!**/generated/**pkg/generated/informers/externalversions/softwarecomposition/v1beta1/interface.gois excluded by!**/generated/**pkg/generated/informers/externalversions/softwarecomposition/v1beta1/networkneighborhood.gois excluded by!**/generated/**pkg/generated/listers/softwarecomposition/v1beta1/applicationprofile.gois excluded by!**/generated/**pkg/generated/listers/softwarecomposition/v1beta1/expansion_generated.gois excluded by!**/generated/**pkg/generated/listers/softwarecomposition/v1beta1/networkneighborhood.gois excluded by!**/generated/**pkg/generated/openapi/zz_generated.openapi.gois excluded by!**/generated/**
📒 Files selected for processing (74)
cmd/migration/main.gocmd/migration/main_test.gopkg/apis/softwarecomposition/network_types.gopkg/apis/softwarecomposition/networkpolicy/v2/networkpolicy.gopkg/apis/softwarecomposition/networkpolicy/v2/networkpolicy_file_test.gopkg/apis/softwarecomposition/networkpolicy/v2/networkpolicy_test.gopkg/apis/softwarecomposition/networkpolicy/v2/testdata/cp-operator.jsonpkg/apis/softwarecomposition/networkpolicy/v2/testdata/known-servers.jsonpkg/apis/softwarecomposition/networkpolicy/v2/testdata/np-operator.jsonpkg/apis/softwarecomposition/networkpolicy/v2/testdata/np.new.jsonpkg/apis/softwarecomposition/register.gopkg/apis/softwarecomposition/types.gopkg/apis/softwarecomposition/types_test.gopkg/apis/softwarecomposition/v1beta1/generated.protopkg/apis/softwarecomposition/v1beta1/network_types.gopkg/apis/softwarecomposition/v1beta1/network_types_protobuf_test.gopkg/apis/softwarecomposition/v1beta1/networkpolicy/v2/networkpolicy.gopkg/apis/softwarecomposition/v1beta1/networkpolicy/v2/networkpolicy_test.gopkg/apis/softwarecomposition/v1beta1/networkpolicy/v2/testdata/nn-operator.jsonpkg/apis/softwarecomposition/v1beta1/register.gopkg/apis/softwarecomposition/v1beta1/types.gopkg/apis/softwarecomposition/v1beta1/zz_generated.conversion.gopkg/apis/softwarecomposition/v1beta1/zz_generated.deepcopy.gopkg/apis/softwarecomposition/v1beta1/zz_generated.model_name.gopkg/apis/softwarecomposition/zz_generated.deepcopy.gopkg/apiserver/apiserver.gopkg/config/config.gopkg/config/config_test.gopkg/registry/file/applicationprofile_processor.gopkg/registry/file/applicationprofile_processor_collapse_provider_test.gopkg/registry/file/applicationprofile_processor_test.gopkg/registry/file/applicationprofile_storage.gopkg/registry/file/cleanup.gopkg/registry/file/containerprofile_aggregator_test.gopkg/registry/file/containerprofile_completed_guard_realmech_test.gopkg/registry/file/containerprofile_completed_guard_test.gopkg/registry/file/containerprofile_consolidate_golden_test.gopkg/registry/file/containerprofile_kind_test.gopkg/registry/file/containerprofile_processor.gopkg/registry/file/containerprofile_processor_collapse_provider_test.gopkg/registry/file/containerprofile_processor_test.gopkg/registry/file/containerprofile_rest_storage.gopkg/registry/file/containerprofile_storage.gopkg/registry/file/containerprofile_storage_interface.gopkg/registry/file/containerprofile_user_managed.gopkg/registry/file/containerprofile_user_managed_test.gopkg/registry/file/dynamicpathdetector/tests/compare_exec_args_test.gopkg/registry/file/dynamicpathdetector/tests/coverage_test.gopkg/registry/file/dynamicpathdetector/tests/execargs_wildcard_ap_test.gopkg/registry/file/dynamicpathdetector/types.gopkg/registry/file/generatednetworkpolicy.gopkg/registry/file/generatednetworkpolicy_multicontainer_test.gopkg/registry/file/generatednetworkpolicy_test.gopkg/registry/file/networkneighborhood_ipcollapse.gopkg/registry/file/networkneighborhood_processor.gopkg/registry/file/networkneighborhood_processor_test.gopkg/registry/file/networkneighborhood_storage.gopkg/registry/file/sqlite_keyroundtrip_test.gopkg/registry/file/storage.gopkg/registry/file/storage_test.gopkg/registry/file/testdata/consolidate_golden/consolidated.golden.jsonpkg/registry/file/testdata/consolidate_golden/window_1.jsonpkg/registry/file/testdata/consolidate_golden/window_2.jsonpkg/registry/file/testdata/consolidate_golden/window_3.jsonpkg/registry/file/testdata/expectedFilesToDelete.jsonpkg/registry/softwarecomposition/applicationprofile/etcd.gopkg/registry/softwarecomposition/applicationprofile/strategy.gopkg/registry/softwarecomposition/applicationprofile/strategy_test.gopkg/registry/softwarecomposition/collapseconfiguration/etcd.gopkg/registry/softwarecomposition/collapseconfiguration/strategy_test.gopkg/registry/softwarecomposition/containerprofile/strategy_test.gopkg/registry/softwarecomposition/networkneighborhood/etcd.gopkg/registry/softwarecomposition/networkneighborhood/strategy.gopkg/registry/softwarecomposition/networkneighborhood/strategy_test.go
💤 Files with no reviewable changes (28)
- pkg/apis/softwarecomposition/v1beta1/networkpolicy/v2/testdata/nn-operator.json
- pkg/apis/softwarecomposition/v1beta1/register.go
- pkg/apis/softwarecomposition/v1beta1/networkpolicy/v2/networkpolicy.go
- pkg/registry/softwarecomposition/applicationprofile/etcd.go
- pkg/registry/file/applicationprofile_processor_test.go
- pkg/registry/softwarecomposition/applicationprofile/strategy_test.go
- pkg/registry/file/networkneighborhood_processor_test.go
- pkg/apis/softwarecomposition/v1beta1/networkpolicy/v2/networkpolicy_test.go
- pkg/registry/file/applicationprofile_processor_collapse_provider_test.go
- pkg/apis/softwarecomposition/register.go
- pkg/registry/file/testdata/expectedFilesToDelete.json
- pkg/registry/file/networkneighborhood_storage.go
- pkg/registry/softwarecomposition/networkneighborhood/strategy_test.go
- pkg/apis/softwarecomposition/network_types.go
- pkg/registry/file/applicationprofile_processor.go
- pkg/registry/file/networkneighborhood_processor.go
- pkg/registry/softwarecomposition/applicationprofile/strategy.go
- pkg/registry/softwarecomposition/networkneighborhood/etcd.go
- pkg/apis/softwarecomposition/v1beta1/network_types.go
- pkg/apis/softwarecomposition/v1beta1/zz_generated.model_name.go
- pkg/registry/softwarecomposition/networkneighborhood/strategy.go
- pkg/registry/file/containerprofile_user_managed.go
- pkg/registry/file/containerprofile_rest_storage.go
- pkg/apis/softwarecomposition/v1beta1/zz_generated.deepcopy.go
- pkg/registry/file/applicationprofile_storage.go
- pkg/apis/softwarecomposition/zz_generated.deepcopy.go
- pkg/registry/file/containerprofile_user_managed_test.go
- pkg/apis/softwarecomposition/v1beta1/zz_generated.conversion.go
Comment on lines
+72
to
77
| // only if relevancy is enabled, delete container profiles with missing | ||
| // instanceId or wlid annotations. | ||
| if relevancyEnabled { | ||
| logger.L().Debug("relevancy is enabled, adding additional cleanup handlers") | ||
| resourceKindToHandler["applicationprofiles"] = append(resourceKindToHandler["applicationprofiles"], deleteMissingInstanceIdAnnotation, deleteMissingWlidAnnotation) | ||
| resourceKindToHandler["containerprofiles"] = append(resourceKindToHandler["containerprofiles"], deleteMissingInstanceIdAnnotation, deleteMissingWlidAnnotation) | ||
| } |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win
Add the requested lifecycle-contract test for containerprofiles cleanup.
A past reviewer asked for an explicit test here since ContainerProfiles have a different lifecycle than ApplicationProfiles did, but no test covering deleteMissingInstanceIdAnnotation/deleteMissingWlidAnnotation being wired onto "containerprofiles" is included in this change set. Please add a unit test (e.g. in cleanup_test.go) asserting the exact handler set registered for "containerprofiles" when relevancyEnabled is true/false.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pkg/registry/file/cleanup.go` around lines 72 - 77, The cleanup registration
for "containerprofiles" lacks coverage for both relevancy states. Add a unit
test near the cleanup setup that verifies relevancyEnabled=true registers
deleteMissingInstanceIdAnnotation and deleteMissingWlidAnnotation in the exact
expected handler set, while relevancyEnabled=false leaves those handlers
unregistered.
There was a problem hiding this comment.
Caution
Inline review comments failed to post. This is likely due to GitHub's internal server error or limits when posting large numbers of comments. If you are seeing this consistently it is likely a permissions issue. Please check "Moderation" -> "Code review limits" under your organization settings.
Actionable comments posted: 6
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
pkg/apis/softwarecomposition/v1beta1/generated.proto (1)
226-264: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winStale WARNING comment left over from ApplicationProfile removal.
Line 227 still says
// WARNING report fields from ApplicationProfileContainer here, referencing a type that no longer exists. The sibling comment for the network fields (line 258) was correctly updated to "network fields", andpkg/apis/softwarecomposition/v1beta1/types.goline 236 already uses the correct wording ("execution/profile fields") for this same field group — this generated file appears to not have been fully regenerated/synced.📝 Proposed fix
message ContainerProfileSpec { - // WARNING report fields from ApplicationProfileContainer here + // WARNING report the execution/profile fields here repeated string architectures = 1;🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/apis/softwarecomposition/v1beta1/generated.proto` around lines 226 - 264, Update the stale warning comment in ContainerProfileSpec above architectures to describe the execution/profile fields rather than referencing the removed ApplicationProfileContainer type, matching the wording used by ContainerProfileSpec in types.go; leave the field definitions and network warning unchanged.pkg/apiserver/apiserver.go (1)
141-144: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winStale comment references a removed second processor.
These comments still describe "processors" (plural) and "application/container storage backends," but the application-profile processor was removed — only
containerProfileProcessorremains and only itsCollapseSettingsis wired (line 176). Update the comments to reflect the single-processor reality to avoid confusing future maintainers.📝 Proposed fix
- // Construct processors first so we can wire the CollapseConfiguration - // CRD provider into them AFTER the application/container storage - // backends are built — chicken-and-egg: the provider needs storage to - // read the CR, processors are baked into the storage backend. + // Construct the processor first so we can wire the CollapseConfiguration + // CRD provider into it AFTER the container storage backend is built — + // chicken-and-egg: the provider needs storage to read the CR, and the + // processor is baked into the storage backend.- // Wire the CollapseConfiguration CRD into the live deflate path: both - // processors read effective thresholds from CollapseConfiguration/default + // Wire the CollapseConfiguration CRD into the live deflate path: the + // container profile processor reads effective thresholds from CollapseConfiguration/default // (cluster-scoped) on every compaction, falling back to compiled-in // defaults when the CR is absent. Without this the CRD endpoint // registered below stores the manifest but never consults it — applying // the artifacts/collapseconfiguration-default-sample.yaml manifest would // be a no-op (matthyx review on apiserver.go:164, 2026-05-27). - // - // One shared provider closure is wired into both processors so a single - // CR update affects both compaction paths consistently.Also applies to: 165-174
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/apiserver/apiserver.go` around lines 141 - 144, Update the comments around containerProfileProcessor initialization and CollapseSettings wiring to refer to the single container-profile processor, not plural processors or application/container storage backends. Describe only the remaining processor and its CollapseConfiguration provider dependency, keeping the implementation unchanged.
🧹 Nitpick comments (10)
pkg/apis/softwarecomposition/networkpolicy/v2/networkpolicy_test.go (2)
443-489: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueDuplicate table entry. The
policy_with_known_serverscase at Lines 443-588 is byte-identical in name, input and expectations to the one at Lines 297-442;t.Runwill just suffix the second subtest name. Drop one.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/apis/softwarecomposition/networkpolicy/v2/networkpolicy_test.go` around lines 443 - 489, Remove the duplicate policy_with_known_servers table entry, keeping only one identical test case and its expectations in the surrounding table-driven test.
299-337: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winMigrated expectations outside ingress/egress are unverified.
compareNPdiffs onlySpec.Spec.Ingress/Egress, so every metadata, name,apiVersionandPoliciesRefexpectation in the tests and goldens is inert — which is why the divergences below all pass unnoticed.
pkg/apis/softwarecomposition/networkpolicy/v2/networkpolicy_test.go#L299-L337: assertPoliciesRef(andSpec.Spec.PodSelector) explicitly for the known-servers case, and normalize the stale.../v1TypeMeta.APIVersionto.../v1beta1.pkg/apis/softwarecomposition/networkpolicy/v2/testdata/cp-operator.json#L13-L22: either addkubescape.io/workload-container-nameto both goldens'metadata.labelsor drop it from the fixture.pkg/apis/softwarecomposition/networkpolicy/v2/testdata/np.new.json#L50-L52: set the embeddedNetworkPolicyname todeployment-operator, matching the generator andnp-operator.json.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/apis/softwarecomposition/networkpolicy/v2/networkpolicy_test.go` around lines 299 - 337, Update pkg/apis/softwarecomposition/networkpolicy/v2/networkpolicy_test.go:299-337 to explicitly assert PoliciesRef and Spec.Spec.PodSelector for the known-servers case, and normalize the expected TypeMeta.APIVersion to the v1beta1 value. In pkg/apis/softwarecomposition/networkpolicy/v2/testdata/cp-operator.json:13-22, add kubescape.io/workload-container-name to both golden metadata.labels entries or remove it from the fixture. In pkg/apis/softwarecomposition/networkpolicy/v2/testdata/np.new.json:50-52, change the embedded NetworkPolicy name to deployment-operator.pkg/apis/softwarecomposition/networkpolicy/v2/networkpolicy.go (1)
24-50: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueConsider not mutating and not aliasing the caller's label map.
Line 39 deletes from
cp.Labelsin place, and Lines 50/77 alias that same map into both output objects. Callers now pass pointers into a listed[]ContainerProfile(generatednetworkpolicy.goGet/GetList), so the input is silently modified and the two generated objects share one map. Behavior is unchanged from the previousnnversion, but a shallow copy would make this robust.♻️ Proposed defensive copy
- delete(cp.Labels, helpersv1.TemplateHashKey) + labels := make(map[string]string, len(cp.Labels)) + for k, v := range cp.Labels { + if k == helpersv1.TemplateHashKey { + continue + } + labels[k] = v + }Then use
labels(and a second copy) fornetworkPolicy.ObjectMeta.LabelsandgeneratedNetworkPolicy.ObjectMeta.Labels.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/apis/softwarecomposition/networkpolicy/v2/networkpolicy.go` around lines 24 - 50, Update GenerateNetworkPolicy to create a defensive copy of cp.Labels before removing TemplateHashKey, so the caller’s ContainerProfile is not mutated. Use the cleaned labels for networkPolicy.ObjectMeta.Labels and provide a separate copy for generatedNetworkPolicy.ObjectMeta.Labels, preventing the two output objects from sharing the same map.pkg/apis/softwarecomposition/networkpolicy/v2/testdata/cp-operator.json (1)
13-22: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueFixture labels diverge from the goldens' labels.
kubescape.io/workload-container-nameis set here, but neither golden'smetadata.labels(np-operator.jsonLines 6-13,np.new.jsonLines 8-15) contains it, and the generator only stripsinstance-template-hash. This passes solely becausecompareNPignores metadata, which weakens the "diff-oracle" claim innetworkpolicy_file_test.go. Either add the label to the goldens or drop it from the fixture.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/apis/softwarecomposition/networkpolicy/v2/testdata/cp-operator.json` around lines 13 - 22, Align the fixture and golden metadata labels by either adding kubescape.io/workload-container-name to both golden files or removing it from cp-operator.json; keep compareNP unchanged so metadata differences remain detectable by networkpolicy_file_test.go.pkg/apis/softwarecomposition/networkpolicy/v2/networkpolicy_file_test.go (1)
44-61: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueDecode
known-serversthrough the v1beta1 conversion path.
known-servers.jsonis currently decoded into[]softwarecomposition.KnownServer, which works only because Go matches the camelCase JSON keys (ipBlock,server,name) to the internal exported fields; this is fragile and diverges from the profile fixture path. Decode assoftwarecompositionv1beta1.KnownServerand convert to the internal type for consistency.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/apis/softwarecomposition/networkpolicy/v2/networkpolicy_file_test.go` around lines 44 - 61, Update the known-servers fixture setup in the test to unmarshal into a slice of softwarecompositionv1beta1.KnownServer, then convert each entry through the v1beta1 conversion path into the internal []softwarecomposition.KnownServer used by the generator. Replace the direct json.Unmarshal into knownServers while preserving the existing fixture error handling and resulting internal collection.pkg/registry/file/dynamicpathdetector/tests/execargs_wildcard_ap_test.go (1)
39-39: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueTest names still say "AP" but now test ContainerProfile.
execAP/matchAPwere fully replaced byexecCP/matchCP, but the enclosing test function names (TestAP_LiteralStarArg_DoesNotBroaden,TestAP_DynamicArg_IsSingleSegmentWildcard,TestAP_MultiArgWildcard_AbsorbsTail,TestAP_LiteralStarVsDynamic_DivergeOnSameInput) weren't renamed, which could mislead future readers into thinking these exercise ApplicationProfile.Also applies to: 62-62, 85-85, 111-111
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/registry/file/dynamicpathdetector/tests/execargs_wildcard_ap_test.go` at line 39, Rename the affected test functions from the AP prefix to CP to match the ContainerProfile behavior exercised by execCP and matchCP. Update TestAP_LiteralStarArg_DoesNotBroaden, TestAP_DynamicArg_IsSingleSegmentWildcard, TestAP_MultiArgWildcard_AbsorbsTail, and TestAP_LiteralStarVsDynamic_DivergeOnSameInput without changing their test logic.pkg/registry/file/networkneighborhood_ipcollapse.go (1)
25-47: 🎯 Functional Correctness | 🔵 Trivial | 💤 Low valueMinor aliasing risk when merging duplicate identifiers.
out[index].DNSNames/.Portsstill reference the first occurrence's backing array; the in-placeappendat Lines 34-35 can mutate that shared array before it's replaged byDeflateSortString/DeflateStringer. Low risk given current callers discardinafter the call, but worth a defensive copy to avoid surprises if this helper is reused elsewhere.♻️ Suggested defensive copy
if index, ok := seen[item.Identifier]; ok { - out[index].DNSNames = append(out[index].DNSNames, item.DNSNames...) - out[index].Ports = append(out[index].Ports, item.Ports...) + out[index].DNSNames = append(append([]string(nil), out[index].DNSNames...), item.DNSNames...) + out[index].Ports = append(append([]softwarecomposition.NetworkPort(nil), out[index].Ports...), item.Ports...) toDeflate.Add(index)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/registry/file/networkneighborhood_ipcollapse.go` around lines 25 - 47, Update deflateNetworkNeighbors so the first occurrence’s DNSNames and Ports slices are defensively copied before duplicate items are appended, preventing merged output from sharing backing arrays with input data. Preserve the existing duplicate aggregation and deflation behavior.pkg/registry/file/containerprofile_processor_test.go (1)
184-242: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winConcurrent consolidation test no longer verifies output correctness.
TestConsolidateTimeSeries_Concurrent_NoDeadlocknow only checks for deadlocks and pool leaks after removing the AP verification block; it no longer confirms the consolidatedContainerProfilecontent is correct under concurrent dispatch (same staged inputs asTestConsolidateData). A regression that produces wrong-but-non-deadlocking output would slip through.♻️ Suggested addition before the pool-leak check
conn, err := pool.Take(ctx) require.NoError(t, err) containerProfile := softwarecomposition.ContainerProfile{} key := "/spdx.softwarecomposition.kubescape.io/containerprofile/kube-system/replicaset-coredns-5d78c9869d-coredns-185f-129c" require.NoError(t, s.GetWithConn(ctx, conn, key, storage.GetOptions{}, &containerProfile)) assert.Equal(t, softwarecomposition.CallID("test-call-id"), containerProfile.Spec.IdentifiedCallStacks[0].CallID) pool.Put(conn)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/registry/file/containerprofile_processor_test.go` around lines 184 - 242, Restore an output-correctness assertion in TestConsolidateTimeSeries_Concurrent_NoDeadlock after the final consolidation and before the pool-leak check. Reuse pool, s, and ctx to acquire a connection, fetch the expected consolidated ContainerProfile with GetWithConn for the known coredns key, assert its first identified call stack has CallID "test-call-id", and return the connection to the pool while preserving the existing deadlock and leak checks.cmd/migration/main_test.go (1)
284-286: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueDrop the import-keeper instead of a package-level blank var.
softwarecompositionisn't otherwise needed in this test file; removing the import is cleaner than anchoring it withvar _ = softwarecomposition.HTTPEndpoint{}.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@cmd/migration/main_test.go` around lines 284 - 286, Remove the package-level blank variable referencing softwarecomposition.HTTPEndpoint and delete the now-unused softwarecomposition import from the test file, leaving the surrounding migration fixture unchanged.pkg/registry/softwarecomposition/containerprofile/strategy_test.go (1)
120-124: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueConsider renaming the copy-pasted symbols this guard pins.
The guard asserts on
SbomSyftStrategyinside thecontainerprofilepackage (same forMatchWorkloadConfigurationScanat Line 76) — exactly the copy-paste heritage the file header warns about. Renaming these instrategy.gotoContainerProfileStrategy/MatchContainerProfilewould make the tests self-documenting; the package is internal so the churn is contained.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/registry/softwarecomposition/containerprofile/strategy_test.go` around lines 120 - 124, Rename the copy-pasted strategy symbols in strategy.go from SbomSyftStrategy to ContainerProfileStrategy and MatchWorkloadConfigurationScan to MatchContainerProfile, then update all references in the containerprofile package, including the compile-time interface guards and tests. Preserve the existing behavior and interfaces.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@cmd/migration/main_test.go`:
- Line 48: Replace both exec.Command call sites in the migration test with
exec.CommandContext, including the build invocation and the second command
around the affected lines. Add the context import and pass an appropriate
test-scoped context so hung build or run processes are bounded while preserving
the existing arguments and behavior.
In `@pkg/apis/softwarecomposition/networkpolicy/v2/testdata/np.new.json`:
- Around line 50-52: Update the embedded NetworkPolicy metadata name in
np.new.json to match the generator’s deployment-operator naming and the sibling
golden fixture, replacing the stale replicaset-based name while preserving the
namespace and policy rules.
In `@pkg/registry/file/cleanup.go`:
- Around line 72-77: The cleanup registration for "containerprofiles" lacks
coverage for both relevancy states. Add a unit test near the cleanup setup that
verifies relevancyEnabled=true registers deleteMissingInstanceIdAnnotation and
deleteMissingWlidAnnotation in the exact expected handler set, while
relevancyEnabled=false leaves those handlers unregistered.
In `@pkg/registry/file/containerprofile_processor.go`:
- Around line 186-201: Update the GetContainerProfileMetadataNoLock error
handling in the completed-immutability check to distinguish storage.IsNotFound
from other errors. Keep the create/no-existing-profile path unchanged for
not-found errors, but log any other storage failure with the relevant key and
error details before proceeding, matching the diagnostic behavior of the nearby
SBOM lookup.
In `@pkg/registry/file/generatednetworkpolicy_multicontainer_test.go`:
- Around line 26-32: Update the comment above the generated network policy tests
to remove the outdated claim that storage performs a literal-key Get, loses
per-workload aggregation, and causes the tests to fail. Reword it to describe
the current pinned aggregation contract while retaining the relevant
per-container naming and workload-level behavior details.
In `@pkg/registry/file/generatednetworkpolicy.go`:
- Around line 176-193: Update the single-workload lookup around
listNamespaceContainerProfiles to avoid truncated in-memory scans: apply the
workload-name selection through the storage.ListOptions predicate when
supported, or paginate using continuation tokens until all namespace profiles
are examined. Preserve the existing availability filtering and return the
matching profile, only returning storage.NewKeyNotFoundError after the complete
filtered search.
---
Outside diff comments:
In `@pkg/apis/softwarecomposition/v1beta1/generated.proto`:
- Around line 226-264: Update the stale warning comment in ContainerProfileSpec
above architectures to describe the execution/profile fields rather than
referencing the removed ApplicationProfileContainer type, matching the wording
used by ContainerProfileSpec in types.go; leave the field definitions and
network warning unchanged.
In `@pkg/apiserver/apiserver.go`:
- Around line 141-144: Update the comments around containerProfileProcessor
initialization and CollapseSettings wiring to refer to the single
container-profile processor, not plural processors or application/container
storage backends. Describe only the remaining processor and its
CollapseConfiguration provider dependency, keeping the implementation unchanged.
---
Nitpick comments:
In `@cmd/migration/main_test.go`:
- Around line 284-286: Remove the package-level blank variable referencing
softwarecomposition.HTTPEndpoint and delete the now-unused softwarecomposition
import from the test file, leaving the surrounding migration fixture unchanged.
In `@pkg/apis/softwarecomposition/networkpolicy/v2/networkpolicy_file_test.go`:
- Around line 44-61: Update the known-servers fixture setup in the test to
unmarshal into a slice of softwarecompositionv1beta1.KnownServer, then convert
each entry through the v1beta1 conversion path into the internal
[]softwarecomposition.KnownServer used by the generator. Replace the direct
json.Unmarshal into knownServers while preserving the existing fixture error
handling and resulting internal collection.
In `@pkg/apis/softwarecomposition/networkpolicy/v2/networkpolicy_test.go`:
- Around line 443-489: Remove the duplicate policy_with_known_servers table
entry, keeping only one identical test case and its expectations in the
surrounding table-driven test.
- Around line 299-337: Update
pkg/apis/softwarecomposition/networkpolicy/v2/networkpolicy_test.go:299-337 to
explicitly assert PoliciesRef and Spec.Spec.PodSelector for the known-servers
case, and normalize the expected TypeMeta.APIVersion to the v1beta1 value. In
pkg/apis/softwarecomposition/networkpolicy/v2/testdata/cp-operator.json:13-22,
add kubescape.io/workload-container-name to both golden metadata.labels entries
or remove it from the fixture. In
pkg/apis/softwarecomposition/networkpolicy/v2/testdata/np.new.json:50-52, change
the embedded NetworkPolicy name to deployment-operator.
In `@pkg/apis/softwarecomposition/networkpolicy/v2/networkpolicy.go`:
- Around line 24-50: Update GenerateNetworkPolicy to create a defensive copy of
cp.Labels before removing TemplateHashKey, so the caller’s ContainerProfile is
not mutated. Use the cleaned labels for networkPolicy.ObjectMeta.Labels and
provide a separate copy for generatedNetworkPolicy.ObjectMeta.Labels, preventing
the two output objects from sharing the same map.
In `@pkg/apis/softwarecomposition/networkpolicy/v2/testdata/cp-operator.json`:
- Around line 13-22: Align the fixture and golden metadata labels by either
adding kubescape.io/workload-container-name to both golden files or removing it
from cp-operator.json; keep compareNP unchanged so metadata differences remain
detectable by networkpolicy_file_test.go.
In `@pkg/registry/file/containerprofile_processor_test.go`:
- Around line 184-242: Restore an output-correctness assertion in
TestConsolidateTimeSeries_Concurrent_NoDeadlock after the final consolidation
and before the pool-leak check. Reuse pool, s, and ctx to acquire a connection,
fetch the expected consolidated ContainerProfile with GetWithConn for the known
coredns key, assert its first identified call stack has CallID "test-call-id",
and return the connection to the pool while preserving the existing deadlock and
leak checks.
In `@pkg/registry/file/dynamicpathdetector/tests/execargs_wildcard_ap_test.go`:
- Line 39: Rename the affected test functions from the AP prefix to CP to match
the ContainerProfile behavior exercised by execCP and matchCP. Update
TestAP_LiteralStarArg_DoesNotBroaden, TestAP_DynamicArg_IsSingleSegmentWildcard,
TestAP_MultiArgWildcard_AbsorbsTail, and
TestAP_LiteralStarVsDynamic_DivergeOnSameInput without changing their test
logic.
In `@pkg/registry/file/networkneighborhood_ipcollapse.go`:
- Around line 25-47: Update deflateNetworkNeighbors so the first occurrence’s
DNSNames and Ports slices are defensively copied before duplicate items are
appended, preventing merged output from sharing backing arrays with input data.
Preserve the existing duplicate aggregation and deflation behavior.
In `@pkg/registry/softwarecomposition/containerprofile/strategy_test.go`:
- Around line 120-124: Rename the copy-pasted strategy symbols in strategy.go
from SbomSyftStrategy to ContainerProfileStrategy and
MatchWorkloadConfigurationScan to MatchContainerProfile, then update all
references in the containerprofile package, including the compile-time interface
guards and tests. Preserve the existing behavior and interfaces.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 1a9c937a-7fda-489d-8d43-55cc8b4ff472
⛔ Files ignored due to path filters (25)
pkg/apis/softwarecomposition/v1beta1/generated.pb.gois excluded by!**/*.pb.gopkg/apis/softwarecomposition/v1beta1/generated.protomessage.pb.gois excluded by!**/*.pb.gopkg/generated/applyconfiguration/softwarecomposition/v1beta1/applicationprofile.gois excluded by!**/generated/**pkg/generated/applyconfiguration/softwarecomposition/v1beta1/applicationprofilecontainer.gois excluded by!**/generated/**pkg/generated/applyconfiguration/softwarecomposition/v1beta1/applicationprofilespec.gois excluded by!**/generated/**pkg/generated/applyconfiguration/softwarecomposition/v1beta1/containerprofilespec.gois excluded by!**/generated/**pkg/generated/applyconfiguration/softwarecomposition/v1beta1/networkneighborhood.gois excluded by!**/generated/**pkg/generated/applyconfiguration/softwarecomposition/v1beta1/networkneighborhoodcontainer.gois excluded by!**/generated/**pkg/generated/applyconfiguration/softwarecomposition/v1beta1/networkneighborhoodspec.gois excluded by!**/generated/**pkg/generated/applyconfiguration/utils.gois excluded by!**/generated/**pkg/generated/clientset/versioned/typed/softwarecomposition/v1beta1/applicationprofile.gois excluded by!**/generated/**pkg/generated/clientset/versioned/typed/softwarecomposition/v1beta1/fake/fake_applicationprofile.gois excluded by!**/generated/**pkg/generated/clientset/versioned/typed/softwarecomposition/v1beta1/fake/fake_networkneighborhood.gois excluded by!**/generated/**pkg/generated/clientset/versioned/typed/softwarecomposition/v1beta1/fake/fake_softwarecomposition_client.gois excluded by!**/generated/**pkg/generated/clientset/versioned/typed/softwarecomposition/v1beta1/generated_expansion.gois excluded by!**/generated/**pkg/generated/clientset/versioned/typed/softwarecomposition/v1beta1/networkneighborhood.gois excluded by!**/generated/**pkg/generated/clientset/versioned/typed/softwarecomposition/v1beta1/softwarecomposition_client.gois excluded by!**/generated/**pkg/generated/informers/externalversions/generic.gois excluded by!**/generated/**pkg/generated/informers/externalversions/softwarecomposition/v1beta1/applicationprofile.gois excluded by!**/generated/**pkg/generated/informers/externalversions/softwarecomposition/v1beta1/interface.gois excluded by!**/generated/**pkg/generated/informers/externalversions/softwarecomposition/v1beta1/networkneighborhood.gois excluded by!**/generated/**pkg/generated/listers/softwarecomposition/v1beta1/applicationprofile.gois excluded by!**/generated/**pkg/generated/listers/softwarecomposition/v1beta1/expansion_generated.gois excluded by!**/generated/**pkg/generated/listers/softwarecomposition/v1beta1/networkneighborhood.gois excluded by!**/generated/**pkg/generated/openapi/zz_generated.openapi.gois excluded by!**/generated/**
📒 Files selected for processing (74)
cmd/migration/main.gocmd/migration/main_test.gopkg/apis/softwarecomposition/network_types.gopkg/apis/softwarecomposition/networkpolicy/v2/networkpolicy.gopkg/apis/softwarecomposition/networkpolicy/v2/networkpolicy_file_test.gopkg/apis/softwarecomposition/networkpolicy/v2/networkpolicy_test.gopkg/apis/softwarecomposition/networkpolicy/v2/testdata/cp-operator.jsonpkg/apis/softwarecomposition/networkpolicy/v2/testdata/known-servers.jsonpkg/apis/softwarecomposition/networkpolicy/v2/testdata/np-operator.jsonpkg/apis/softwarecomposition/networkpolicy/v2/testdata/np.new.jsonpkg/apis/softwarecomposition/register.gopkg/apis/softwarecomposition/types.gopkg/apis/softwarecomposition/types_test.gopkg/apis/softwarecomposition/v1beta1/generated.protopkg/apis/softwarecomposition/v1beta1/network_types.gopkg/apis/softwarecomposition/v1beta1/network_types_protobuf_test.gopkg/apis/softwarecomposition/v1beta1/networkpolicy/v2/networkpolicy.gopkg/apis/softwarecomposition/v1beta1/networkpolicy/v2/networkpolicy_test.gopkg/apis/softwarecomposition/v1beta1/networkpolicy/v2/testdata/nn-operator.jsonpkg/apis/softwarecomposition/v1beta1/register.gopkg/apis/softwarecomposition/v1beta1/types.gopkg/apis/softwarecomposition/v1beta1/zz_generated.conversion.gopkg/apis/softwarecomposition/v1beta1/zz_generated.deepcopy.gopkg/apis/softwarecomposition/v1beta1/zz_generated.model_name.gopkg/apis/softwarecomposition/zz_generated.deepcopy.gopkg/apiserver/apiserver.gopkg/config/config.gopkg/config/config_test.gopkg/registry/file/applicationprofile_processor.gopkg/registry/file/applicationprofile_processor_collapse_provider_test.gopkg/registry/file/applicationprofile_processor_test.gopkg/registry/file/applicationprofile_storage.gopkg/registry/file/cleanup.gopkg/registry/file/containerprofile_aggregator_test.gopkg/registry/file/containerprofile_completed_guard_realmech_test.gopkg/registry/file/containerprofile_completed_guard_test.gopkg/registry/file/containerprofile_consolidate_golden_test.gopkg/registry/file/containerprofile_kind_test.gopkg/registry/file/containerprofile_processor.gopkg/registry/file/containerprofile_processor_collapse_provider_test.gopkg/registry/file/containerprofile_processor_test.gopkg/registry/file/containerprofile_rest_storage.gopkg/registry/file/containerprofile_storage.gopkg/registry/file/containerprofile_storage_interface.gopkg/registry/file/containerprofile_user_managed.gopkg/registry/file/containerprofile_user_managed_test.gopkg/registry/file/dynamicpathdetector/tests/compare_exec_args_test.gopkg/registry/file/dynamicpathdetector/tests/coverage_test.gopkg/registry/file/dynamicpathdetector/tests/execargs_wildcard_ap_test.gopkg/registry/file/dynamicpathdetector/types.gopkg/registry/file/generatednetworkpolicy.gopkg/registry/file/generatednetworkpolicy_multicontainer_test.gopkg/registry/file/generatednetworkpolicy_test.gopkg/registry/file/networkneighborhood_ipcollapse.gopkg/registry/file/networkneighborhood_processor.gopkg/registry/file/networkneighborhood_processor_test.gopkg/registry/file/networkneighborhood_storage.gopkg/registry/file/sqlite_keyroundtrip_test.gopkg/registry/file/storage.gopkg/registry/file/storage_test.gopkg/registry/file/testdata/consolidate_golden/consolidated.golden.jsonpkg/registry/file/testdata/consolidate_golden/window_1.jsonpkg/registry/file/testdata/consolidate_golden/window_2.jsonpkg/registry/file/testdata/consolidate_golden/window_3.jsonpkg/registry/file/testdata/expectedFilesToDelete.jsonpkg/registry/softwarecomposition/applicationprofile/etcd.gopkg/registry/softwarecomposition/applicationprofile/strategy.gopkg/registry/softwarecomposition/applicationprofile/strategy_test.gopkg/registry/softwarecomposition/collapseconfiguration/etcd.gopkg/registry/softwarecomposition/collapseconfiguration/strategy_test.gopkg/registry/softwarecomposition/containerprofile/strategy_test.gopkg/registry/softwarecomposition/networkneighborhood/etcd.gopkg/registry/softwarecomposition/networkneighborhood/strategy.gopkg/registry/softwarecomposition/networkneighborhood/strategy_test.go
💤 Files with no reviewable changes (28)
- pkg/apis/softwarecomposition/v1beta1/networkpolicy/v2/testdata/nn-operator.json
- pkg/apis/softwarecomposition/v1beta1/register.go
- pkg/apis/softwarecomposition/v1beta1/networkpolicy/v2/networkpolicy.go
- pkg/registry/softwarecomposition/applicationprofile/etcd.go
- pkg/registry/file/applicationprofile_processor_test.go
- pkg/registry/softwarecomposition/applicationprofile/strategy_test.go
- pkg/registry/file/networkneighborhood_processor_test.go
- pkg/apis/softwarecomposition/v1beta1/networkpolicy/v2/networkpolicy_test.go
- pkg/registry/file/applicationprofile_processor_collapse_provider_test.go
- pkg/apis/softwarecomposition/register.go
- pkg/registry/file/testdata/expectedFilesToDelete.json
- pkg/registry/file/networkneighborhood_storage.go
- pkg/registry/softwarecomposition/networkneighborhood/strategy_test.go
- pkg/apis/softwarecomposition/network_types.go
- pkg/registry/file/applicationprofile_processor.go
- pkg/registry/file/networkneighborhood_processor.go
- pkg/registry/softwarecomposition/applicationprofile/strategy.go
- pkg/registry/softwarecomposition/networkneighborhood/etcd.go
- pkg/apis/softwarecomposition/v1beta1/network_types.go
- pkg/apis/softwarecomposition/v1beta1/zz_generated.model_name.go
- pkg/registry/softwarecomposition/networkneighborhood/strategy.go
- pkg/registry/file/containerprofile_user_managed.go
- pkg/registry/file/containerprofile_rest_storage.go
- pkg/apis/softwarecomposition/v1beta1/zz_generated.deepcopy.go
- pkg/registry/file/applicationprofile_storage.go
- pkg/apis/softwarecomposition/zz_generated.deepcopy.go
- pkg/registry/file/containerprofile_user_managed_test.go
- pkg/apis/softwarecomposition/v1beta1/zz_generated.conversion.go
🛑 Comments failed to post (1)
pkg/apis/softwarecomposition/networkpolicy/v2/testdata/np.new.json (1)
50-52: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Inner
NetworkPolicyname contradicts the generator (and the sibling golden).The generator names the embedded policy
<lower(kind)>-<workload-name>→deployment-operator, whichnp-operator.jsonLine 63 has; here it isreplicaset-operator-55df98fc6d. Unnoticed only becausecompareNPcompares ingress/egress alone.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/apis/softwarecomposition/networkpolicy/v2/testdata/np.new.json` around lines 50 - 52, Update the embedded NetworkPolicy metadata name in np.new.json to match the generator’s deployment-operator naming and the sibling golden fixture, replacing the stale replicaset-based name while preserving the namespace and policy rules.
Signed-off-by: ConstanzeTU <74674840+ConstanzeTU@users.noreply.github.com> Signed-off-by: entlein <einentlein@gmail.com>
Signed-off-by: entlein <einentlein@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Removing all code relating to AP NN or ug
Summary by CodeRabbit
New Features
Breaking Changes
Bug Fixes