ROSAENG-62342: add pull-secret advanced action

[rolandmkunkel]

• Add get-pull-secret-email advanced action that retrieves the registered email from the cluster's openshift-config/pull-secret secret (cloud.openshift.com auth entry)
• Register in action catalog and wire into action-cli

Summary by CodeRabbit

• New Features
  • Added a get-pull-secret-email action to retrieve the email associated with the OpenShift pull secret.
  • The action automatically targets the appropriate pull-secret resource and requires no additional parameters.
  • Added validation and clear errors for missing, malformed, or incomplete pull-secret data.
• Bug Fixes
  • Resource validation now correctly supports actions with predefined resources while continuing to validate other actions.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign raphaelbut for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Warning

Review limit reached

@rolandmkunkel, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 22 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Repository: openshift-online/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: cb15ada7-6891-488e-95fe-3fc73b124229

📥 Commits

Reviewing files that changed from the base of the PR and between 1b9422a and ec5ec6a.

📒 Files selected for processing (2)

• cmd/action-cli/main.go
• internal/actions/get_pull_secret_email_test.go

Walkthrough

The pull-secret email action reads the OpenShift pull-secret, extracts the cloud.openshift.com email, exposes the action through the CLI, and registers it in the catalog. Tests cover successful extraction, RBAC, malformed data, and missing fields.

Changes

Pull-secret email retrieval

Layer / File(s)	Summary
Pull-secret email extraction internal/actions/get_pull_secret_email.go, internal/actions/get_pull_secret_email_test.go	The new action reads and parses the pull-secret, validates the target registry email, declares secret-read RBAC, and tests success and error cases.
CLI action integration cmd/action-cli/main.go	The CLI recognizes get-pull-secret-email, applies the pull-secret target, and validates resources after action-specific defaults.
Catalog registration and expectations internal/catalog/catalog.go, internal/handlers/api_test.go	The catalog registers the read-only action for existing roles. Handler expectations now include four actions and items.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant ActionCLI
  participant GetPullSecretEmailAction
  participant KubernetesAPI
  ActionCLI->>GetPullSecretEmailAction: Execute get-pull-secret-email
  GetPullSecretEmailAction->>KubernetesAPI: Read openshift-config/pull-secret
  KubernetesAPI-->>GetPullSecretEmailAction: Return Secret data
  GetPullSecretEmailAction-->>ActionCLI: Return extracted registry email

Loading

Possibly related PRs

• openshift-online/rosa-trusted-actions#54: Adds a similar action-specific resource default and CLI, catalog, and test integration.

Suggested reviewers: bergmannf, zmird-r

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No-Weak-Crypto	✅ Passed	Changed code has no MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypto, or secret/token comparisons; base64 is used only to decode the Docker config.
Container-Privileges	✅ Passed	The PR changes only Go source and tests. No prohibited manifest settings exist; Containerfile uses USER 1001, and Tekton privileged-nested defaults to false.
No-Sensitive-Data-In-Logs	✅ Passed	The new action has no logging calls, and audit records contain only action/target/error fields; the email is returned as action output, not written to logs.
No-Hardcoded-Secrets	✅ Passed	No hardcoded production secrets found; the only credential-like fixture is dGVzdDp0ZXN0, which decodes to test:test, and no added base64 literal exceeds 32 characters.
No-Injection-Vectors	✅ Passed	The patch uses base64.DecodeString and json.Unmarshal for secret data and adds no SQL construction, shell execution, eval/exec, unsafe YAML or pickle loading, or HTML injection.
Ai-Attribution	✅ Passed	The PR description and sole PR commit do not mention AI tools; the commit has no Assisted-by or Generated-by trailer and no AI Co-Authored-By trailer.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the addition of a pull-secret advanced action, which matches the main change in the pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@cmd/action-cli/main.go`:
- Around line 70-80: Update the action setup flow around the action switch and
authorizer construction so get-pull-secret-email resolves
openshift-config/pull-secret before building nsList and allowedSecrets. Ensure
authorization.Authorize receives those fixed targets in the intended allowlists,
and add CLI integration coverage for the default get-pull-secret-email
invocation.

In `@internal/actions/get_pull_secret_email_test.go`:
- Around line 36-37: Handle the json.Marshal error for each dockerConfig fixture
in internal/actions/get_pull_secret_email_test.go at lines 36-37, 152-153, and
186-187 by failing the test immediately when serialization fails, rather than
discarding the error. Preserve the existing base64 encoding flow after
successful marshaling.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift-online/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 7bdfe852-215e-4c1c-93a3-832634084d3f

📥 Commits

Reviewing files that changed from the base of the PR and between 2c7226a and 1b9422a.

📒 Files selected for processing (5)

• cmd/action-cli/main.go
• internal/actions/get_pull_secret_email.go
• internal/actions/get_pull_secret_email_test.go
• internal/catalog/catalog.go
• internal/handlers/api_test.go

[openshift-ci]

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.