feat(ci): add payload-blocking-runs and kubelet-version-check skills - #616
feat(ci): add payload-blocking-runs and kubelet-version-check skills#616redhat-chai-bot wants to merge 1 commit into
Conversation
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: redhat-chai-bot The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
WalkthroughAdds two CI workflows: one lists release-blocking payload runs using BigQuery and release-controller data, and the other extracts kubelet versions and statuses from GCS artifacts. New commands, skills, catalog entries, and plugin version metadata document and register the workflows. ChangesCI payload analysis
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant User
participant payload_blocking_runs.py
participant BigQuery
participant release-controller
User->>payload_blocking_runs.py: provide PR and stream options
payload_blocking_runs.py->>BigQuery: query payload runs
payload_blocking_runs.py->>release-controller: retrieve blocking jobs
payload_blocking_runs.py-->>User: output matching gcsweb URLs
sequenceDiagram
participant User
participant get_kubestat.py
participant GCS
User->>get_kubestat.py: provide payload-run URL list
get_kubestat.py->>GCS: fetch finished.json and node artifacts
GCS-->>get_kubestat.py: return status and kubelet data
get_kubestat.py-->>User: output sorted analysis table
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 10✅ Passed checks (10 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 11
🧹 Nitpick comments (2)
plugins/ci/skills/kubelet-version-check/get_kubestat.py (2)
42-44: 🚀 Performance & Scalability | 🔵 Trivial | 💤 Low valueRedundant token fetches under concurrency (optional).
With 24 worker threads, the first wave all observe an empty
_token_cacheand each mints a JWT + performs a token exchange (~24 calls instead of 1). Correctness is unaffected (GIL keeps the dict updates atomic), but athreading.Lockaround the mint-and-cache path would avoid the thundering herd.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/ci/skills/kubelet-version-check/get_kubestat.py` around lines 42 - 44, Add a module-level threading.Lock and guard the token minting and cache-update path in the token-fetch function, rechecking _token_cache after acquiring the lock before performing the exchange. Keep the existing fast path outside the lock, and ensure the lock covers only the refresh logic to prevent redundant concurrent token fetches.
180-180: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueHardcoded version regex is brittle (optional).
_VERSION_REonly recognizesv1.35/v1.36; any other kubelet version is reported asunexpected: <version>rather than the value itself. If this tool should track future releases, consider a generalv\d+\.\d+\.\S+match (with the acceptable range enforced separately) so new versions aren't mislabeled.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/ci/skills/kubelet-version-check/get_kubestat.py` at line 180, Update _VERSION_RE to recognize kubelet versions generically using a pattern such as v\d+\.\d+\.\S+, and keep supported-version validation separate so future versions are reported accurately rather than as unexpected values.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@plugins/ci/commands/check-kubelet-versions.md`:
- Line 53: Update the command invoking the kubelet check script to pass
payload-runs.txt as a positional argument instead of shell input redirection, so
get_kubestat.py receives the filename through sys.argv[1].
- Around line 80-89: Add language identifiers to every fenced code block in the
documented command examples, using ```text for plain commands and ```bash where
shell syntax is intended, including the examples for /ci:check-kubelet-versions
and the end-to-end command sequence.
- Around line 47-51: Remove the fallback search under ~/.claude/plugins in the
kubelet version check command. Require KUBELET_CHECK to resolve exclusively from
CLAUDE_PLUGIN_ROOT, and fail closed with the existing error when that path is
unavailable or the script is missing; do not execute any discovered alternative.
In `@plugins/ci/commands/list-payload-blocking-runs.md`:
- Around line 54-58: Replace the angle-bracket placeholders in the executable
command with properly quoted shell variables or arrays for the organization,
repository, PR, and streams arguments; alternatively, explicitly label the
snippet as pseudocode requiring substitution before execution.
- Around line 92-99: Add language identifiers to the fenced command examples in
the documentation, using ```text for plain command invocations and ```bash where
shell syntax is intended; update both examples under the default and explicit
lookback sections.
- Around line 48-52: The fallback in the payload-blocking script path resolution
must not discover or execute scripts from ~/.claude/plugins. Remove the
find-based fallback and fail closed when CLAUDE_PLUGIN_ROOT does not contain
payload_blocking_runs.py, or require an explicitly supplied trusted path before
proceeding; preserve the existing missing-script error handling.
In `@plugins/ci/skills/kubelet-version-check/get_kubestat.py`:
- Around line 272-274: Update the width calculation in get_kubestat.py so it
handles an empty results collection without calling max() with only a single
integer. In the table-formatting logic around widths, compute each column width
from the header plus any available row lengths, preserving header-only widths
when results is empty so the tool can print an empty table.
- Around line 263-267: Handle exceptions from each future independently in the
loop consuming `as_completed(futures)`: wrap `fut.result()` in a try/except,
catch the parsing failure such as `ValueError`, and append an error row matching
the existing result schema instead of aborting. Preserve progress reporting and
continue processing all remaining URLs.
In `@plugins/ci/skills/kubelet-version-check/SKILL.md`:
- Around line 49-53: Remove the ~/.claude/plugins fallback from the
KUBELET_CHECK initialization. Use only the script under CLAUDE_PLUGIN_ROOT (or
another explicitly trusted fixed path), then retain the existence check and
error exit without searching or executing files from the agent configuration
directory.
- Around line 96-104: The documented per-run error handling does not match the
implementation because ValueError from parse_url() propagates through main() via
fut.result(). Update the script so main() catches per-run parse_url() failures
and emits an inline error row while continuing other runs, then keep the Error
Handling documentation aligned with that behavior.
In `@plugins/ci/skills/payload-blocking-runs/SKILL.md`:
- Around line 46-48: Remove the ~/.claude/plugins fallback lookup from the
PAYLOAD_BLOCKING initialization. Resolve the script only through
CLAUDE_PLUGIN_ROOT or another explicitly trusted path, and retain the validation
that fails closed when no valid payload_blocking_runs.py is found.
---
Nitpick comments:
In `@plugins/ci/skills/kubelet-version-check/get_kubestat.py`:
- Around line 42-44: Add a module-level threading.Lock and guard the token
minting and cache-update path in the token-fetch function, rechecking
_token_cache after acquiring the lock before performing the exchange. Keep the
existing fast path outside the lock, and ensure the lock covers only the refresh
logic to prevent redundant concurrent token fetches.
- Line 180: Update _VERSION_RE to recognize kubelet versions generically using a
pattern such as v\d+\.\d+\.\S+, and keep supported-version validation separate
so future versions are reported accurately rather than as unexpected values.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 7910e1d7-246d-467a-a9e4-cd6368acd0bc
📒 Files selected for processing (9)
.claude-plugin/marketplace.jsondocs/index.htmlplugins/ci/.claude-plugin/plugin.jsonplugins/ci/commands/check-kubelet-versions.mdplugins/ci/commands/list-payload-blocking-runs.mdplugins/ci/skills/kubelet-version-check/SKILL.mdplugins/ci/skills/kubelet-version-check/get_kubestat.pyplugins/ci/skills/payload-blocking-runs/SKILL.mdplugins/ci/skills/payload-blocking-runs/payload_blocking_runs.py
| KUBELET_CHECK="${CLAUDE_PLUGIN_ROOT}/skills/kubelet-version-check/get_kubestat.py" | ||
| if [ ! -f "$KUBELET_CHECK" ]; then | ||
| KUBELET_CHECK=$(find ~/.claude/plugins -type f -path "*/ci/skills/kubelet-version-check/get_kubestat.py" 2>/dev/null | sort | head -1) | ||
| fi | ||
| if [ -z "$KUBELET_CHECK" ] || [ ! -f "$KUBELET_CHECK" ]; then echo "ERROR: get_kubestat.py not found" >&2; exit 2; fi |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Do not execute scripts discovered under ~/.claude/plugins.
This fallback selects and executes the first matching script from a mutable agent configuration directory, which could run stale or attacker-controlled code with the user’s credentials. Fail closed when CLAUDE_PLUGIN_ROOT is unavailable, or require an explicitly supplied trusted path.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@plugins/ci/commands/check-kubelet-versions.md` around lines 47 - 51, Remove
the fallback search under ~/.claude/plugins in the kubelet version check
command. Require KUBELET_CHECK to resolve exclusively from CLAUDE_PLUGIN_ROOT,
and fail closed with the existing error when that path is unavailable or the
script is missing; do not execute any discovered alternative.
Source: Linters/SAST tools
| fi | ||
| if [ -z "$KUBELET_CHECK" ] || [ ! -f "$KUBELET_CHECK" ]; then echo "ERROR: get_kubestat.py not found" >&2; exit 2; fi | ||
|
|
||
| python3 "$KUBELET_CHECK" <payload-runs.txt> |
There was a problem hiding this comment.
🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win
Pass the filename as an argument, not shell redirection.
<payload-runs.txt> is parsed as shell redirection, and get_kubestat.py expects the path in sys.argv[1]; as written, this command cannot run. Use python3 "$KUBELET_CHECK" payload-runs.txt.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@plugins/ci/commands/check-kubelet-versions.md` at line 53, Update the command
invoking the kubelet check script to pass payload-runs.txt as a positional
argument instead of shell input redirection, so get_kubestat.py receives the
filename through sys.argv[1].
| ``` | ||
| /ci:check-kubelet-versions payload-runs.txt | ||
| ``` | ||
|
|
||
| 2. **End-to-end from a PR** (run the two commands in sequence): | ||
| ``` | ||
| /ci:list-payload-blocking-runs openshift/machine-config-operator#5509 --streams 4.20.0-0.nightly | ||
| # save the emitted URLs to payload-runs.txt, then: | ||
| /ci:check-kubelet-versions payload-runs.txt | ||
| ``` |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Add language identifiers to fenced code blocks.
Use text for command examples or bash where shell syntax is intended.
🧰 Tools
🪛 markdownlint-cli2 (0.22.1)
[warning] 80-80: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
[warning] 85-85: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@plugins/ci/commands/check-kubelet-versions.md` around lines 80 - 89, Add
language identifiers to every fenced code block in the documented command
examples, using ```text for plain commands and ```bash where shell syntax is
intended, including the examples for /ci:check-kubelet-versions and the
end-to-end command sequence.
Source: Linters/SAST tools
| PAYLOAD_BLOCKING="${CLAUDE_PLUGIN_ROOT}/skills/payload-blocking-runs/payload_blocking_runs.py" | ||
| if [ ! -f "$PAYLOAD_BLOCKING" ]; then | ||
| PAYLOAD_BLOCKING=$(find ~/.claude/plugins -type f -path "*/ci/skills/payload-blocking-runs/payload_blocking_runs.py" 2>/dev/null | sort | head -1) | ||
| fi | ||
| if [ -z "$PAYLOAD_BLOCKING" ] || [ ! -f "$PAYLOAD_BLOCKING" ]; then echo "ERROR: payload_blocking_runs.py not found" >&2; exit 2; fi |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Do not execute scripts discovered under ~/.claude/plugins.
The fallback executes the first matching script from a mutable agent configuration directory, allowing stale or attacker-controlled code to run with the user’s credentials. Fail closed or require an explicitly supplied trusted script path.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@plugins/ci/commands/list-payload-blocking-runs.md` around lines 48 - 52, The
fallback in the payload-blocking script path resolution must not discover or
execute scripts from ~/.claude/plugins. Remove the find-based fallback and fail
closed when CLAUDE_PLUGIN_ROOT does not contain payload_blocking_runs.py, or
require an explicitly supplied trusted path before proceeding; preserve the
existing missing-script error handling.
| python3 "$PAYLOAD_BLOCKING" \ | ||
| --org <org> --repo <repo> --pr <pr> \ | ||
| --start <since> \ | ||
| --streams <stream> [<stream> ...] \ | ||
| --verbose --show-jobs |
There was a problem hiding this comment.
🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win
Do not use angle-bracket placeholders in executable shell.
--org <org> --repo <repo> --pr <pr> and --streams <stream> [<stream> ...] are interpreted as shell redirections, not arguments. Use quoted shell variables/arrays, or clearly mark this as pseudocode that must be substituted before execution.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@plugins/ci/commands/list-payload-blocking-runs.md` around lines 54 - 58,
Replace the angle-bracket placeholders in the executable command with properly
quoted shell variables or arrays for the organization, repository, PR, and
streams arguments; alternatively, explicitly label the snippet as pseudocode
requiring substitution before execution.
| for fut in as_completed(futures): | ||
| done += 1 | ||
| if done % 50 == 0 or done == len(urls): | ||
| print(f" {done}/{len(urls)} done", file=sys.stderr) | ||
| results.append(fut.result()) |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win
One unparseable URL aborts the entire run.
parse_url raises ValueError on a line that doesn't match _URL_RE; that exception surfaces through fut.result() and terminates the whole loop, discarding every completed result. A single malformed line in the input file loses all work. Consider catching per-run failures and recording them as an error row instead.
🛡️ Example handling
- for fut in as_completed(futures):
- done += 1
- if done % 50 == 0 or done == len(urls):
- print(f" {done}/{len(urls)} done", file=sys.stderr)
- results.append(fut.result())
+ for fut in as_completed(futures):
+ done += 1
+ if done % 50 == 0 or done == len(urls):
+ print(f" {done}/{len(urls)} done", file=sys.stderr)
+ line = futures[fut]
+ try:
+ results.append(fut.result())
+ except Exception as exc: # noqa: BLE001
+ print(f"WARNING: skipping {line!r}: {exc}", file=sys.stderr)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@plugins/ci/skills/kubelet-version-check/get_kubestat.py` around lines 263 -
267, Handle exceptions from each future independently in the loop consuming
`as_completed(futures)`: wrap `fut.result()` in a try/except, catch the parsing
failure such as `ValueError`, and append an error row matching the existing
result schema instead of aborting. Preserve progress reporting and continue
processing all remaining URLs.
| widths = [ | ||
| max(len(hdr[i]), *(len(r[i]) for r in results)) for i in range(4) | ||
| ] |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
Crash on empty input: max() receives a single int.
When results is empty (empty/all-blank input file), *(len(r[i]) for r in results) expands to nothing, so this becomes max(len(hdr[i])) — a single int argument — which raises TypeError: 'int' object is not iterable. The tool aborts instead of printing an empty table.
🐛 Proposed fix
- widths = [
- max(len(hdr[i]), *(len(r[i]) for r in results)) for i in range(4)
- ]
+ widths = [
+ max([len(hdr[i]), *(len(r[i]) for r in results)]) for i in range(4)
+ ]📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| widths = [ | |
| max(len(hdr[i]), *(len(r[i]) for r in results)) for i in range(4) | |
| ] | |
| widths = [ | |
| max([len(hdr[i]), *(len(r[i]) for r in results)]) for i in range(4) | |
| ] |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@plugins/ci/skills/kubelet-version-check/get_kubestat.py` around lines 272 -
274, Update the width calculation in get_kubestat.py so it handles an empty
results collection without calling max() with only a single integer. In the
table-formatting logic around widths, compute each column width from the header
plus any available row lengths, preserving header-only widths when results is
empty so the tool can print an empty table.
| KUBELET_CHECK="${CLAUDE_PLUGIN_ROOT}/skills/kubelet-version-check/get_kubestat.py" | ||
| if [ ! -f "$KUBELET_CHECK" ]; then | ||
| KUBELET_CHECK=$(find ~/.claude/plugins -type f -path "*/ci/skills/kubelet-version-check/get_kubestat.py" 2>/dev/null | sort | head -1) | ||
| fi | ||
| if [ -z "$KUBELET_CHECK" ] || [ ! -f "$KUBELET_CHECK" ]; then echo "ERROR: get_kubestat.py not found" >&2; exit 2; fi |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Remove the fallback that executes code from ~/.claude/plugins.
This searches an agent configuration directory and executes whichever matching file sorts first. A stale or attacker-controlled plugin can run with the user’s credentials. Use only CLAUDE_PLUGIN_ROOT or another explicitly trusted script path.
🧰 Tools
🪛 SkillSpector (2.3.7)
[error] 51: [AS1] Agent Config Directory Access: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Remediation: Remove all code or instructions that access agent configuration directories (.claude/, .codex/, .gemini/). If configuration values are needed, pass them explicitly as parameters or environment variables — never read the agent's own config files.
(Agent Snooping (AS1))
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@plugins/ci/skills/kubelet-version-check/SKILL.md` around lines 49 - 53,
Remove the ~/.claude/plugins fallback from the KUBELET_CHECK initialization. Use
only the script under CLAUDE_PLUGIN_ROOT (or another explicitly trusted fixed
path), then retain the existence check and error exit without searching or
executing files from the agent configuration directory.
Source: Linters/SAST tools
| ## Error Handling | ||
|
|
||
| The script handles each run independently rather than aborting the whole batch; per-run problems are reported inline in that run's row: | ||
|
|
||
| - **Unparseable URL**: raises a `ValueError` for that line (fix or remove the offending URL). | ||
| - **Missing `finished.json`**: status is reported as `unknown`. | ||
| - **No e2e step directory**: kubelet version is `no e2e step`. | ||
| - **No nodes artifact**: kubelet version is `no nodes file`. | ||
| - **Version doesn't match the expected `v1.3x` pattern**: reported as `unexpected: <value>` so anomalies stand out. |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win
Align the documented error handling with the implementation.
The skill promises per-run inline errors, but parse_url() can raise ValueError and main() propagates fut.result(), so one malformed URL aborts the batch instead of producing an inline row. Catch and convert that exception in the script, or document batch termination accurately.
🧰 Tools
🪛 SkillSpector (2.3.7)
[error] 51: [AS1] Agent Config Directory Access: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Remediation: Remove all code or instructions that access agent configuration directories (.claude/, .codex/, .gemini/). If configuration values are needed, pass them explicitly as parameters or environment variables — never read the agent's own config files.
(Agent Snooping (AS1))
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@plugins/ci/skills/kubelet-version-check/SKILL.md` around lines 96 - 104, The
documented per-run error handling does not match the implementation because
ValueError from parse_url() propagates through main() via fut.result(). Update
the script so main() catches per-run parse_url() failures and emits an inline
error row while continuing other runs, then keep the Error Handling
documentation aligned with that behavior.
| PAYLOAD_BLOCKING=$(find ~/.claude/plugins -type f -path "*/ci/skills/payload-blocking-runs/payload_blocking_runs.py" 2>/dev/null | sort | head -1) | ||
| fi | ||
| if [ -z "$PAYLOAD_BLOCKING" ] || [ ! -f "$PAYLOAD_BLOCKING" ]; then echo "ERROR: payload_blocking_runs.py not found" >&2; exit 2; fi |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Remove the fallback that executes code from ~/.claude/plugins.
This searches an agent configuration directory and executes whichever matching file sorts first. A stale or attacker-controlled plugin can therefore run with the user’s credentials. Use only CLAUDE_PLUGIN_ROOT or an explicitly trusted script path, and fail closed otherwise.
🧰 Tools
🪛 SkillSpector (2.3.7)
[error] 46: [AS1] Agent Config Directory Access: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Remediation: Remove all code or instructions that access agent configuration directories (.claude/, .codex/, .gemini/). If configuration values are needed, pass them explicitly as parameters or environment variables — never read the agent's own config files.
(Agent Snooping (AS1))
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@plugins/ci/skills/payload-blocking-runs/SKILL.md` around lines 46 - 48,
Remove the ~/.claude/plugins fallback lookup from the PAYLOAD_BLOCKING
initialization. Resolve the script only through CLAUDE_PLUGIN_ROOT or another
explicitly trusted path, and retain the validation that fails closed when no
valid payload_blocking_runs.py is found.
Source: Linters/SAST tools
openshift-ci
Bot
added
the
needs-rebase
|
PR needs rebase. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
1 participant
Summary
Adds two new skills (with scripts) and two new commands to the
ciplugin to support analyzing blocking/payloadjob runs against a PR and verifying which kubelet version they ran with.These compose into a pipeline for questions like: "For blocking jobs running against a rebase PR since , did they succeed and run with the rebased kubelet?"
What's added
Skill:
payload-blocking-runspayload_blocking_runs.pyqueries BigQuery (openshift-gce-devel.ci_analysis_us.jobs) for/payloadjob runs against a given org/repo/PR over a time window, then filters to the blocking set by fetchingresults.blockingJobsfrom the release controller API for the specified release streams and matching test-name suffixes. Emits sorted gcsweb artifact URLs.--org --repo --pr --start --end --streams --all-jobs --show-jobs -v -o--verbosesurfaces which suffixes were extracted and which jobs did/didn't match — the recommended way to validate filter accuracy when the blocking set changes over timegoogle-cloud-bigquery,requests; BigQuery ADC authSkill:
kubelet-version-checkget_kubestat.pytakes a text file of gcsweb URLs (one per line) and, for each run, readsfinished.json(status) and thegather-extra/artifacts/oc_cmds/nodesartifact (kubelet version), emitting a table of job / build_id / status / kubelet_version. Stdlib-only, 24-worker threadpool, optionalGOOGLE_APPLICATION_CREDENTIALS.Commands
/ci:list-payload-blocking-runs <org/repo#pr> [--since] [--streams ...]— runs the skill and adds AI reasoning: coverage-gap analysis (blocking jobs with zero runs) and next steps/ci:check-kubelet-versions <payload-runs.txt>— runs the skill and adds AI reasoning: kubelet-version consistency, flags unexpected/missing versions, correlates version with pass/failHousekeeping
plugins/ci/.claude-plugin/plugin.json0.0.68→0.0.69make updatesyncedmarketplace.jsonand regenerated docsmake lintpasses (Grade: A+, 0 errors/warnings); both scripts passpy_compileNotes for reviewers
payload_blocking_runs.pyscript was reconstructed from a working ad-hoc version; please sanity-check the BQ query and suffix-derivation logic against your expectations.get_kubestat.pyuses optional service-account JSON. Harmonizing these could be a nice follow-up.Summary by CodeRabbit
/payloadtest runs for a pull request.