Testing ConfigMap Tagging by tommyd450 · Pull Request #424 · securesign/fulcio

tommyd450 · 2026-07-27T09:19:44Z

No description provided.

qodo-for-securesign · 2026-07-27T09:20:19Z

PR Summary by Qodo

Point Tekton Fulcio PR pipeline to SECURESIGN-4640 branch

⚙️ Configuration changes 🕐 Less than 5 minutes

AI Description

• Switch Fulcio pull-request pipeline to use a non-main pipelines.git revision.
• Enables testing ConfigMap tagging behavior from the SECURESIGN-4640 work branch.

Diagram

graph TD
  A["Pull request event"] --> B["Tekton PipelineRun"] --> C["pipelines.git repo"] --> D["Use revision: SECURESIGN-4640"]
  subgraph Legend
    direction LR
    _evt([Trigger]) ~~~ _cfg["Tekton config"] ~~~ _repo[(Git repo)]
  end

High-Level Assessment

The following are alternative approaches to this PR:

1. Parameterize the revision (default: main)

➕ Avoids hardcoding a personal/temporary branch in shared CI config
➕ Allows testing feature branches without committing config changes
➕ Makes it easier to revert to main behavior automatically
➖ Requires wiring a parameter through triggers/templates
➖ Slightly more configuration upfront

2. Pin to an immutable ref (tag or commit SHA)

➕ Reproducible builds; avoids unexpected changes if branch moves
➕ Clear audit trail for what pipeline code ran
➖ Less convenient for rapid iteration than a branch
➖ Needs updates when new pipeline changes are required

Recommendation: If this is temporary testing, consider parameterizing the revision or pinning to a commit SHA to avoid leaving CI pointed at a personal branch. If the intent is longer-lived, switch to a shared feature branch name (or tag) and document the purpose in the Tekton config.

Files changed (1) +1 / -1

Other (1) +1 / -1

fulcio-pull-request.yamlUpdate pipeline git revision for Fulcio PR runs +1/-1

Update pipeline git revision for Fulcio PR runs
• Changes the referenced pipelines.git revision from 'main' to 'jkopriva/SECURESIGN-4640', causing the Tekton PR pipeline to source its task definition from that branch.
.tekton/fulcio-pull-request.yaml

qodo-for-securesign · 2026-07-27T09:21:21Z

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Mutable pipeline git revision 🐞 Bug ⛨ Security

Description

The PR PipelineRun now resolves its pipeline definition from the mutable branch
jkopriva/SECURESIGN-4640 in securesign/pipelines.git, which can silently change CI behavior over
time or break builds if the branch is deleted/unavailable. This also increases supply-chain risk
because PR CI will execute whatever pipeline logic that branch points to, unlike the push pipeline
which remains on main.

Code

.tekton/fulcio-pull-request.yaml[55]
+        value: 'jkopriva/SECURESIGN-4640'

Evidence
The pull-request PipelineRun’s git resolver revision was changed to a feature branch, while the
push PipelineRun still references main, demonstrating a newly introduced divergence and reliance
on a mutable ref for PR CI execution.
.tekton/fulcio-pull-request.yaml[49-57]
.tekton/fulcio-push.yaml[47-55]
.tekton/fulcio-pull-request.yaml[9-10]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`.tekton/fulcio-pull-request.yaml` uses the Tekton `git` resolver to fetch a pipeline definition from `https://github.com/securesign/pipelines.git`, but the referenced `revision` was changed from `main` to a mutable feature branch (`jkopriva/SECURESIGN-4640`). This makes PR builds non-reproducible and fragile (branch can be force-pushed/deleted) and can cause PR CI to execute unexpected pipeline logic.

## Issue Context
The push PipelineRun still references `main`, so pull-request and push builds would run different pipeline definitions.

## Fix Focus Areas
- .tekton/fulcio-pull-request.yaml[49-57]

## Recommended fix
Change `pipelineRef.params.revision` back to a stable reference (e.g., `main`, a release branch, or preferably an immutable commit SHA/tag) consistent with the push pipeline configuration.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

qodo-for-securesign · 2026-07-27T09:21:24Z

        value: 'https://github.com/securesign/pipelines.git'
      - name: revision
-        value: 'main'
+        value: 'jkopriva/SECURESIGN-4640'


1. Mutable pipeline git revision 🐞 Bug ⛨ Security

The PR PipelineRun now resolves its pipeline definition from the mutable branch jkopriva/SECURESIGN-4640 in securesign/pipelines.git, which can silently change CI behavior over time or break builds if the branch is deleted/unavailable. This also increases supply-chain risk because PR CI will execute whatever pipeline logic that branch points to, unlike the push pipeline which remains on main.

Agent Prompt

## Issue description `.tekton/fulcio-pull-request.yaml` uses the Tekton `git` resolver to fetch a pipeline definition from `https://github.com/securesign/pipelines.git`, but the referenced `revision` was changed from `main` to a mutable feature branch (`jkopriva/SECURESIGN-4640`). This makes PR builds non-reproducible and fragile (branch can be force-pushed/deleted) and can cause PR CI to execute unexpected pipeline logic. ## Issue Context The push PipelineRun still references `main`, so pull-request and push builds would run different pipeline definitions. ## Fix Focus Areas - .tekton/fulcio-pull-request.yaml[49-57] ## Recommended fix Change `pipelineRef.params.revision` back to a stable reference (e.g., `main`, a release branch, or preferably an immutable commit SHA/tag) consistent with the push pipeline configuration.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

tommyd450 · 2026-07-27T10:02:57Z

/retest

red-hat-konflux · 2026-07-27T10:03:03Z

All PipelineRuns for this commit have already succeeded. Use /retest <pipeline-name> to re-run a specific pipeline or /test to re-run all pipelines.

tommyd450 · 2026-07-27T10:03:33Z

/test

qodo-for-securesign · 2026-07-27T10:03:41Z

PR-Agent: Missing component name in test command: /test <component_name>.
Running automatically on the largest changed component.

✨ Test tool usage guide:

The test tool generate tests for a selected component, based on the PR code changes.
It can be invoked manually by commenting on any PR:

/test component_name

where 'component_name' is the name of a specific component in the PR. To get a list of the components that changed in the PR, use the analyze tool.
Language that are currently supported: Python, Java, C++, JavaScript, TypeScript.

Configuration options:

num_tests: number of tests to generate. Default is 3.
testing_framework: the testing framework to use. If not set, for Python it will use pytest, for Java it will use JUnit, for C++ it will use Catch2, and for JavaScript and TypeScript it will use jest.
avoid_mocks: if set to true, the tool will try to avoid using mocks in the generated tests. Note that even if this option is set to true, the tool might still use mocks if it cannot generate a test without them. Default is true.
extra_instructions: Optional extra instructions to the tool. For example: "use the following mock injection scheme: ...".
file: in case there are several components with the same name, you can specify the relevant file.
class_name: in case there are several components with the same name in the same file, you can specify the relevant class name.

See more information about the test tool in the docs.

tommyd450 · 2026-07-27T10:28:38Z

/test

qodo-for-securesign · 2026-07-27T10:28:50Z

PR-Agent: Missing component name in test command: /test <component_name>.
Running automatically on the largest changed component.

✨ Test tool usage guide:

The test tool generate tests for a selected component, based on the PR code changes.
It can be invoked manually by commenting on any PR:

/test component_name

where 'component_name' is the name of a specific component in the PR. To get a list of the components that changed in the PR, use the analyze tool.
Language that are currently supported: Python, Java, C++, JavaScript, TypeScript.

Configuration options:

num_tests: number of tests to generate. Default is 3.
testing_framework: the testing framework to use. If not set, for Python it will use pytest, for Java it will use JUnit, for C++ it will use Catch2, and for JavaScript and TypeScript it will use jest.
avoid_mocks: if set to true, the tool will try to avoid using mocks in the generated tests. Note that even if this option is set to true, the tool might still use mocks if it cannot generate a test without them. Default is true.
extra_instructions: Optional extra instructions to the tool. For example: "use the following mock injection scheme: ...".
file: in case there are several components with the same name, you can specify the relevant file.
class_name: in case there are several components with the same name in the same file, you can specify the relevant class name.

See more information about the test tool in the docs.

tommyd450 · 2026-07-27T10:50:13Z

/test

qodo-for-securesign · 2026-07-27T10:50:20Z

PR-Agent: Missing component name in test command: /test <component_name>.
Running automatically on the largest changed component.

✨ Test tool usage guide:

The test tool generate tests for a selected component, based on the PR code changes.
It can be invoked manually by commenting on any PR:

/test component_name

where 'component_name' is the name of a specific component in the PR. To get a list of the components that changed in the PR, use the analyze tool.
Language that are currently supported: Python, Java, C++, JavaScript, TypeScript.

Configuration options:

num_tests: number of tests to generate. Default is 3.
testing_framework: the testing framework to use. If not set, for Python it will use pytest, for Java it will use JUnit, for C++ it will use Catch2, and for JavaScript and TypeScript it will use jest.
avoid_mocks: if set to true, the tool will try to avoid using mocks in the generated tests. Note that even if this option is set to true, the tool might still use mocks if it cannot generate a test without them. Default is true.
extra_instructions: Optional extra instructions to the tool. For example: "use the following mock injection scheme: ...".
file: in case there are several components with the same name, you can specify the relevant file.
class_name: in case there are several components with the same name in the same file, you can specify the relevant class name.

See more information about the test tool in the docs.

tommyd450 · 2026-07-27T11:51:14Z

/test

qodo-for-securesign · 2026-07-27T11:51:25Z

PR-Agent: Missing component name in test command: /test <component_name>.
Running automatically on the largest changed component.

✨ Test tool usage guide:

The test tool generate tests for a selected component, based on the PR code changes.
It can be invoked manually by commenting on any PR:

/test component_name

where 'component_name' is the name of a specific component in the PR. To get a list of the components that changed in the PR, use the analyze tool.
Language that are currently supported: Python, Java, C++, JavaScript, TypeScript.

Configuration options:

num_tests: number of tests to generate. Default is 3.
testing_framework: the testing framework to use. If not set, for Python it will use pytest, for Java it will use JUnit, for C++ it will use Catch2, and for JavaScript and TypeScript it will use jest.
avoid_mocks: if set to true, the tool will try to avoid using mocks in the generated tests. Note that even if this option is set to true, the tool might still use mocks if it cannot generate a test without them. Default is true.
extra_instructions: Optional extra instructions to the tool. For example: "use the following mock injection scheme: ...".
file: in case there are several components with the same name, you can specify the relevant file.
class_name: in case there are several components with the same name in the same file, you can specify the relevant class name.

See more information about the test tool in the docs.

Testing ConfigMap Tagging

d5a6a19

qodo-for-securesign Bot reviewed Jul 27, 2026

View reviewed changes

Test

e6090d6

Uh oh!

Conversation

tommyd450 commented Jul 27, 2026

Uh oh!

qodo-for-securesign Bot commented Jul 27, 2026

PR Summary by Qodo

Uh oh!

qodo-for-securesign Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review by Qodo

Uh oh!

qodo-for-securesign Bot Jul 27, 2026

Choose a reason for hiding this comment

Uh oh!

tommyd450 commented Jul 27, 2026

Uh oh!

red-hat-konflux Bot commented Jul 27, 2026

Uh oh!

tommyd450 commented Jul 27, 2026

Uh oh!

qodo-for-securesign Bot commented Jul 27, 2026

Uh oh!

tommyd450 commented Jul 27, 2026

Uh oh!

qodo-for-securesign Bot commented Jul 27, 2026

Uh oh!

tommyd450 commented Jul 27, 2026

Uh oh!

qodo-for-securesign Bot commented Jul 27, 2026

Uh oh!

tommyd450 commented Jul 27, 2026

Uh oh!

qodo-for-securesign Bot commented Jul 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

qodo-for-securesign Bot commented Jul 27, 2026 •

edited

Loading