Add k8s-rebase plugin for Kubernetes dependency rebases - #617
Conversation
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: dfarrell07 The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
needs-ok-to-test
|
Hi @dfarrell07. Thanks for your PR. I'm waiting for a openshift-eng member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
openshift-ci
Bot
added
approved
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughAdds and registers the ChangesKubernetes rebase plugin
Estimated code review effort: 5 (Critical) | ~120 minutes ✨ Finishing Touches🧪 Generate unit tests (beta)
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 11
🧹 Nitpick comments (4)
plugins/k8s-rebase/scripts/k8s-rebase-autofix.sh (1)
111-114: 🔒 Security & Privacy | 🔵 Trivial | 💤 Low valueHarden the in-container
jqdownload. The binary is fetched over the network and executed without integrity verification, and/tmp/jqis a predictable path (symlink/TOCTOU-prone on shared hosts). Since it's the official jqlang release running in an ephemeral container the risk is limited, but consider pinning and checking a known SHA-256 (and/ormktemp) beforechmod +x.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/k8s-rebase/scripts/k8s-rebase-autofix.sh` around lines 111 - 114, Harden the jq installation block by downloading to a unique temporary path via mktemp, verifying the downloaded binary against a pinned known SHA-256 checksum, and only then making it executable and adding its directory to PATH. Update the existing command chain guarded by command -v jq; remove the predictable /tmp/jq path and ensure verification failure prevents execution or PATH export.Source: Linters/SAST tools
plugins/k8s-rebase/scripts/k8s-rebase-validate.sh (2)
79-88: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winScope
--privilegedto modes that actually need it.The container is launched with
--privileged(and--security-opt label=disable) unconditionally, including--quick(build+vet) and--no-test, which never need elevated capabilities. Only privileged/namespace tests (--full, and the default mode's network tests) require it. Gate--privilegedon the mode to reduce the blast radius for the common build/vet path.♻️ Suggested approach
+ PRIV_FLAG="" + case "$MODE" in + full|default) PRIV_FLAG="--privileged" ;; + esac exec $CONTAINER_RT run --rm \ --security-opt label=disable \ - --privileged \ + $PRIV_FLAG \ $USERNS_FLAG \🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/k8s-rebase/scripts/k8s-rebase-validate.sh` around lines 79 - 88, Update the container invocation in the validation script so --privileged and its associated security-opt label=disable are included only for modes requiring namespace or network tests: --full and the default mode. Omit both options for --quick and --no-test while preserving the existing run arguments and behavior.
240-241: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winHarden env extraction from
test-go.sh(avoideval).
eval "$(grep "^export KUBE_FEATURE_" "$TEST_GO_SH")"re-parses lines from the target repo'shack/test-go.shas shell code; a craftedexport KUBE_FEATURE_X=...; <cmd>line would execute. The same concatenate-into-bash -cpattern recurs at Lines 405 and 588. Since the tool already runs that repo's build/test targets the incremental risk is limited, but prefer parsingKEY=valuepairs and exporting them directly rather than executing arbitrary content.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/k8s-rebase/scripts/k8s-rebase-validate.sh` around lines 240 - 241, Replace the eval-based environment extraction in the TEST_GO_SH handling and the corresponding logic at the later occurrences with safe parsing of only KUBE_FEATURE_ KEY=value assignments, then export each validated key/value directly. Ensure crafted values or appended commands from test-go.sh are treated as data and never executed, while preserving the intended feature-variable imports.plugins/k8s-rebase/gates/step3-autofix/e2e-infra.md (1)
7-10: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winTie the KubeVirt requirement to the target version matrix.
“Latest stable release” is a moving acceptance criterion: it can reject a valid pinned version or force an unrelated dependency upgrade. Require the exact version prescribed by the patterns document or target repository matrix, with “not nightly” as the additional constraint.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/k8s-rebase/gates/step3-autofix/e2e-infra.md` around lines 7 - 10, Update the KubeVirt checklist item in the step3-autofix requirements to require the exact version specified by the patterns document or target repository version matrix, while retaining the constraint that it must not be a nightly release; remove the vague “latest stable release” wording.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@plugins/k8s-rebase/gates/step3-autofix/dep-release-notes.md`:
- Around line 6-13: The release-note sources in the step 3 instructions are
incomplete and mutable. Update the KIND and KubeVirt GitHub API retrieval to
paginate through all release pages, pin MetalLB and golangci-lint raw URLs to
the requested version’s tag or commit instead of main, and explicitly report
when a requested version cannot be found.
In `@plugins/k8s-rebase/gates/step3-autofix/feature-gates.md`:
- Around line 1-6: Update the feature-gate verification instructions to filter
GATE_DEPS using the same active-gate logic as k8s-rebase-autofix.sh, considering
only gate symbols present under vendor/k8s.io. Count missing gates only among
those active dependencies while preserving the existing comparisons across
SetFromMap, os.Setenv/t.Setenv, and hack/test-go.sh exports.
In `@plugins/k8s-rebase/gates/step4-verification/build-vet-recheck.md`:
- Line 11: Update the verification command in the build-and-vet step so go vet
./... executes regardless of whether go build ./... fails; replace the &&
chaining between these checks with independent execution while preserving the
existing output handling, directory change, and combined failure reporting.
In `@plugins/k8s-rebase/gates/step4-verification/ci-prediction.md`:
- Around line 18-23: Update the stale codegen guidance in step4 verification to
remove the requirement for a dedicated codegen commit. Prefer running the
repository’s verify-update-codegen or equivalent diff verification when
available, and treat git log history only as supporting evidence while allowing
generated output in squashed or combined commits.
In `@plugins/k8s-rebase/gates/step4-verification/cleanliness.md`:
- Around line 3-4: Update the root-owned entry count command in the cleanliness
verification step to include the find predicate -type f, while preserving the
existing .git and vendor exclusions and user filter.
In `@plugins/k8s-rebase/gates/step4-verification/dep-cve-check.md`:
- Line 6: Update the dependency scan command in the verification step to process
every unique changed module instead of truncating output with head -50. Remove
the cap or implement batching/pagination that still queries the complete module
list.
In `@plugins/k8s-rebase/gates/step4-verification/deprecated-imports.md`:
- Around line 11-12: Replace the broad golang.org/x/exp grep in
plugins/k8s-rebase/gates/step4-verification/deprecated-imports.md:11-12 with
checks derived from the package-level x/exp migration map, flagging only
packages that have explicit replacements. Update
plugins/k8s-rebase/gates/step4-verification/go-version-check.md:20-23 to reuse
that same map while keeping x/slices and x/maps checks conditional on the
detected Go version.
In `@plugins/k8s-rebase/gates/step4-verification/gomod-diff-analysis.md`:
- Around line 17-19: Update the step4-verification reporting instructions to
require output for every classification the prompt asks agents to evaluate,
including pseudo-version pins, dependency additions/removals, and go directive
changes, rather than only counts for third-party minor-version jumps and
pre-release direct dependencies. Preserve the informational review guidance for
each reported category.
In `@plugins/k8s-rebase/gates/step4-verification/k8s-changelog.md`:
- Around line 1-2: Update the changelog retrieval command to use curl’s --fail
and --show-error options, explicitly report and fail when the changelog is
unavailable or empty, and replace the mutable master URL with a stable
Kubernetes release tag or commit while preserving the K8S_MINOR-based changelog
path.
In `@plugins/k8s-rebase/gates/step4-verification/version-completeness.md`:
- Line 3: Update the file-scope statement in version-completeness.md to include
.yaml alongside .yml, ensuring the scan covers both YAML extensions while
preserving the existing exclusions and count-gate behavior.
In `@plugins/k8s-rebase/README.md`:
- Line 45: Update the gate prompt file count in the README table to 29 files,
matching the gate totals documented in SKILL.md and the PR description; leave
the path and description unchanged.
---
Nitpick comments:
In `@plugins/k8s-rebase/gates/step3-autofix/e2e-infra.md`:
- Around line 7-10: Update the KubeVirt checklist item in the step3-autofix
requirements to require the exact version specified by the patterns document or
target repository version matrix, while retaining the constraint that it must
not be a nightly release; remove the vague “latest stable release” wording.
In `@plugins/k8s-rebase/scripts/k8s-rebase-autofix.sh`:
- Around line 111-114: Harden the jq installation block by downloading to a
unique temporary path via mktemp, verifying the downloaded binary against a
pinned known SHA-256 checksum, and only then making it executable and adding its
directory to PATH. Update the existing command chain guarded by command -v jq;
remove the predictable /tmp/jq path and ensure verification failure prevents
execution or PATH export.
In `@plugins/k8s-rebase/scripts/k8s-rebase-validate.sh`:
- Around line 79-88: Update the container invocation in the validation script so
--privileged and its associated security-opt label=disable are included only for
modes requiring namespace or network tests: --full and the default mode. Omit
both options for --quick and --no-test while preserving the existing run
arguments and behavior.
- Around line 240-241: Replace the eval-based environment extraction in the
TEST_GO_SH handling and the corresponding logic at the later occurrences with
safe parsing of only KUBE_FEATURE_ KEY=value assignments, then export each
validated key/value directly. Ensure crafted values or appended commands from
test-go.sh are treated as data and never executed, while preserving the intended
feature-variable imports.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: ec127345-a4c1-4949-b911-15f3f492325c
📒 Files selected for processing (41)
.claude-plugin/marketplace.jsondocs/index.htmlplugins/k8s-rebase/.claude-plugin/plugin.jsonplugins/k8s-rebase/OWNERSplugins/k8s-rebase/README.mdplugins/k8s-rebase/docs/k8s-rebase-patterns.mdplugins/k8s-rebase/gates/step1-rebase/rebase-completeness.mdplugins/k8s-rebase/gates/step2-compilation/build-vet.mdplugins/k8s-rebase/gates/step2-compilation/diff-scope.mdplugins/k8s-rebase/gates/step2-compilation/fix-correctness.mdplugins/k8s-rebase/gates/step2-compilation/type-conversions.mdplugins/k8s-rebase/gates/step2-compilation/version-consistency.mdplugins/k8s-rebase/gates/step3-autofix/autofix-diff-review.mdplugins/k8s-rebase/gates/step3-autofix/autofix-result.mdplugins/k8s-rebase/gates/step3-autofix/crd-validation.mdplugins/k8s-rebase/gates/step3-autofix/dep-release-notes.mdplugins/k8s-rebase/gates/step3-autofix/deprecated-api-remnants.mdplugins/k8s-rebase/gates/step3-autofix/e2e-infra.mdplugins/k8s-rebase/gates/step3-autofix/feature-gates.mdplugins/k8s-rebase/gates/step3-autofix/logical-completeness.mdplugins/k8s-rebase/gates/step3-autofix/patterns-completeness.mdplugins/k8s-rebase/gates/step4-verification/build-vet-recheck.mdplugins/k8s-rebase/gates/step4-verification/ci-prediction.mdplugins/k8s-rebase/gates/step4-verification/ci-readiness.mdplugins/k8s-rebase/gates/step4-verification/cleanliness.mdplugins/k8s-rebase/gates/step4-verification/commit-messages.mdplugins/k8s-rebase/gates/step4-verification/correctness.mdplugins/k8s-rebase/gates/step4-verification/dep-cve-check.mdplugins/k8s-rebase/gates/step4-verification/deprecated-imports.mdplugins/k8s-rebase/gates/step4-verification/go-version-check.mdplugins/k8s-rebase/gates/step4-verification/gomod-diff-analysis.mdplugins/k8s-rebase/gates/step4-verification/k8s-changelog.mdplugins/k8s-rebase/gates/step4-verification/logical-consistency.mdplugins/k8s-rebase/gates/step4-verification/maintainer-review.mdplugins/k8s-rebase/gates/step4-verification/version-completeness.mdplugins/k8s-rebase/scripts/k8s-rebase-autofix.shplugins/k8s-rebase/scripts/k8s-rebase-review-prompt.mdplugins/k8s-rebase/scripts/k8s-rebase-review.shplugins/k8s-rebase/scripts/k8s-rebase-validate.shplugins/k8s-rebase/scripts/k8s-rebase.shplugins/k8s-rebase/skills/k8s-rebase/SKILL.md
| - KIND: gh api repos/kubernetes-sigs/kind/releases (has explicit | ||
| "Breaking Changes" headings in .body) | ||
| - MetalLB: curl the in-repo release notes at | ||
| raw.githubusercontent.com/metallb/metallb/main/website/content/release-notes/_index.md | ||
| - KubeVirt: gh api repos/kubevirt/kubevirt/releases (tagged by | ||
| SIG — focus on SIG-network, Deprecation, API change) | ||
| - golangci-lint: curl CHANGELOG.md from the repo | ||
| raw.githubusercontent.com/golangci/golangci-lint/main/CHANGELOG.md |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Make release-note retrieval complete and reproducible.
The GitHub API calls omit pagination, so releases outside the default first page can be missed. The raw URLs also point at mutable main branches, making gate results non-reproducible. Paginate API results, use tag/commit-pinned sources, and report when the requested versions cannot be found.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@plugins/k8s-rebase/gates/step3-autofix/dep-release-notes.md` around lines 6 -
13, The release-note sources in the step 3 instructions are incomplete and
mutable. Update the KIND and KubeVirt GitHub API retrieval to paginate through
all release pages, pin MetalLB and golangci-lint raw URLs to the requested
version’s tag or commit instead of main, and explicitly report when a requested
version cannot be found.
| If test files use feature gates (SetFromMap or KUBE_FEATURE_ | ||
| env vars): find `k8s-rebase-autofix.sh` and read the GATE_DEPS | ||
| map near the top. Count files missing any gate from that map. Verify | ||
| gates match between SetFromMap calls, os.Setenv/t.Setenv | ||
| calls, and hack/test-go.sh exports. Report count of files | ||
| with missing gates. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Filter GATE_DEPS to gates active in the vendored Kubernetes version.
k8s-rebase-autofix.sh only considers parent/dependent gates whose symbols exist under vendor/k8s.io. This gate currently says to check “any gate from that map,” which can produce false failures for future gates on older targets. Mirror the script’s active-gate filtering before counting missing files.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@plugins/k8s-rebase/gates/step3-autofix/feature-gates.md` around lines 1 - 6,
Update the feature-gate verification instructions to filter GATE_DEPS using the
same active-gate logic as k8s-rebase-autofix.sh, considering only gate symbols
present under vendor/k8s.io. Count missing gates only among those active
dependencies while preserving the existing comparisons across SetFromMap,
os.Setenv/t.Setenv, and hack/test-go.sh exports.
| Read the Kubernetes changelog for the target minor version: | ||
| curl -sL "https://raw.githubusercontent.com/kubernetes/kubernetes/master/CHANGELOG/CHANGELOG-1.${K8S_MINOR}.md" |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
Make changelog retrieval fail closed.
curl -sL does not fail on HTTP 404, so an unavailable changelog can be treated as an empty result and incorrectly pass the gate. Use --fail --show-error, report unavailable data explicitly, and pin the source to a stable Kubernetes tag or commit instead of master.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@plugins/k8s-rebase/gates/step4-verification/k8s-changelog.md` around lines 1
- 2, Update the changelog retrieval command to use curl’s --fail and
--show-error options, explicitly report and fail when the changelog is
unavailable or empty, and replace the mutable master URL with a stable
Kubernetes release tag or commit while preserving the K8S_MINOR-based changelog
path.
| | `scripts/k8s-rebase-validate.sh` | Build/lint/vet/test across all modules | | ||
| | `scripts/k8s-rebase-review.sh` | Antagonistic review via `claude -p` | | ||
| | `scripts/k8s-rebase-review-prompt.md` | Review agent prompt template | | ||
| | `gates/step{1,2,3,4}-*/*.md` | Subagent verification prompts (23 files) | |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Gate file count is inaccurate. SKILL.md enumerates 29 gate prompts (step1=1, step2=5, step3=9, step4=14), and the PR description also says 29. Update "23 files" to match.
✏️ Proposed fix
-| `gates/step{1,2,3,4}-*/*.md` | Subagent verification prompts (23 files) |
+| `gates/step{1,2,3,4}-*/*.md` | Subagent verification prompts (29 files) |📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| | `gates/step{1,2,3,4}-*/*.md` | Subagent verification prompts (23 files) | | |
| | `gates/step{1,2,3,4}-*/*.md` | Subagent verification prompts (29 files) | |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@plugins/k8s-rebase/README.md` at line 45, Update the gate prompt file count
in the README table to 29 files, matching the gate totals documented in SKILL.md
and the PR description; leave the path and description unchanged.
| CONTRIBUTING.md). If the PR already exists, suggest `gh pr edit`. | ||
|
|
||
| Always suggest the CI monitoring loop alongside the PR command: | ||
| `/loop 5m check CI on the PR, explore any failures max carefully, find root causes` |
There was a problem hiding this comment.
As per our meeting you mentioned that the loop check the CI logs and errors.
However these are my findings from this updated PR which is the same as raised earlier that I don't find a logic for the loop.
From what I see is that the skill doesn't catch e2e-level breakage. It is not even defined in ai-helpers.
I also see there is no gh run, gh pr checks or or CI-log fetching in this plugin.
I even check the gates ci-prediction and ci-readiness and saw that it greps the repo and does not read CI.
I see that the skill only checks build, vet, lint and unit tests and it never runs e2e.
k8s-rebase-validate.sh runs go build (L346), go vet, golangci-lint (L365) and go test on the packages (L310). The test/e2e module is skipped at L339–342 because its vendor dir is gitignored, and nothing in the plugin ever starts a kind cluster or runs ginkgo. right ?
The problem is that the agent decides it's finished when these checks pass. So the rebase can look completely done and green, while still being broken. This is because the things that actually break an ovnk rebase don't show up in a build or a lint.
These issues will only show up when a real cluster is running the e2e suite like the test for RelaxedServiceNameValidation from k8s 1.36 binary, the KubeVirt live-migration lanes, the MetalLB/FRR image mismatch issue, kubeadm settings silently not applying, etc.
However please correct if I am wrong. cc @vinnie1110 @Jaanki
There was a problem hiding this comment.
I see that the Step 5 in SKILL.md is where the skill stops and has the following:
"Generate a gh pr create command for the user. Do NOT run it. Read git log to build the title and body, then present the complete command for the user to review, edit, and execute."
then
"Always suggest the CI monitoring loop alongside the PR command:
/loop 5m check CI on the PR, explore any failures max carefully, find root causes"
then rm -rf .rebase-tmp/, and the skill ends.
So the skill prints two strings and exits. It doesn't open the PR, and it doesn't run /loop.
So someone has to manually create a PR using gh pr create and type type /loop 5m ... into the session, which re-prompts the agent every 5 minutes with that sentence.
Then I see agent does things by itself like run gh pr checks to find failing jobs, gh run view --log-failed to pull the logs, gh run download for the ginkgo artifacts, then reads them and decides what broke.
So, the point is this step is not really a part of the skill. Nothing calls it, no subagent runs it, nothing checks what it found. The skill only does build, vet, lint and unit tests locally. It skips e2e test whose failures can break ovn-k rebase.
In short this is manual process done by human who executes this command may be in claude code console which keeps on running by agent.
But I can understand that sometimes running e2e needs real clusters and running it locally isn't realistic.
However I think CI is where the actual validation happens and right now it is outside the skill.
Can we add it in a deterministic stage instead of a suggestion ?
There was a problem hiding this comment.
For k8s 1.36, all the breakage patterns you listed are already encoded in the autofix scripts. fix_relaxed_service_name_validation, fix_kubevirt_version, fix_metallb_version, fix_kubeadm_v1beta4 all fire on every rebase (no-op on repos without the relevant files). The ovnk PR is CI green including kv-live-migration, BGP, and conformance. The skill doesn't need to run e2e to catch these, it prevents the failures before CI ever runs.
The harder question is k8s 1.37, where there will be new patterns nobody has seen yet. That's where the gate subagents matter most. The k8s-changelog gate reads the 1.37 release notes filtered by SIG Network and API Machinery and flags breaking changes that have no existing autofix pattern. The dep-release-notes gate reads changelogs for ecosystem deps like KIND, MetalLB, KubeVirt, and golangci-lint and flags incompatibilities between the old and new versions. The dep-cve gate scans whatever dependency versions 1.37 pins against the OSV vulnerability database. None of this content exists until the release, so it can't be scripted in advance.
For 1.36 the skill already prevents several issues that human reviewers had to flag on the manual PRs. The SKILL.md has explicit guidelines against adding config file comments that explain the PR (which danwinship flagged on openshift/cluster-network-operator#3017) and against commit messages that reference issue/PR numbers (which danwinship flagged for spamming GitHub notifications on the same PR). The version-consistency gate (step2) prevents partial module skew like openshift/cloud-network-config-controller#223 where kube-aggregator was left at v0.36.1 while all other k8s.io modules were at v0.36.2.
When something does slip through to CI, a genuinely novel pattern, the user runs /loop 5m check CI on the PR, explore any failures max carefully, find root causes and the agent reads the failure logs and investigates. The fix gets documented in the patterns doc and encoded as an autofix function. The next repo gets it automatically. That's how the 1.36 patterns got built in the first place: by running the skill on ovnk, finding what broke, fixing it, and documenting it. Now all 6 CORENET repos benefit from those patterns without discovering them independently.
Running e2e locally would need clusters and hours of compute. CI is the right place for that. The skill maximizes local coverage (build, vet, lint, unit tests, 30 gate checks) and uses /loop to close the CI feedback loop.
There was a problem hiding this comment.
Making CI monitoring a deterministic stage inside the skill would mean the skill pushes code to remote repos and triggers CI runs autonomously. The skill avoids this by design: the gh pr create command is generated but the skill does not run it, so the human controls what gets pushed and when. A rebase can produce a correct branch that the human decides not to push yet (waiting for library-go, coordinating with other PRs, etc.). Baking push+monitor into the skill removes that control.
/loop is a Claude Code built-in. The SKILL.md suggests /loop 5m check CI on the PR, explore any failures max carefully, find root causes after the user pushes. The agent runs gh pr checks, reads failure logs, and investigates root causes every 5 minutes until stopped. The user types one command and the agent handles the monitoring cycle.
There was a problem hiding this comment.
Agreed that once a pattern is generated it fires on every rebase, but that's exactly the problem for testing 1.37. These patterns are specific to a handful of ovnk issues (NetworkQoS int64, RelaxedServiceNameValidation, kubeadm v1beta4, MetalLB/FRR). They don't generalise to other repos, and they were seeded from my PR, not discovered by the skill.
You confirmed this yourself:
ovn-kubernetes/ovn-kubernetes#6525 (comment)
ovn-kubernetes/ovn-kubernetes#6525 (comment)
So 1.36 being green just shows those patterns replay. It doesn't test whether the skill can find an ovnk e2e failure on its own because the answers were already in the doc.
The /loop might well fix the 1.37 issues on its own next time that's the thing we actually want to test. So I think we should:
Empty the ovnk e2e patterns that came from my PR, so 1.37 is a real test of whether the skill discovers them rather than replays them.
First ask the human what steps are needed to bump for this repo, and feed that in.
Have the agent look at previous merged commits, not open PRs.
If /loop rediscovers the failures with the patterns emptied, that proves the capability and I'll be the first to say so. If it doesn't, we've learned the skill needs a human e2e pass per new version which is worth knowing before the fleet relies on it.
There was a problem hiding this comment.
Making CI monitoring a deterministic stage inside the skill would mean the skill pushes code to remote repos and triggers CI runs autonomously. The skill avoids this by design: the
gh pr createcommand is generated but the skill does not run it, so the human controls what gets pushed and when. A rebase can produce a correct branch that the human decides not to push yet (waiting for library-go, coordinating with other PRs, etc.). Baking push+monitor into the skill removes that control.
/loopis a Claude Code built-in. The SKILL.md suggests/loop 5m check CI on the PR, explore any failures max carefully, find root causesafter the user pushes. The agent runsgh pr checks, reads failure logs, and investigates root causes every 5 minutes until stopped. The user types one command and the agent handles the monitoring cycle.
The problem with /loop is not that it can't check CI. It can. And I'm fine with the human controlling the push.
The problem is /loop sits outside the skill. The fixes it pushes don't go into summary.txt, get no gate, get no review, and nothing records what it did. So if it fixes an e2e test and commits, we don't know what broke or why it picked that fix.
Also the skill deletes its state (rm -rf .rebase-tmp/) at Step 5, before CI even runs. So when CI fails the to-do list is already gone and /loop starts cold.
I think a Step 6 fixes this and keeps your push design:
Step 6 — check CI, after the human pushes the PR
Wait for CI: gh pr checks --watch. It waits till CI finishes and returns. No 5-minute loop, and it keeps the state.
Get the logs: gh run view --log-failed and gh run download for ginkgo (GitHub Actions). For prow, reuse the ci plugin.
Write each failure into summary.txt, same as a build failure. So it's tracked, not a loose suggestion.
Fix it the same way Steps 2–4 do: patterns doc first, one commit per fix, run the gate on it, run the review on it.
Give the fixes to the human to push. Same control as today. Then wait for CI again.
Delete .rebase-tmp/ only after CI is green. Right now it's deleted at Step 5, which is why the track is lost.
Human still controls the push. Nothing pushes on its own. The only change is the CI fixes now go through the same gates and review as everything else, and we have a record of what broke and why.
If you don't want a long-running run, Step 6 can be a separate command (/k8s-rebase:ci-check ) the user runs when CI is done.
There was a problem hiding this comment.
Also regarding clearing patterns to test 1.36 wont work because there might be a change the /loop agent to check exisiting open bump/rebase PRs.
So, as of now to test skills for bump will be testing k8s 1.37 for ovnk.
There was a problem hiding this comment.
point 6 if implemented can solve the issue of testing 1.36 as it will use the skills which should have, don't look for open PRs, look for only past commits. Also the main re-requisite is the patterns must be clear and the skills must be provided with info on how a human will bump or rebase k8s.
There was a problem hiding this comment.
right now under /loop it's the Claude agent working the e2e tests, not our skill or a subagent. Nothing in the skill drives it or checks it, so we also have no track of which commits were made for which issue when the loop is involved.
0b218ca to
c30d11d
Compare
There was a problem hiding this comment.
Actionable comments posted: 9
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@plugins/k8s-rebase/gates/step1-rebase/rebase-completeness.md`:
- Around line 6-9: Update the uncommitted-changes counting guidance in
rebase-completeness.md to include relevant untracked (??) generated or vendored
outputs, while filtering only unrelated pre-existing untracked files. Preserve
detection of staged-but-uncommitted go.mod, vendor, and generated files as
commit-step failures.
- Around line 10-16: Update the commit-counting procedure in the “Rebase
commits” section to inspect only commits from the current rebase attempt, using
the recorded rebase range or a run-specific manifest instead of the entire
branch history. Apply this scope consistently to Rebase, Codegen, and Version
refs commit checks.
In `@plugins/k8s-rebase/gates/step3-autofix/crd-validation.md`:
- Around line 3-4: Update the file-counting step in the CRD validation
instructions to inspect parsed YAML schema objects rather than relying on
adjacent lines. Identify objects containing both format: int32 and maximum:
4294967295 regardless of comments, blank lines, key order, or intervening
properties, and count those requiring format: int64.
- Around line 5-8: Update the CRD comparison instructions to derive the actual
merge base or target ref from the repository state instead of hardcoding a
main-then-master fallback. Use that resolved ref with git show when checking the
original CRD definitions, preserving the metadata.name pattern validation
comparison.
- Around line 1-2: Update the CRD discovery instructions in the “If CRD YAMLs
exist in helm/*/crds/” section so a missing helm/*/crds/ directory does not
produce a zero result or skip validation. Discover CRDs across the repository,
or require explicit target paths, and preserve validation for CRDs located
outside Helm directories.
In `@plugins/k8s-rebase/scripts/k8s-rebase-review-prompt.md`:
- Around line 7-23: Update the prompt template around ORIGINAL_ERROR, DIFF,
K8S_CHANGELOG, and PATTERN_HINT to explicitly classify all interpolated content
as untrusted data, never instructions. Add clear, unambiguous delimiters around
each rendered evidence block and instruct Claude to ignore any directives
embedded within them before determining the final verdict.
- Around line 11-15: Update the review prompt around the `${DIFF}` placeholder
to state that the input may contain only selected files or be truncated, and
require the reviewer to fail closed when the diff is incomplete. Ensure the
prompt requests all relevant dependency/build files and later hunks, and defines
an explicit truncation marker that must trigger rejection rather than approval.
In `@plugins/k8s-rebase/scripts/k8s-rebase-validate.sh`:
- Around line 90-99: Update the auto-containerize re-exec command in the
validation script to pass --privileged only when MODE_FLAG selects --full, using
the same conditional gating pattern as USERNS_FLAG. Ensure quick, no-test,
test-only, and default modes omit the privileged option while preserving
full-mode behavior.
In `@plugins/k8s-rebase/scripts/k8s-rebase.sh`:
- Around line 643-649: Restrict the bare-version replacement in the Pass 2 loop
to Kubernetes-specific documentation or lines with Kubernetes context, rather
than all Markdown files under docs/. Update both the file-selection grep and
replacement matching around OLD_SHORT so unrelated values such as percentages or
longer versions like 1.35.0 remain unchanged, while preserving replacements for
standalone Kubernetes prose versions.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 564aa843-28a9-4051-8865-5728bbf2a0bc
📒 Files selected for processing (41)
.claude-plugin/marketplace.jsondocs/index.htmlplugins/k8s-rebase/.claude-plugin/plugin.jsonplugins/k8s-rebase/OWNERSplugins/k8s-rebase/README.mdplugins/k8s-rebase/docs/k8s-rebase-patterns.mdplugins/k8s-rebase/gates/step1-rebase/rebase-completeness.mdplugins/k8s-rebase/gates/step2-compilation/build-vet.mdplugins/k8s-rebase/gates/step2-compilation/diff-scope.mdplugins/k8s-rebase/gates/step2-compilation/fix-correctness.mdplugins/k8s-rebase/gates/step2-compilation/type-conversions.mdplugins/k8s-rebase/gates/step2-compilation/version-consistency.mdplugins/k8s-rebase/gates/step3-autofix/autofix-diff-review.mdplugins/k8s-rebase/gates/step3-autofix/autofix-result.mdplugins/k8s-rebase/gates/step3-autofix/crd-validation.mdplugins/k8s-rebase/gates/step3-autofix/dep-release-notes.mdplugins/k8s-rebase/gates/step3-autofix/deprecated-api-remnants.mdplugins/k8s-rebase/gates/step3-autofix/e2e-infra.mdplugins/k8s-rebase/gates/step3-autofix/feature-gates.mdplugins/k8s-rebase/gates/step3-autofix/logical-completeness.mdplugins/k8s-rebase/gates/step3-autofix/patterns-completeness.mdplugins/k8s-rebase/gates/step4-verification/build-vet-recheck.mdplugins/k8s-rebase/gates/step4-verification/ci-prediction.mdplugins/k8s-rebase/gates/step4-verification/ci-readiness.mdplugins/k8s-rebase/gates/step4-verification/cleanliness.mdplugins/k8s-rebase/gates/step4-verification/commit-messages.mdplugins/k8s-rebase/gates/step4-verification/correctness.mdplugins/k8s-rebase/gates/step4-verification/dep-cve-check.mdplugins/k8s-rebase/gates/step4-verification/deprecated-imports.mdplugins/k8s-rebase/gates/step4-verification/go-version-check.mdplugins/k8s-rebase/gates/step4-verification/gomod-diff-analysis.mdplugins/k8s-rebase/gates/step4-verification/k8s-changelog.mdplugins/k8s-rebase/gates/step4-verification/logical-consistency.mdplugins/k8s-rebase/gates/step4-verification/maintainer-review.mdplugins/k8s-rebase/gates/step4-verification/version-completeness.mdplugins/k8s-rebase/scripts/k8s-rebase-autofix.shplugins/k8s-rebase/scripts/k8s-rebase-review-prompt.mdplugins/k8s-rebase/scripts/k8s-rebase-review.shplugins/k8s-rebase/scripts/k8s-rebase-validate.shplugins/k8s-rebase/scripts/k8s-rebase.shplugins/k8s-rebase/skills/k8s-rebase/SKILL.md
🚧 Files skipped from review as they are similar to previous changes (22)
- plugins/k8s-rebase/gates/step4-verification/dep-cve-check.md
- plugins/k8s-rebase/.claude-plugin/plugin.json
- plugins/k8s-rebase/gates/step3-autofix/autofix-diff-review.md
- plugins/k8s-rebase/gates/step4-verification/maintainer-review.md
- .claude-plugin/marketplace.json
- plugins/k8s-rebase/gates/step2-compilation/fix-correctness.md
- plugins/k8s-rebase/gates/step3-autofix/patterns-completeness.md
- plugins/k8s-rebase/gates/step2-compilation/version-consistency.md
- plugins/k8s-rebase/gates/step4-verification/commit-messages.md
- plugins/k8s-rebase/README.md
- plugins/k8s-rebase/gates/step4-verification/cleanliness.md
- plugins/k8s-rebase/OWNERS
- plugins/k8s-rebase/gates/step3-autofix/e2e-infra.md
- plugins/k8s-rebase/gates/step4-verification/deprecated-imports.md
- plugins/k8s-rebase/gates/step2-compilation/type-conversions.md
- plugins/k8s-rebase/gates/step3-autofix/feature-gates.md
- plugins/k8s-rebase/gates/step4-verification/ci-readiness.md
- plugins/k8s-rebase/gates/step3-autofix/logical-completeness.md
- plugins/k8s-rebase/gates/step4-verification/logical-consistency.md
- plugins/k8s-rebase/gates/step4-verification/k8s-changelog.md
- docs/index.html
- plugins/k8s-rebase/gates/step3-autofix/dep-release-notes.md
| 2. Uncommitted changes: count from `git status --short` | ||
| (exclude untracked files with `?`). Any staged-but- | ||
| uncommitted go.mod, vendor, or generated files indicate | ||
| the script's commit step failed. |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Do not ignore relevant untracked outputs.
Excluding every status entry beginning with ? allows newly generated or vendored files to remain uncommitted while producing count 0, contradicting the failure condition described here. Count relevant ?? paths while filtering only unrelated pre-existing files.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@plugins/k8s-rebase/gates/step1-rebase/rebase-completeness.md` around lines 6
- 9, Update the uncommitted-changes counting guidance in rebase-completeness.md
to include relevant untracked (??) generated or vendored outputs, while
filtering only unrelated pre-existing untracked files. Preserve detection of
staged-but-uncommitted go.mod, vendor, and generated files as commit-step
failures.
| 3. Rebase commits: check `git log --oneline` on the current | ||
| branch. Count MISSING expected commits: | ||
| - "Rebase" commits (at least 1 per go.mod with k8s.io deps, | ||
| excluding vendor/) | ||
| - Codegen commit (expected if hack/update-codegen.sh or | ||
| Makefile has generate/manifests/codegen targets) | ||
| - Version refs commit |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift
Scope commit checks to the current rebase attempt.
Searching the entire branch with git log --oneline can satisfy the Rebase, codegen, and version-reference checks using commits from an earlier run. Use the recorded rebase range or a run-specific manifest instead.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@plugins/k8s-rebase/gates/step1-rebase/rebase-completeness.md` around lines 10
- 16, Update the commit-counting procedure in the “Rebase commits” section to
inspect only commits from the current rebase attempt, using the recorded rebase
range or a run-specific manifest instead of the entire branch history. Apply
this scope consistently to Rebase, Codegen, and Version refs commit checks.
| 1. Count files where `format: int32` immediately precedes | ||
| `maximum: 4294967295` (these need format: int64). |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Match CRD schema semantics, not line adjacency.
This detects only the exact adjacent sequence format: int32 followed by maximum: 4294967295. Comments, blank lines, reordered keys, or other schema properties will produce a false zero count. Parse the YAML or inspect the containing schema object.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@plugins/k8s-rebase/gates/step3-autofix/crd-validation.md` around lines 3 - 4,
Update the file-counting step in the CRD validation instructions to inspect
parsed YAML schema objects rather than relying on adjacent lines. Identify
objects containing both format: int32 and maximum: 4294967295 regardless of
comments, blank lines, key order, or intervening properties, and count those
requiring format: int64.
| ## Original Error | ||
|
|
||
| ${ORIGINAL_ERROR} | ||
|
|
||
| ## Fix Diff | ||
|
|
||
| ```diff | ||
| ${DIFF} | ||
| ``` | ||
|
|
||
| ## K8s Release Notes (relevant excerpt) | ||
|
|
||
| ${K8S_CHANGELOG} | ||
|
|
||
| ## Matching Pattern (if any) | ||
|
|
||
| ${PATTERN_HINT} |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Treat interpolated sections as untrusted evidence.
Commit messages, diffs, changelogs, and pattern hints can contain instructions such as APPROVE:. Since the rendered prompt is sent directly to Claude, a malicious change can steer the verdict. Explicitly state that these blocks are data, never instructions, and use unambiguous delimiters before evaluating the final verdict.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@plugins/k8s-rebase/scripts/k8s-rebase-review-prompt.md` around lines 7 - 23,
Update the prompt template around ORIGINAL_ERROR, DIFF, K8S_CHANGELOG, and
PATTERN_HINT to explicitly classify all interpolated content as untrusted data,
never instructions. Add clear, unambiguous delimiters around each rendered
evidence block and instruct Claude to ignore any directives embedded within them
before determining the final verdict.
| ## Fix Diff | ||
|
|
||
| ```diff | ||
| ${DIFF} | ||
| ``` |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Make the review fail closed on partial diffs.
The downstream plugins/k8s-rebase/scripts/k8s-rebase-review.sh only supplies selected file types and truncates ${DIFF} to 2,000 lines, while this template presents it as the complete fix. Dependency/build changes such as go.mod, go.sum, Makefile, or later diff hunks can therefore be approved without review. Include all relevant files and add an explicit truncation marker or reject incomplete input.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@plugins/k8s-rebase/scripts/k8s-rebase-review-prompt.md` around lines 11 - 15,
Update the review prompt around the `${DIFF}` placeholder to state that the
input may contain only selected files or be truncated, and require the reviewer
to fail closed when the diff is incomplete. Ensure the prompt requests all
relevant dependency/build files and later hunks, and defines an explicit
truncation marker that must trigger rejection rather than approval.
| # Pass 2: bare version in doc prose (1.35 without v-prefix) | ||
| while IFS= read -r file; do | ||
| [[ -z "$file" ]] && continue | ||
| sed -i -E "s/\b${OLD_SHORT//./\\.}\b/${NEW_SHORT}/g" "$file" | ||
| CHANGED_FILES+="$file"$'\n' | ||
| info " Updated (short): $file" | ||
| done < <(grep -rln "\b${OLD_SHORT}\b" --include="*.md" docs/ 2>/dev/null | grep -v vendor || true) |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Show the relevant region with line numbers
sed -n '600,690p' plugins/k8s-rebase/scripts/k8s-rebase.sh | cat -n
printf '\n--- SEARCH OLD_SHORT/NEW_SHORT ---\n'
rg -n "OLD_SHORT|NEW_SHORT|OLD_MAJOR|OLD_MINOR|docs/" plugins/k8s-rebase/scripts/k8s-rebase.sh
printf '\n--- DOC FILE PATTERNS IN SCRIPT ---\n'
rg -n "grep -rln|sed -i -E|k8s|kubernetes|docs/" plugins/k8s-rebase/scripts/k8s-rebase.shRepository: openshift-eng/ai-helpers
Length of output: 13032
🏁 Script executed:
python3 - <<'PY'
import subprocess, textwrap, os, tempfile, pathlib, json
samples = [
"Kubernetes 1.35 release notes",
"tool version 1.35%",
"version 1.35.0",
"abc1.35def",
"1.35",
]
pattern = r"\b1\.35\b"
for s in samples:
p = subprocess.run(
["bash", "-lc", f"printf '%s\n' {s!r} | grep -n '{pattern}'"],
capture_output=True, text=True
)
print("GREP", repr(s), "=>", "MATCH" if p.returncode == 0 else "NO")
p2 = subprocess.run(
["bash", "-lc", f"printf '%s\n' {s!r} | sed -E 's/{pattern}/1.36/g'"],
capture_output=True, text=True
)
print("SED ", repr(s), "=>", repr(p2.stdout.strip()))
PYRepository: openshift-eng/ai-helpers
Length of output: 539
🏁 Script executed:
python3 - <<'PY'
import subprocess
samples = [
"Kubernetes 1.35 release notes",
"tool version 1.35%",
"version 1.35.0",
"abc1.35def",
"1.35",
]
pattern = r"\b1\.35\b"
for s in samples:
grep = subprocess.run(
["bash", "-lc", f"printf '%s\n' {s!r} | grep -n '{pattern}'"],
capture_output=True, text=True
)
sed = subprocess.run(
["bash", "-lc", f"printf '%s\n' {s!r} | sed -E 's/{pattern}/1.36/g'"],
capture_output=True, text=True
)
print(repr(s), "GREP=", grep.returncode == 0, "SED=", repr(sed.stdout.strip()))
PYRepository: openshift-eng/ai-helpers
Length of output: 423
Restrict the bare-version docs replace to Kubernetes-specific prose. docs/**/*.md can still contain unrelated 1.35 tokens, and this pass rewrites them too (for example 1.35% and the leading part of 1.35.0). Narrow the match to k8s-specific docs or surrounding context.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@plugins/k8s-rebase/scripts/k8s-rebase.sh` around lines 643 - 649, Restrict
the bare-version replacement in the Pass 2 loop to Kubernetes-specific
documentation or lines with Kubernetes context, rather than all Markdown files
under docs/. Update both the file-selection grep and replacement matching around
OLD_SHORT so unrelated values such as percentages or longer versions like 1.35.0
remain unchanged, while preserving replacements for standalone Kubernetes prose
versions.
c30d11d to
f06d1b9
Compare
There was a problem hiding this comment.
Actionable comments posted: 7
♻️ Duplicate comments (2)
plugins/k8s-rebase/gates/step4-verification/build-vet-recheck.md (1)
11-11: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winRun
go veteven whengo buildfails.Because the commands are chained with
&&, a build failure skipsgo vet, violating the gate’s requirement to run both checks and producing an incomplete error count.
plugins/k8s-rebase/gates/step4-verification/build-vet-recheck.md#L11-L11: replace the command chain with a subshell that executes both checks independently.plugins/k8s-rebase/gates/step2-compilation/build-vet.md#L11-L11: apply the identical subshell replacement to ensurego vetis not skipped on build failure.🛠️ Proposed fix (apply to both files)
- cd "$mod_dir" && go build ./... 2>&1 && go vet ./... 2>&1; cd - + ( + cd "$mod_dir" || exit 1 + go build ./... 2>&1 + go vet ./... 2>&1 + )🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/k8s-rebase/gates/step4-verification/build-vet-recheck.md` at line 11, Update the command at plugins/k8s-rebase/gates/step4-verification/build-vet-recheck.md:11-11 to run go build and go vet independently within a subshell, ensuring go vet executes even if the build fails. Apply the identical replacement at plugins/k8s-rebase/gates/step2-compilation/build-vet.md:11-11.plugins/k8s-rebase/gates/step4-verification/ci-prediction.md (1)
19-24: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winDo not require a dedicated codegen commit in
git log.A valid rebase may include generated output in a squashed or combined commit. Checking
git logcan report a false failure. Update the guidance to prefer diff verification over checking the commit history.🛠️ Proposed update
- Makefile codegen/generate/manifests target exists, check - that git log shows a codegen commit. If the repo has a - `verify-update-codegen` or `verify` CI job, stale output - will fail `git diff --exit-code`. Look for controller-gen - version annotations in CRD manifests matching the vendored - controller-tools version. + Makefile codegen/generate/manifests target exists, verify + that stale output would not fail `git diff --exit-code` if + the repo has a `verify-update-codegen` or `verify` CI job. + Prefer running these verification scripts over checking + git history, as generated output may be part of squashed or + combined commits. Look for controller-gen version annotations + in CRD manifests matching the vendored controller-tools version.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/k8s-rebase/gates/step4-verification/ci-prediction.md` around lines 19 - 24, Update the guidance in the codegen verification section to remove the requirement that git log contain a dedicated codegen commit. Instruct reviewers to prefer verifying generated output through git diff --exit-code or the repository’s existing verify-update-codegen/verify CI job, while retaining the controller-gen version annotation check.
🧹 Nitpick comments (4)
plugins/k8s-rebase/gates/step2-compilation/diff-scope.md (1)
5-6: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueFix markdown formatting for directory paths.
The unescaped underscores in
_output/andthird_party/can trigger markdown rendering issues (MD037: spaces inside emphasis markers). Wrap the paths in backticks to treat them as literal code.🛠️ Proposed fix
-.sh, .j2). Changes in generated/managed directories are also -expected: vendor/, LICENSES/, _output/, third_party/. +.sh, .j2). Changes in generated/managed directories are also +expected: `vendor/`, `LICENSES/`, `_output/`, `third_party/`.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/k8s-rebase/gates/step2-compilation/diff-scope.md` around lines 5 - 6, Update the directory-path list in the compilation diff-scope documentation to wrap `_output/` and `third_party/` in backticks, preserving the existing wording and formatting for the other paths.plugins/k8s-rebase/docs/k8s-rebase-patterns.md (1)
154-154: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueAdd language specifiers to fenced code blocks.
These code blocks lack a language specifier, which triggers
markdownlint(MD040) and degrades syntax highlighting.
plugins/k8s-rebase/docs/k8s-rebase-patterns.md#L154-L154: change```to```textplugins/k8s-rebase/docs/k8s-rebase-patterns.md#L266-L266: change```to```textplugins/k8s-rebase/docs/k8s-rebase-patterns.md#L270-L270: change```to```textplugins/k8s-rebase/docs/k8s-rebase-patterns.md#L294-L294: change```to```textplugins/k8s-rebase/docs/k8s-rebase-patterns.md#L329-L329: change```to```textplugins/k8s-rebase/docs/k8s-rebase-patterns.md#L463-L463: change```to```go.mod🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/k8s-rebase/docs/k8s-rebase-patterns.md` at line 154, Update the fenced code blocks in plugins/k8s-rebase/docs/k8s-rebase-patterns.md at lines 154, 266, 270, 294, and 329 to use the text language specifier, and use the go.mod specifier at line 463. No other content changes are needed.plugins/k8s-rebase/gates/step4-verification/go-version-check.md (1)
20-27: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winAlign this gate's output with the "count" contract other step4 gates use.
SKILL.md lists this as a
(count)gate and requires "All count-checks must be 0," but the prompt only asks to "Report any mismatches or migration opportunities" — unlike sibling count gates (version-completeness.md,gomod-diff-analysis.md) which explicitly say "Report count of X." Free-form prose output makes it harder for the main agent to mechanically verify the zero/non-zero gate result.♻️ Suggested wording
-Report any mismatches or migration opportunities. +Report the count of mismatches and migration opportunities found above (0 = pass).🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/k8s-rebase/gates/step4-verification/go-version-check.md` around lines 20 - 27, Update the x/ package opportunity check in the step4 verification prompt to explicitly require reporting the count of detected mismatches or migration opportunities, while preserving the existing read-only rule and grep scope. Ensure the output is a numeric count so SKILL.md can enforce the zero/non-zero gate contract.plugins/k8s-rebase/scripts/k8s-rebase.sh (1)
37-59: 📐 Maintainability & Code Quality | 🔵 Trivial | 🏗️ Heavy liftContainerize re-exec + commit-style helper logic is copy-pasted across all three scripts with no shared source of truth.
_detect_commit_style/format_msg(k8s-rebase.sh, k8s-rebase-autofix.sh) and the "check Go version → pick podman/docker → re-exec in container" block (all three scripts) are near-identical, hand-duplicated blocks. This isn't just style: the previously-flagged--privilegedscoping fix landed only ink8s-rebase-validate.sh's copy and never propagated, which is exactly the kind of drift this duplication invites.
plugins/k8s-rebase/scripts/k8s-rebase.sh#L37-L59: extract_detect_commit_style/format_msginto a smalllib/rebase-common.shsourced by all three scripts.plugins/k8s-rebase/scripts/k8s-rebase-autofix.sh#L42-L61: source the same shared helper instead of redefining it.plugins/k8s-rebase/scripts/k8s-rebase.sh#L225-L263: extract the podman/docker-detection-and-re-exec block into a shared function parameterized by the script path and extra args.plugins/k8s-rebase/scripts/k8s-rebase-autofix.sh#L79-L113: use the shared re-exec function instead of its own copy.plugins/k8s-rebase/scripts/k8s-rebase-validate.sh#L66-L102: use the shared re-exec function (with a mode-aware--privileged/--userns=keep-idparameter) instead of its own copy.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/k8s-rebase/scripts/k8s-rebase.sh` around lines 37 - 59, Create plugins/k8s-rebase/scripts/lib/rebase-common.sh with shared _detect_commit_style, format_msg, and a parameterized container re-exec function. In plugins/k8s-rebase/scripts/k8s-rebase.sh#37-59 and k8s-rebase-autofix.sh#42-61, remove duplicated commit-style helpers and source the shared library; replace re-exec blocks at k8s-rebase.sh#225-263, k8s-rebase-autofix.sh#79-113, and k8s-rebase-validate.sh#66-102 with the shared function, preserving script-specific arguments and mode-aware --privileged/--userns=keep-id behavior.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@plugins/k8s-rebase/gates/step4-verification/skill-improvement.md`:
- Around line 1-6: Update
plugins/k8s-rebase/gates/step4-verification/skill-improvement.md lines 1-6 to
require inspecting commit history with git log/git show before classifying
commits, using commit bodies to distinguish manual fixes from commits containing
“Applied:”. Update
plugins/k8s-rebase/gates/step4-verification/maintainer-review.md lines 1-10 and
21-25 to use commit history when reporting scope, commit messages, SHAs, and
per-commit file/line findings.
- Around line 1-4: Update the manual-fix commit classification in the
branch-diff verification instructions to avoid treating absence of “Applied:” as
definitive. Use an explicit autofix commit trailer, or require the autofix
workflow—including post-vet fix_uncommitted commits—to add the marker
consistently before relying on it for classification.
In `@plugins/k8s-rebase/scripts/k8s-rebase-autofix.sh`:
- Around line 122-125: Replace the predictable /tmp/jq download location in the
jq-install blocks of plugins/k8s-rebase/scripts/k8s-rebase-autofix.sh (lines
122-125) and plugins/k8s-rebase/scripts/k8s-rebase-validate.sh (lines 123-126)
with a directory created by mktemp -d, download jq there, and prepend that
directory to PATH in both scripts.
In `@plugins/k8s-rebase/scripts/k8s-rebase-review.sh`:
- Around line 30-59: Align the review workflow with the script’s per-commit
design: update the SKILL.md Step 4c invocation to run the review for each fix
commit with the actual error context, rather than once at the final HEAD with
the generic “k8s rebase” argument. Preserve the existing evidence collection in
the script, including PATTERN_HINT, K8S_CHANGELOG, and commit-scoped DIFF
behavior.
In `@plugins/k8s-rebase/scripts/k8s-rebase-validate.sh`:
- Around line 271-289: The root package classification in run_test_only uses an
unanchored regex and can incorrectly skip packages with matching substrings.
Make this check exact-match the same way as the make test sudo-fallback path,
preferably by reusing a shared helper or pattern based on ROOT_PKGS so both
paths cannot drift.
- Around line 248-253: Replace the eval-based loading in the feature-gate export
block with a loop over the matching export lines from TEST_GO_SH, parsing and
applying only literal KUBE_FEATURE_ assignments. Preserve the existing file
discovery and skip behavior when TEST_GO_SH is empty, while avoiding execution
of arbitrary shell code.
In `@plugins/k8s-rebase/skills/k8s-rebase/SKILL.md`:
- Around line 28-35: Choose one consistent container policy and apply it across
the documented and automated flows: either make podman with --userns=keep-id a
hard requirement by removing the docker fallback and making the
container-selection logic in k8s-rebase.sh, k8s-rebase-autofix.sh, and
k8s-rebase-validate.sh fail when podman is unavailable, or retain the fallback
and update SKILL.md plus all three scripts to visibly warn about docker’s
root-owned-file caveat when it is selected. Ensure all four affected files
reflect the same policy.
---
Duplicate comments:
In `@plugins/k8s-rebase/gates/step4-verification/build-vet-recheck.md`:
- Line 11: Update the command at
plugins/k8s-rebase/gates/step4-verification/build-vet-recheck.md:11-11 to run go
build and go vet independently within a subshell, ensuring go vet executes even
if the build fails. Apply the identical replacement at
plugins/k8s-rebase/gates/step2-compilation/build-vet.md:11-11.
In `@plugins/k8s-rebase/gates/step4-verification/ci-prediction.md`:
- Around line 19-24: Update the guidance in the codegen verification section to
remove the requirement that git log contain a dedicated codegen commit. Instruct
reviewers to prefer verifying generated output through git diff --exit-code or
the repository’s existing verify-update-codegen/verify CI job, while retaining
the controller-gen version annotation check.
---
Nitpick comments:
In `@plugins/k8s-rebase/docs/k8s-rebase-patterns.md`:
- Line 154: Update the fenced code blocks in
plugins/k8s-rebase/docs/k8s-rebase-patterns.md at lines 154, 266, 270, 294, and
329 to use the text language specifier, and use the go.mod specifier at line
463. No other content changes are needed.
In `@plugins/k8s-rebase/gates/step2-compilation/diff-scope.md`:
- Around line 5-6: Update the directory-path list in the compilation diff-scope
documentation to wrap `_output/` and `third_party/` in backticks, preserving the
existing wording and formatting for the other paths.
In `@plugins/k8s-rebase/gates/step4-verification/go-version-check.md`:
- Around line 20-27: Update the x/ package opportunity check in the step4
verification prompt to explicitly require reporting the count of detected
mismatches or migration opportunities, while preserving the existing read-only
rule and grep scope. Ensure the output is a numeric count so SKILL.md can
enforce the zero/non-zero gate contract.
In `@plugins/k8s-rebase/scripts/k8s-rebase.sh`:
- Around line 37-59: Create plugins/k8s-rebase/scripts/lib/rebase-common.sh with
shared _detect_commit_style, format_msg, and a parameterized container re-exec
function. In plugins/k8s-rebase/scripts/k8s-rebase.sh#37-59 and
k8s-rebase-autofix.sh#42-61, remove duplicated commit-style helpers and source
the shared library; replace re-exec blocks at k8s-rebase.sh#225-263,
k8s-rebase-autofix.sh#79-113, and k8s-rebase-validate.sh#66-102 with the shared
function, preserving script-specific arguments and mode-aware
--privileged/--userns=keep-id behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 3e3591aa-e874-46c0-a843-96728207649f
📒 Files selected for processing (42)
.claude-plugin/marketplace.jsondocs/index.htmlplugins/k8s-rebase/.claude-plugin/plugin.jsonplugins/k8s-rebase/OWNERSplugins/k8s-rebase/README.mdplugins/k8s-rebase/docs/k8s-rebase-patterns.mdplugins/k8s-rebase/gates/step1-rebase/rebase-completeness.mdplugins/k8s-rebase/gates/step2-compilation/build-vet.mdplugins/k8s-rebase/gates/step2-compilation/diff-scope.mdplugins/k8s-rebase/gates/step2-compilation/fix-correctness.mdplugins/k8s-rebase/gates/step2-compilation/type-conversions.mdplugins/k8s-rebase/gates/step2-compilation/version-consistency.mdplugins/k8s-rebase/gates/step3-autofix/autofix-diff-review.mdplugins/k8s-rebase/gates/step3-autofix/autofix-result.mdplugins/k8s-rebase/gates/step3-autofix/crd-validation.mdplugins/k8s-rebase/gates/step3-autofix/dep-release-notes.mdplugins/k8s-rebase/gates/step3-autofix/deprecated-api-remnants.mdplugins/k8s-rebase/gates/step3-autofix/e2e-infra.mdplugins/k8s-rebase/gates/step3-autofix/feature-gates.mdplugins/k8s-rebase/gates/step3-autofix/logical-completeness.mdplugins/k8s-rebase/gates/step3-autofix/patterns-completeness.mdplugins/k8s-rebase/gates/step4-verification/build-vet-recheck.mdplugins/k8s-rebase/gates/step4-verification/ci-prediction.mdplugins/k8s-rebase/gates/step4-verification/ci-readiness.mdplugins/k8s-rebase/gates/step4-verification/cleanliness.mdplugins/k8s-rebase/gates/step4-verification/commit-messages.mdplugins/k8s-rebase/gates/step4-verification/correctness.mdplugins/k8s-rebase/gates/step4-verification/dep-cve-check.mdplugins/k8s-rebase/gates/step4-verification/deprecated-imports.mdplugins/k8s-rebase/gates/step4-verification/go-version-check.mdplugins/k8s-rebase/gates/step4-verification/gomod-diff-analysis.mdplugins/k8s-rebase/gates/step4-verification/k8s-changelog.mdplugins/k8s-rebase/gates/step4-verification/logical-consistency.mdplugins/k8s-rebase/gates/step4-verification/maintainer-review.mdplugins/k8s-rebase/gates/step4-verification/skill-improvement.mdplugins/k8s-rebase/gates/step4-verification/version-completeness.mdplugins/k8s-rebase/scripts/k8s-rebase-autofix.shplugins/k8s-rebase/scripts/k8s-rebase-review-prompt.mdplugins/k8s-rebase/scripts/k8s-rebase-review.shplugins/k8s-rebase/scripts/k8s-rebase-validate.shplugins/k8s-rebase/scripts/k8s-rebase.shplugins/k8s-rebase/skills/k8s-rebase/SKILL.md
🚧 Files skipped from review as they are similar to previous changes (25)
- plugins/k8s-rebase/gates/step2-compilation/type-conversions.md
- plugins/k8s-rebase/scripts/k8s-rebase-review-prompt.md
- plugins/k8s-rebase/gates/step3-autofix/logical-completeness.md
- plugins/k8s-rebase/gates/step4-verification/k8s-changelog.md
- plugins/k8s-rebase/gates/step4-verification/cleanliness.md
- plugins/k8s-rebase/gates/step4-verification/ci-readiness.md
- plugins/k8s-rebase/gates/step4-verification/commit-messages.md
- plugins/k8s-rebase/OWNERS
- plugins/k8s-rebase/.claude-plugin/plugin.json
- plugins/k8s-rebase/gates/step2-compilation/version-consistency.md
- plugins/k8s-rebase/gates/step2-compilation/fix-correctness.md
- plugins/k8s-rebase/gates/step3-autofix/crd-validation.md
- plugins/k8s-rebase/gates/step3-autofix/autofix-diff-review.md
- plugins/k8s-rebase/gates/step3-autofix/dep-release-notes.md
- plugins/k8s-rebase/gates/step4-verification/logical-consistency.md
- plugins/k8s-rebase/gates/step1-rebase/rebase-completeness.md
- plugins/k8s-rebase/gates/step3-autofix/e2e-infra.md
- plugins/k8s-rebase/gates/step3-autofix/feature-gates.md
- plugins/k8s-rebase/gates/step4-verification/dep-cve-check.md
- plugins/k8s-rebase/gates/step3-autofix/deprecated-api-remnants.md
- plugins/k8s-rebase/gates/step3-autofix/patterns-completeness.md
- .claude-plugin/marketplace.json
- plugins/k8s-rebase/gates/step4-verification/deprecated-imports.md
- docs/index.html
- plugins/k8s-rebase/README.md
| **Container commands:** When running containers, always use | ||
| `podman` with `--userns=keep-id`. Never use `docker run` — | ||
| it creates root-owned files that break subsequent operations. | ||
| `--security-opt label=disable` is required for SELinux hosts | ||
| (container writes to bind-mounted repo dirs fail without it). | ||
| ``` | ||
| podman run --rm --security-opt label=disable --userns=keep-id -v "$(pwd):$(pwd)" -w "$(pwd)" docker.io/library/golang:VERSION ... | ||
| ``` |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
SKILL.md's "Never use docker run" rule is silently contradicted by all three automation scripts. SKILL.md states plainly that docker must never be used because it "creates root-owned files that break subsequent operations," but every script that auto-containerizes falls back to docker automatically whenever podman isn't installed — exactly the failure mode SKILL.md warns about, without the human/agent ever being told it happened.
plugins/k8s-rebase/skills/k8s-rebase/SKILL.md#L28-L35: acknowledge the automatic docker fallback in the deterministic scripts (and its root-owned-file caveat), or state that podman is a hard requirement and the scripts should fail instead of silently falling back to docker.plugins/k8s-rebase/scripts/k8s-rebase.sh#L236-L241: either drop the docker fallback (diewhen only docker is available) to match the documented policy, or emit a visible warning about root-owned files when it engages.plugins/k8s-rebase/scripts/k8s-rebase-autofix.sh#L87-L89: same choice — align with whichever policy is chosen for k8s-rebase.sh.plugins/k8s-rebase/scripts/k8s-rebase-validate.sh#L81-L83: same choice — align with whichever policy is chosen for k8s-rebase.sh.
🧰 Tools
🪛 markdownlint-cli2 (0.23.0)
[warning] 33-33: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
📍 Affects 4 files
plugins/k8s-rebase/skills/k8s-rebase/SKILL.md#L28-L35(this comment)plugins/k8s-rebase/scripts/k8s-rebase.sh#L236-L241plugins/k8s-rebase/scripts/k8s-rebase-autofix.sh#L87-L89plugins/k8s-rebase/scripts/k8s-rebase-validate.sh#L81-L83
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@plugins/k8s-rebase/skills/k8s-rebase/SKILL.md` around lines 28 - 35, Choose
one consistent container policy and apply it across the documented and automated
flows: either make podman with --userns=keep-id a hard requirement by removing
the docker fallback and making the container-selection logic in k8s-rebase.sh,
k8s-rebase-autofix.sh, and k8s-rebase-validate.sh fail when podman is
unavailable, or retain the fallback and update SKILL.md plus all three scripts
to visibly warn about docker’s root-owned-file caveat when it is selected.
Ensure all four affected files reflect the same policy.
f06d1b9 to
c0724a4
Compare
There was a problem hiding this comment.
Actionable comments posted: 6
♻️ Duplicate comments (5)
plugins/k8s-rebase/scripts/k8s-rebase.sh (1)
686-695: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winBare-version doc replace still isn't restricted to Kubernetes-specific prose.
The perl lookbehind/lookahead now correctly guards against IP-address and patch-version corruption (the two concrete examples from the earlier review), but the match is still purely numeric — any standalone
1.35-style token indocs/**/*.mdunrelated to Kubernetes (e.g. a percentage, section/step number) will still be rewritten, since there's no check that the surrounding text is actually about Kubernetes.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/k8s-rebase/scripts/k8s-rebase.sh` around lines 686 - 695, Restrict the bare-version replacement in the Pass 2 loop to Kubernetes-specific documentation instead of matching every standalone numeric token under docs/. Update the grep/perl selection around OLD_SHORT and NEW_SHORT to require an appropriate Kubernetes context, while preserving the existing protections for IP addresses, compound versions, and patch versions.plugins/k8s-rebase/gates/step3-autofix/crd-validation.md (1)
6-7: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winCRD
format: int32/maximumcheck still relies on line adjacency, not schema semantics.This only detects the exact adjacent sequence
format: int32followed immediately bymaximum: 4294967295. Comments, blank lines, reordered keys, or other intervening schema properties will still produce a false zero count for a read-only gate that's required to report exact counts.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/k8s-rebase/gates/step3-autofix/crd-validation.md` around lines 6 - 7, Update the CRD validation instructions in step 3 so the count identifies schema objects containing both format: int32 and maximum: 4294967295 regardless of key order, comments, blank lines, or intervening properties; remove the line-adjacency requirement and preserve exact reporting for the read-only gate.plugins/k8s-rebase/scripts/k8s-rebase-autofix.sh (1)
122-128: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick winPredictable
/tmp/jqpath is copy-pasted into both scripts — same TOCTOU root cause. Both download jq to a hardcoded, predictable path,chmod +xit, and prepend/tmptoPATH, allowing a local attacker (or leftover file) to hijack the binary.
plugins/k8s-rebase/scripts/k8s-rebase-autofix.sh#L122-L128: download jq into amktemp -ddirectory and prepend that directory toPATHinstead of/tmp.plugins/k8s-rebase/scripts/k8s-rebase-validate.sh#L125-L131: apply the identicalmktemp -dfix here too.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/k8s-rebase/scripts/k8s-rebase-autofix.sh` around lines 122 - 128, The jq bootstrap blocks in plugins/k8s-rebase/scripts/k8s-rebase-autofix.sh lines 122-128 and plugins/k8s-rebase/scripts/k8s-rebase-validate.sh lines 125-131 use a predictable shared /tmp/jq path. In both scripts, create a unique temporary directory with mktemp -d, download and verify jq within that directory, make that file executable, and prepend only the temporary directory to PATH.plugins/k8s-rebase/scripts/k8s-rebase-review.sh (1)
30-59: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winEvidence-gathering (
PATTERN_HINT,K8S_CHANGELOG, commit-scopedDIFF) is still unreachable in practice.SKILL.md's Step 4c still calls this script once at final
HEADwith the literal string"k8s rebase"asORIGINAL_ERROR— that string never matches any of thePATTERN_HINTkeywords (L53),K8S_CHANGELOG(L48) is just whatever the last commit message says (not a real changelog), andDIFF(L40-42) covers the entire rebase range truncated to 2000 lines rather than one commit's diff. The antagonistic review still runs with much weaker context than the script's own design intends.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/k8s-rebase/scripts/k8s-rebase-review.sh` around lines 30 - 59, Update the Step 4c invocation and the evidence preparation around PATTERN_HINT, K8S_CHANGELOG, and DIFF so the review runs per rebased commit with that commit’s actual error output, commit message, and scoped diff rather than once at final HEAD with the literal “k8s rebase” value. Preserve the existing filtering and fallback behavior while ensuring each invocation receives commit-specific context before the review runs.plugins/k8s-rebase/scripts/k8s-rebase-validate.sh (1)
277-295: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winUnanchored root_pkgs regex duplicated between the script and its documentation snippet — same substring-match root cause. Both build a
(pkg/a|pkg/b|...)alternation fromroot_pkgsand match it with only a leading^\./anchor, so a shorter root_pkgs entry (e.g.pkg/ovn) substring-matches an unrelated package (pkg/ovnwebhook) and silently drops it from testing. The correct anchored form already exists elsewhere ink8s-rebase-validate.sh(L439, L449:^(...)$).
plugins/k8s-rebase/scripts/k8s-rebase-validate.sh#L277-L295: add the trailing$anchor to thegrep -qEpattern inrun_test_only(), matching the anchored form used at L439/L449.plugins/k8s-rebase/skills/k8s-rebase/SKILL.md#L426-L436: add the same trailing$anchor to the Step 4b package-discovery snippet'sgrep -qEpattern.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/k8s-rebase/scripts/k8s-rebase-validate.sh` around lines 277 - 295, Anchor the root package regex to the full package name by adding a trailing $ to the grep -qE pattern in run_test_only() within plugins/k8s-rebase/scripts/k8s-rebase-validate.sh lines 277-295. Apply the same trailing anchor to the corresponding Step 4b package-discovery snippet in plugins/k8s-rebase/skills/k8s-rebase/SKILL.md lines 426-436; both sites must reject only exact root package paths.
🧹 Nitpick comments (2)
plugins/k8s-rebase/scripts/k8s-rebase.sh (1)
251-263: 🔒 Security & Privacy | 🔵 Trivial | 💤 Low valueQuote/array-ify the container
execargs instead of relying on unquoted command substitution.
$([[ "$BUMP_TOOLS" == true ]] && echo "--bump-tools")at Line 263 is unquoted, which both ast-grep (flagged as CWE-78-style pattern) and shellcheck (SC2046) call out. In practiceBUMP_TOOLSis fully internal (only evertrue/falsefrom the script's own arg parser), so this isn't currently exploitable, but the pattern is fragile and worth hardening to an explicit args array for clarity and defense against future refactors that might route less-trusted input through this path.🛡️ Proposed fix using an args array
+ EXTRA_ARGS=() + [[ "$BUMP_TOOLS" == true ]] && EXTRA_ARGS+=("--bump-tools") exec $CONTAINER_RT run --rm \ --security-opt label=disable \ $USERNS_FLAG \ -v "$REPO_ROOT:$REPO_ROOT" \ -v "$(dirname "$SCRIPT_PATH"):$(dirname "$SCRIPT_PATH"):ro" \ -w "$REPO_ROOT" \ -e GIT_AUTHOR_NAME="$(git config user.name)" \ -e GIT_AUTHOR_EMAIL="$(git config user.email)" \ -e GIT_COMMITTER_NAME="$(git config user.name)" \ -e GIT_COMMITTER_EMAIL="$(git config user.email)" \ -e K8S_REBASE_IN_CONTAINER=1 \ "$GO_IMAGE" \ - bash "$SCRIPT_PATH" $([[ "$BUMP_TOOLS" == true ]] && echo "--bump-tools") "$VERSION_INPUT" + bash "$SCRIPT_PATH" "${EXTRA_ARGS[@]}" "$VERSION_INPUT"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/k8s-rebase/scripts/k8s-rebase.sh` around lines 251 - 263, Replace the unquoted conditional command substitution in the container execution command with an explicit argument array, adding --bump-tools only when BUMP_TOOLS is true and then expanding the array safely. Update the exec invocation in the container run block while preserving the existing script, image, and version arguments.plugins/k8s-rebase/scripts/k8s-rebase-autofix.sh (1)
172-217: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winGate-parent/dep computation duplicated 3× (
run_checkstwice,fix_feature_gatesonce).
_all_gate_names(L174-183) and_sfm_gates(L204-210) compute the identical set — activeGATE_DEPSparents plus their vendor-present deps — twice withinrun_checks(), andfix_feature_gates()(L1112-1125) recomputes it a third time with arrays instead of strings. Any future change to how gates/deps are filtered risks drifting between the three copies.♻️ Suggested direction
Extract one helper (e.g.
_compute_active_gates) that echoes space-separated gate names, and reuse it for_all_gate_names,_sfm_gates, andfix_feature_gates'sall_gates(viaread -rainto an array where an array is needed).🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/k8s-rebase/scripts/k8s-rebase-autofix.sh` around lines 172 - 217, Extract the duplicated active gate/ dependency discovery into a single helper, such as _compute_active_gates, that returns the vendor-present parent and dependency names in a space-separated form. Update run_checks to reuse this result for both _all_gate_names and _sfm_gates, and update fix_feature_gates to populate its all_gates array from the helper output via read -ra, removing its separate computation while preserving existing filtering behavior.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@plugins/k8s-rebase/docs/k8s-rebase-patterns.md`:
- Line 154: Add language identifiers to every fenced code block in
k8s-rebase-patterns.md, including the blocks at the referenced locations. Use
text for diagnostic/output blocks and the appropriate language identifier for
each code or configuration block, eliminating all MD040 violations.
- Around line 459-470: Update the replace directive workaround guidance near the
example to require a trusted, reviewed fork and an immutable pinned version or
commit reference instead of the generic FORK placeholder. Retain the instruction
to remove the replace directive once the official library-go fix is available.
In `@plugins/k8s-rebase/gates/step3-autofix/autofix-result.md`:
- Around line 1-9: Update the autofix verification guidance to treat matching
git-log commit counts only as supporting evidence, not proof of execution.
Require corroborating diff, result, or script-output evidence so no-op and
squashed/combined successful runs are recognized, while preserving the
instruction to ignore stale gitignored vendor directories and avoid escalating
them.
In `@plugins/k8s-rebase/gates/step3-autofix/crd-validation.md`:
- Around line 8-11: Replace the brittle main/master merge-base fallback with
resolved default/target branch detection, mirroring the existing detection in
k8s-rebase.sh before comparing against the base. In
plugins/k8s-rebase/gates/step3-autofix/crd-validation.md lines 8-11, use the
resolved base for git show metadata.name comparisons; in
plugins/k8s-rebase/gates/step4-verification/go-version-check.md lines 4-9, reuse
the same resolved base for both go and toolchain directive git diff checks,
ensuring unresolved bases fail rather than silently producing zero differences.
In `@plugins/k8s-rebase/gates/step4-verification/build-vet-recheck.md`:
- Line 11: Update the subshell command in the build-and-vet verification step to
exit when changing to mod_dir fails, then run go build and go vet while
capturing each command’s status and return a failure if either command fails.
Preserve both commands’ output and ensure the combined status reflects both
checks.
In `@plugins/k8s-rebase/skills/k8s-rebase/SKILL.md`:
- Around line 1-9: Add an overlap-review summary to the k8s-rebase skill
documentation, covering the four-phase comparison against open PRs and existing
skills/commands. Include the required HIGH/MODERATE/LOW classification and
retain the existing front matter and skill instructions unchanged.
---
Duplicate comments:
In `@plugins/k8s-rebase/gates/step3-autofix/crd-validation.md`:
- Around line 6-7: Update the CRD validation instructions in step 3 so the count
identifies schema objects containing both format: int32 and maximum: 4294967295
regardless of key order, comments, blank lines, or intervening properties;
remove the line-adjacency requirement and preserve exact reporting for the
read-only gate.
In `@plugins/k8s-rebase/scripts/k8s-rebase-autofix.sh`:
- Around line 122-128: The jq bootstrap blocks in
plugins/k8s-rebase/scripts/k8s-rebase-autofix.sh lines 122-128 and
plugins/k8s-rebase/scripts/k8s-rebase-validate.sh lines 125-131 use a
predictable shared /tmp/jq path. In both scripts, create a unique temporary
directory with mktemp -d, download and verify jq within that directory, make
that file executable, and prepend only the temporary directory to PATH.
In `@plugins/k8s-rebase/scripts/k8s-rebase-review.sh`:
- Around line 30-59: Update the Step 4c invocation and the evidence preparation
around PATTERN_HINT, K8S_CHANGELOG, and DIFF so the review runs per rebased
commit with that commit’s actual error output, commit message, and scoped diff
rather than once at final HEAD with the literal “k8s rebase” value. Preserve the
existing filtering and fallback behavior while ensuring each invocation receives
commit-specific context before the review runs.
In `@plugins/k8s-rebase/scripts/k8s-rebase-validate.sh`:
- Around line 277-295: Anchor the root package regex to the full package name by
adding a trailing $ to the grep -qE pattern in run_test_only() within
plugins/k8s-rebase/scripts/k8s-rebase-validate.sh lines 277-295. Apply the same
trailing anchor to the corresponding Step 4b package-discovery snippet in
plugins/k8s-rebase/skills/k8s-rebase/SKILL.md lines 426-436; both sites must
reject only exact root package paths.
In `@plugins/k8s-rebase/scripts/k8s-rebase.sh`:
- Around line 686-695: Restrict the bare-version replacement in the Pass 2 loop
to Kubernetes-specific documentation instead of matching every standalone
numeric token under docs/. Update the grep/perl selection around OLD_SHORT and
NEW_SHORT to require an appropriate Kubernetes context, while preserving the
existing protections for IP addresses, compound versions, and patch versions.
---
Nitpick comments:
In `@plugins/k8s-rebase/scripts/k8s-rebase-autofix.sh`:
- Around line 172-217: Extract the duplicated active gate/ dependency discovery
into a single helper, such as _compute_active_gates, that returns the
vendor-present parent and dependency names in a space-separated form. Update
run_checks to reuse this result for both _all_gate_names and _sfm_gates, and
update fix_feature_gates to populate its all_gates array from the helper output
via read -ra, removing its separate computation while preserving existing
filtering behavior.
In `@plugins/k8s-rebase/scripts/k8s-rebase.sh`:
- Around line 251-263: Replace the unquoted conditional command substitution in
the container execution command with an explicit argument array, adding
--bump-tools only when BUMP_TOOLS is true and then expanding the array safely.
Update the exec invocation in the container run block while preserving the
existing script, image, and version arguments.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 8bf0d47c-2dbc-44f3-bbac-534fbd62c92a
📒 Files selected for processing (42)
.claude-plugin/marketplace.jsondocs/index.htmlplugins/k8s-rebase/.claude-plugin/plugin.jsonplugins/k8s-rebase/OWNERSplugins/k8s-rebase/README.mdplugins/k8s-rebase/docs/k8s-rebase-patterns.mdplugins/k8s-rebase/gates/step1-rebase/rebase-completeness.mdplugins/k8s-rebase/gates/step2-compilation/build-vet.mdplugins/k8s-rebase/gates/step2-compilation/diff-scope.mdplugins/k8s-rebase/gates/step2-compilation/fix-correctness.mdplugins/k8s-rebase/gates/step2-compilation/type-conversions.mdplugins/k8s-rebase/gates/step2-compilation/version-consistency.mdplugins/k8s-rebase/gates/step3-autofix/autofix-diff-review.mdplugins/k8s-rebase/gates/step3-autofix/autofix-result.mdplugins/k8s-rebase/gates/step3-autofix/crd-validation.mdplugins/k8s-rebase/gates/step3-autofix/dep-release-notes.mdplugins/k8s-rebase/gates/step3-autofix/deprecated-api-remnants.mdplugins/k8s-rebase/gates/step3-autofix/e2e-infra.mdplugins/k8s-rebase/gates/step3-autofix/feature-gates.mdplugins/k8s-rebase/gates/step3-autofix/logical-completeness.mdplugins/k8s-rebase/gates/step3-autofix/patterns-completeness.mdplugins/k8s-rebase/gates/step4-verification/build-vet-recheck.mdplugins/k8s-rebase/gates/step4-verification/ci-prediction.mdplugins/k8s-rebase/gates/step4-verification/ci-readiness.mdplugins/k8s-rebase/gates/step4-verification/cleanliness.mdplugins/k8s-rebase/gates/step4-verification/commit-messages.mdplugins/k8s-rebase/gates/step4-verification/correctness.mdplugins/k8s-rebase/gates/step4-verification/dep-cve-check.mdplugins/k8s-rebase/gates/step4-verification/deprecated-imports.mdplugins/k8s-rebase/gates/step4-verification/go-version-check.mdplugins/k8s-rebase/gates/step4-verification/gomod-diff-analysis.mdplugins/k8s-rebase/gates/step4-verification/k8s-changelog.mdplugins/k8s-rebase/gates/step4-verification/logical-consistency.mdplugins/k8s-rebase/gates/step4-verification/maintainer-review.mdplugins/k8s-rebase/gates/step4-verification/skill-improvement.mdplugins/k8s-rebase/gates/step4-verification/version-completeness.mdplugins/k8s-rebase/scripts/k8s-rebase-autofix.shplugins/k8s-rebase/scripts/k8s-rebase-review-prompt.mdplugins/k8s-rebase/scripts/k8s-rebase-review.shplugins/k8s-rebase/scripts/k8s-rebase-validate.shplugins/k8s-rebase/scripts/k8s-rebase.shplugins/k8s-rebase/skills/k8s-rebase/SKILL.md
🚧 Files skipped from review as they are similar to previous changes (26)
- plugins/k8s-rebase/gates/step2-compilation/fix-correctness.md
- plugins/k8s-rebase/gates/step4-verification/cleanliness.md
- plugins/k8s-rebase/gates/step3-autofix/autofix-diff-review.md
- plugins/k8s-rebase/scripts/k8s-rebase-review-prompt.md
- plugins/k8s-rebase/gates/step3-autofix/patterns-completeness.md
- plugins/k8s-rebase/.claude-plugin/plugin.json
- plugins/k8s-rebase/gates/step1-rebase/rebase-completeness.md
- plugins/k8s-rebase/gates/step3-autofix/logical-completeness.md
- plugins/k8s-rebase/gates/step2-compilation/type-conversions.md
- plugins/k8s-rebase/gates/step3-autofix/deprecated-api-remnants.md
- plugins/k8s-rebase/gates/step3-autofix/e2e-infra.md
- .claude-plugin/marketplace.json
- plugins/k8s-rebase/gates/step3-autofix/feature-gates.md
- plugins/k8s-rebase/gates/step3-autofix/dep-release-notes.md
- plugins/k8s-rebase/gates/step4-verification/logical-consistency.md
- plugins/k8s-rebase/gates/step2-compilation/version-consistency.md
- plugins/k8s-rebase/gates/step4-verification/maintainer-review.md
- plugins/k8s-rebase/gates/step4-verification/commit-messages.md
- plugins/k8s-rebase/gates/step4-verification/dep-cve-check.md
- plugins/k8s-rebase/README.md
- plugins/k8s-rebase/gates/step4-verification/skill-improvement.md
- plugins/k8s-rebase/OWNERS
- plugins/k8s-rebase/gates/step4-verification/ci-readiness.md
- plugins/k8s-rebase/gates/step4-verification/k8s-changelog.md
- plugins/k8s-rebase/gates/step4-verification/deprecated-imports.md
- docs/index.html
| 2. Count CRDs that lost metadata.name pattern validation | ||
| compared to the base branch. Detect the base branch with | ||
| `git merge-base HEAD main 2>/dev/null || git merge-base HEAD master`, | ||
| then use `git show <base>:path` to check the original. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Same brittle main/master merge-base assumption repeated across gate prompts. Both gates resolve the comparison base with git merge-base HEAD main 2>/dev/null || git merge-base HEAD master; when the default branch is neither, the substitution is empty and git diff $(...)..HEAD degenerates to git diff ..HEAD (interpreted as HEAD..HEAD), silently reporting zero differences instead of erroring — the opposite of what a "read-only, must report exact counts" gate should do on an unresolvable base.
plugins/k8s-rebase/gates/step3-autofix/crd-validation.md#L8-L11: derive the actual default/target branch (e.g. viagit symbolic-ref refs/remotes/origin/HEAD, mirroring the detection already done ink8s-rebase.shat Line 300) before usinggit show <base>:pathfor the metadata.name comparison.plugins/k8s-rebase/gates/step4-verification/go-version-check.md#L4-L9: apply the same resolved-base-ref approach to both thego directiveandtoolchain directivegit diffinvocations instead of hardcodingmain/master.
📍 Affects 2 files
plugins/k8s-rebase/gates/step3-autofix/crd-validation.md#L8-L11(this comment)plugins/k8s-rebase/gates/step4-verification/go-version-check.md#L4-L9
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@plugins/k8s-rebase/gates/step3-autofix/crd-validation.md` around lines 8 -
11, Replace the brittle main/master merge-base fallback with resolved
default/target branch detection, mirroring the existing detection in
k8s-rebase.sh before comparing against the base. In
plugins/k8s-rebase/gates/step3-autofix/crd-validation.md lines 8-11, use the
resolved base for git show metadata.name comparisons; in
plugins/k8s-rebase/gates/step4-verification/go-version-check.md lines 4-9, reuse
the same resolved base for both go and toolchain directive git diff checks,
ensuring unresolved bases fail rather than silently producing zero differences.
| continue | ||
| fi | ||
| echo "CHECK $mod_dir" | ||
| (cd "$mod_dir" && go build ./... 2>&1; go vet ./... 2>&1) |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
set -euo pipefail
sed -n '1,120p' plugins/k8s-rebase/gates/step4-verification/build-vet-recheck.mdRepository: openshift-eng/ai-helpers
Length of output: 1100
🏁 Script executed:
sed -n '1,80p' plugins/k8s-rebase/gates/step4-verification/build-vet-recheck.mdRepository: openshift-eng/ai-helpers
Length of output: 1100
Preserve both exit codes in the subshell.
(cd "$mod_dir" && go build ./... 2>&1; go vet ./... 2>&1) still returns only go vet’s status, so a failed build can be reported as success. go vet also runs from the caller’s directory if cd fails. Guard the directory change and combine both exit codes before returning.
Suggested adjustment
- (cd "$mod_dir" && go build ./... 2>&1; go vet ./... 2>&1)
+ (
+ cd "$mod_dir" || exit 1
+ build_rc=0
+ go build ./... 2>&1 || build_rc=$?
+ vet_rc=0
+ go vet ./... 2>&1 || vet_rc=$?
+ (( build_rc == 0 && vet_rc == 0 ))
+ )📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| (cd "$mod_dir" && go build ./... 2>&1; go vet ./... 2>&1) | |
| ( | |
| cd "$mod_dir" || exit 1 | |
| build_rc=0 | |
| go build ./... 2>&1 || build_rc=$? | |
| vet_rc=0 | |
| go vet ./... 2>&1 || vet_rc=$? | |
| (( build_rc == 0 && vet_rc == 0 )) | |
| ) |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@plugins/k8s-rebase/gates/step4-verification/build-vet-recheck.md` at line 11,
Update the subshell command in the build-and-vet verification step to exit when
changing to mod_dir fails, then run go build and go vet while capturing each
command’s status and return a failure if either command fails. Preserve both
commands’ output and ensure the combined status reflects both checks.
| --- | ||
| name: k8s-rebase | ||
| description: Rebase a Go project to a new Kubernetes version by bumping all k8s.io/* dependencies, running codegen, updating version references, fixing build breakage with antagonistic review, and presenting a gh pr create command. | ||
| argument-hint: "[--bump-tools] <version> (e.g., 1.36.0 or --bump-tools 1.36.0)" | ||
| user-invocable: true | ||
| allowed-tools: Bash, Read, Agent | ||
| --- | ||
|
|
||
| # Kubernetes Rebase |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
gh pr list --repo openshift-eng/ai-helpers --state open --json number,title,files \
--jq '.[] | select(.files[].path | test("k8s-rebase|SKILL\\.md")) | {number, title}'Repository: openshift-eng/ai-helpers
Length of output: 6075
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n== Repo files ==\n'
git ls-files 'plugins/*/skills/*/SKILL.md' 'plugins/*/commands/*.md' | sed -n '1,200p'
printf '\n== Candidate related files ==\n'
git ls-files 'plugins/rebase-library-go/skills/*/SKILL.md' 'plugins/k8s-rebase/skills/*/SKILL.md' | sed -n '1,200p'
printf '\n== Outline k8s-rebase skill ==\n'
ast-grep outline plugins/k8s-rebase/skills/k8s-rebase/SKILL.md --view expanded || true
printf '\n== Outline rebase-library-go skill ==\n'
ast-grep outline plugins/rebase-library-go/skills/rebase-library-go/SKILL.md --view expanded || trueRepository: openshift-eng/ai-helpers
Length of output: 9494
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n== PR 617 metadata ==\n'
gh pr view 617 --repo openshift-eng/ai-helpers --json number,title,body,files,comments,reviews \
--jq '{number,title,body,files:[.files[].path],comments:[.comments[].body],reviews:[.reviews[].body]}'Repository: openshift-eng/ai-helpers
Length of output: 50383
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "## related files"
git ls-files 'plugins/*/skills/*/SKILL.md' | sed -n '1,120p'
echo "## k8s-rebase skill"
cat -n plugins/k8s-rebase/skills/k8s-rebase/SKILL.md | sed -n '1,120p'
echo "## rebase-library-go skill"
cat -n plugins/rebase-library-go/skills/rebase-library-go/SKILL.md | sed -n '1,220p'Repository: openshift-eng/ai-helpers
Length of output: 11672
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "## rebase-related files"
git ls-files 'plugins/*/*rebase*' 'plugins/*/commands/*rebase*.md' 'plugins/*/skills/*rebase*/SKILL.md' | sed -n '1,200p'
echo
echo "## search for k8s rebase references"
rg -n --glob 'plugins/**' -S 'k8s rebase|k8s-rebase|k8s\.io/\*|dependency rebase|rebase a Go project|bump-deps|rebase' plugins | sed -n '1,240p'Repository: openshift-eng/ai-helpers
Length of output: 29890
🏁 Script executed:
#!/bin/bash
set -euo pipefail
for f in plugins/openshift/commands/rebase.md plugins/openshift/commands/bump-deps.md plugins/openshift/commands/create-cluster.md; do
if [ -f "$f" ]; then
echo "## $f"
cat -n "$f" | sed -n '1,220p'
echo
fi
doneRepository: openshift-eng/ai-helpers
Length of output: 25755
🏁 Script executed:
#!/bin/bash
set -euo pipefail
gh pr view 617 --repo openshift-eng/ai-helpers --json files --jq '.files[].path' | sed -n '1,80p'Repository: openshift-eng/ai-helpers
Length of output: 2500
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "## rebase-related files"
git ls-files 'plugins/*/*rebase*' 'plugins/*/commands/*rebase*.md' 'plugins/*/skills/*rebase*/SKILL.md' | sed -n '1,200p'
echo
echo "## k8s-rebase PR files"
gh pr view 617 --repo openshift-eng/ai-helpers --json files --jq '.files[].path' | sed -n '1,120p'
echo
echo "## search for overlap-relevant wording"
rg -n -S 'overlap|related PR|possibly related|similar|duplicate|rebase|k8s\.io/\*|dependency rebase|bump-deps' \
plugins/k8s-rebase plugins/openshift plugins/ci plugins/code-review plugins/golang | sed -n '1,260p'Repository: openshift-eng/ai-helpers
Length of output: 39182
Add the overlap-review summary for this new skill. PR #617 already notes related PRs, but this file still needs the 4-phase comparison against open PRs and existing skills/commands, plus the HIGH/MODERATE/LOW classification.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@plugins/k8s-rebase/skills/k8s-rebase/SKILL.md` around lines 1 - 9, Add an
overlap-review summary to the k8s-rebase skill documentation, covering the
four-phase comparison against open PRs and existing skills/commands. Include the
required HIGH/MODERATE/LOW classification and retain the existing front matter
and skill instructions unchanged.
Source: Coding guidelines
c0724a4 to
3a1375b
Compare
There was a problem hiding this comment.
Actionable comments posted: 19
🧹 Nitpick comments (5)
plugins/k8s-rebase/test/gate-hardening.sh (1)
99-212: 📐 Maintainability & Code Quality | 🔵 Trivial | 🏗️ Heavy liftLarge duplication with
test/test-skill.sh.
mutate_plugin,TAG_TO_PATTERN,_repo_from_key,_do_record_one, and the court logic are near-copies of the same routines inplugins/k8s-rebase/test/test-skill.sh(already diverging: this copy has the redundant-spec suppression and heading-dedup logic thattest-skill.shlacks). Consider extracting the shared pieces into a sourcedtest/lib-harness.sh.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/k8s-rebase/test/gate-hardening.sh` around lines 99 - 212, Extract the duplicated harness routines shared by mutate_plugin, TAG_TO_PATTERN, _repo_from_key, _do_record_one, and the court logic from mutate_plugin and test/test-skill.sh into a sourced test/lib-harness.sh. Update both callers to source and reuse the shared definitions, preserving mutate_plugin’s redundant-spec suppression and heading-dedup behavior rather than reverting to the older implementation.plugins/k8s-rebase/gates/step3-autofix/patterns-completeness.md (1)
3-6: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winGuard the
GATE_DIRlookup before invoking the companion script.If
findreturns nothing, this runsbash "/patterns-completeness.sh"and the agent gets a confusing "No such file" instead of a defined fallback — and PATH A/PATH B selection becomes undefined.♻️ Proposed fix
GATE_DIR=$(find "$HOME/.claude" "$HOME" -maxdepth 7 -path "*/k8s-rebase/gates/step3-autofix" -type d 2>/dev/null | head -1) -bash "$GATE_DIR/patterns-completeness.sh" "$(pwd)" +if [ -n "$GATE_DIR" ] && [ -f "$GATE_DIR/patterns-completeness.sh" ]; then + bash "$GATE_DIR/patterns-completeness.sh" "$(pwd)" +else + echo "GATE SCRIPT NOT FOUND — follow PATH B" +fi🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/k8s-rebase/gates/step3-autofix/patterns-completeness.md` around lines 3 - 6, Guard the GATE_DIR lookup before invoking patterns-completeness.sh: detect an empty result and apply the defined fallback or explicitly stop with a clear error, preserving the intended PATH A/PATH B selection. Update the command block in patterns-completeness.md without changing behavior when GATE_DIR is found.plugins/k8s-rebase/gates/step3-autofix/major-version-imports.sh (1)
37-45: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winMake the generic scan portable and use explicit
if/else.Two hardening points:
grep -oPis GNU-only; on BSD/macOS grep this silently produces nothing and the whole generic check becomes a no-op (only the klog check would run).grep -oE 'k8s\.io/[a-zA-Z0-9_-]+/v[0-9]+'is equivalent here and portable.- Line 44's
A && B || C(SC2015) works today only becausepre=$((pre+1))never evaluates to 0; an explicitif/elseremoves that fragility.♻️ Proposed fix
- for mod in $(grep -oP 'k8s\.io/[a-zA-Z0-9_-]+/v\d+' "$PRIMARY_GOMOD" 2>/dev/null | sed 's|/v[0-9]*$||' | sort -u); do + while IFS= read -r mod; do + [[ -z "$mod" ]] && continue bare_hits=$(grep -rn "\"$mod\"" --include='*.go' . 2>/dev/null | grep -v vendor/ | grep -v "${mod}/v" || true) if [[ -n "$bare_hits" ]]; then while IFS= read -r hit; do file=$(echo "$hit" | cut -d: -f1) if [[ -n "$BASE" ]]; then base_has=$(git show "$BASE:$file" 2>/dev/null | grep -c "\"$mod\"" || true) - [[ "$base_has" -gt 0 ]] && { echo "$hit PRE-EXISTING ($mod)"; pre=$((pre+1)); } \ - || { echo "$hit NEW ($mod)"; new=$((new+1)); } + if [[ "$base_has" -gt 0 ]]; then + echo "$hit PRE-EXISTING ($mod)"; pre=$((pre+1)) + else + echo "$hit NEW ($mod)"; new=$((new+1)) + fi elseand close the loop with:
- done + done < <(grep -oE 'k8s\.io/[a-zA-Z0-9_-]+/v[0-9]+' "$PRIMARY_GOMOD" 2>/dev/null | sed 's|/v[0-9]*$||' | sort -u)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/k8s-rebase/gates/step3-autofix/major-version-imports.sh` around lines 37 - 45, In the generic module scan loop, replace the GNU-only grep -oP option with portable extended-regex extraction using grep -oE while preserving the existing pattern. In the BASE classification block, replace the chained &&/|| expression with an explicit if/else that checks base_has, emits the same PRE-EXISTING or NEW message, and updates pre or new accordingly.Source: Linters/SAST tools
plugins/k8s-rebase/gates/step3-autofix/major-version-imports.md (1)
51-56: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winAdd the same guarded fallback the sibling gates use.
If
findreturns nothing,bash ""writes no report and the harness treats this gate as missing (test-skill.shrequiresgtotal >= expected_gates).feature-gates.mdandpatterns-completeness.mdboth guard withSCRIPT=$(...)plus aprintffallback.♻️ Proposed fix
REPO="<the repo path from the first line of your prompt>" -bash "$(find "$HOME/.claude" "$HOME" -maxdepth 7 -name "write-gate-report.sh" -path "*/k8s-rebase/scripts/*" 2>/dev/null | head -1)" \ - "$REPO" step3-major-version-imports PASS 0 "your one-line summary" \ - "detail line 1" "detail line 2" +SCRIPT=$(find "$HOME/.claude" "$HOME" -maxdepth 7 -name "write-gate-report.sh" -path "*/k8s-rebase/scripts/*" 2>/dev/null | head -1) +if [ -n "$SCRIPT" ]; then + bash "$SCRIPT" "$REPO" step3-major-version-imports PASS 0 "your one-line summary" \ + "detail line 1" "detail line 2" +else + mkdir -p "$REPO/.rebase-tmp/gates" + printf 'VERDICT: PASS\nISSUES: 0\nSUMMARY: your one-line summary\nDETAILS:\ndetail line 1\ndetail line 2\n' \ + > "$REPO/.rebase-tmp/gates/step3-major-version-imports.report" +fi🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/k8s-rebase/gates/step3-autofix/major-version-imports.md` around lines 51 - 56, Update the report-writing command in the step3-major-version-imports gate to use the guarded SCRIPT lookup pattern from feature-gates.md and patterns-completeness.md. Capture the write-gate-report.sh path, invoke it only when found, and otherwise print the fallback output so the gate still produces a report when find returns no result.plugins/k8s-rebase/scripts/k8s-rebase-review.sh (1)
66-70: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winMissing template silently approves, while an empty verdict rejects.
A mis-pathed
k8s-rebase-review-prompt.md(e.g. plugin layout change) disables the antagonistic review entirely with an APPROVE exit 0 and only a warning. Since the template ships alongside this script, treat its absence as a configuration error rather than an approval.♻️ Suggested change
if [[ ! -f "$TEMPLATE" ]]; then - echo "WARNING: Review template not found at $TEMPLATE, skipping review" - echo "APPROVE: template not found, skipping" - exit 0 + echo "ERROR: Review template not found at $TEMPLATE" >&2 + echo "REJECT: review template missing (cannot run review)" + exit 1 fi🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/k8s-rebase/scripts/k8s-rebase-review.sh` around lines 66 - 70, Update the missing-template handling in k8s-rebase-review.sh so a missing $TEMPLATE is treated as a configuration error: keep the warning, remove the APPROVE output, and exit nonzero. Preserve normal review behavior when the template exists.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@plugins/k8s-rebase/gates/step2-compilation/build-vet.md`:
- Line 11: Update the build/vet loop snippet in
plugins/k8s-rebase/gates/step2-compilation/build-vet.md at line 11 and apply the
identical change in
plugins/k8s-rebase/gates/step4-verification/build-vet-recheck.md at line 11: run
go vet even when go build fails, capture both command statuses independently,
and combine them so either failure is reported while preserving the per-module
error count.
In `@plugins/k8s-rebase/gates/step2-compilation/build-vet.sh`:
- Around line 28-46: Update the build and vet command handling around build_out
and vet_out to capture each go build/go vet exit status instead of
unconditionally discarding it. Preserve the existing .go: diagnostic counts and
output, but treat either non-zero status as at least one failure so BUILD-OK or
VET-OK is not emitted for command failures, including cases without .go:
diagnostics.
In `@plugins/k8s-rebase/gates/step2-compilation/test-compilation.md`:
- Around line 8-14: Update the test-compilation command in the compilation gate
to use go test -c -o=/dev/null ./... instead of go test -run='^$' -count=0
./..., preserving the optional -mod=vendor flag for modules with vendor
directories. Revise the surrounding explanation to state that this compiles test
files without running test binaries, package initialization, or TestMain.
In `@plugins/k8s-rebase/gates/step2-compilation/version-consistency.md`:
- Around line 3-6: Replace the `go mod verify` requirement in the vendor
consistency guidance with vendor-mode validation: verify `vendor/modules.txt`,
then run `go list -m ...` and `go build ./...` using `-mod=vendor` for each
module containing a `vendor/` directory.
In `@plugins/k8s-rebase/gates/step3-autofix/crd-validation.md`:
- Around line 21-25: Update the CRD comparison instructions in crd-validation.md
to require initializing BASE from the intended base branch or commit and
validating that it is non-empty and resolvable before running any git show
comparisons. Ensure the subsequent CRD checks use this validated BASE rather
than relying on crd-validation.sh’s local variable.
In `@plugins/k8s-rebase/gates/step3-autofix/crd-validation.sh`:
- Around line 45-57: In plugins/k8s-rebase/gates/step3-autofix/crd-validation.sh
lines 45-57, stop using the grep-based changed-line count as NEW_ISSUES or as
the validation decision; emit changed CRD paths separately and derive issue
counts by semantically parsing each changed or all-new CRD, including type
changes and their range/format constraints. In
plugins/k8s-rebase/gates/step3-autofix/crd-validation.md lines 10-16, remove the
PASS fast-path based on the heuristic count and require semantic inspection of
every changed or all-new CRD.
In `@plugins/k8s-rebase/gates/step3-autofix/deprecated-api-remnants.md`:
- Around line 38-41: Replace the raw symbol-presence baseline check in the
finding-processing logic with a location-aware comparison of base and head
diagnostics or zero-context changed hunks, so only exact pre-existing findings
are excluded. Apply this change at
plugins/k8s-rebase/gates/step3-autofix/deprecated-api-remnants.md lines 38-41
and plugins/k8s-rebase/gates/step3-autofix/deprecated-calls.md lines 46-49;
preserve the behavior of counting newly introduced calls even when the same
symbol exists elsewhere in the file.
In `@plugins/k8s-rebase/gates/step3-autofix/patterns-completeness.sh`:
- Around line 17-33: Update the build-check logic around the `pre` and `new`
counters so baseline build errors are recorded and excluded from newly
introduced failures. Compare each module’s current error count with the
equivalent pre-rebase baseline, incrementing `new` only for the increase while
preserving accurate reporting for unchanged failures.
In `@plugins/k8s-rebase/gates/step4-verification/dep-cve-check.md`:
- Around line 10-32: Update the dependency extraction instructions to collect
both the removed/base version and added/current version for every changed module
in go.sum, preserving their association by module. Use these old/new version
pairs when classifying each CVE as INTRODUCED, PRE-EXISTING, or FIXED, rather
than evaluating only the added versions.
In `@plugins/k8s-rebase/hooks/block-push.md`:
- Around line 21-31: Annotate the fenced literal-response blocks in
plugins/k8s-rebase/hooks/block-push.md lines 21-31 with the text language
identifier, and annotate the container invocation fenced block in
plugins/k8s-rebase/skills/k8s-rebase/SKILL.md lines 34-36 with the bash language
identifier.
In `@plugins/k8s-rebase/scripts/check-pre-existing.sh`:
- Around line 22-23: Update the pattern matching in the pre-existing finding
count commands for base and current files to use literal matching rather than
regular-expression interpretation, while preserving the existing missing-file
and command-failure handling.
In `@plugins/k8s-rebase/scripts/k8s-rebase-autofix.sh`:
- Around line 1567-1596: Update the remediation messages in the case branches
for “Eventf”, “Conformance old names”, and “FieldsV1.Raw” to match the actual
fixes: direct Eventf wrapping to use the %v format, rename to
SupportClusterNetworkPolicy, and recommend GetRawBytes() or
metav1.NewFieldsV1(...) instead of FieldsV1.Items or MarshalJSON(). Keep the
diagnostic searches aligned with those corrected symbols.
In `@plugins/k8s-rebase/scripts/k8s-rebase-test-harness.sh`:
- Around line 10-12: Update the PERMISSION_MODE default in
k8s-rebase-test-harness.sh to a safe permission mode rather than
bypassPermissions, while preserving support for explicitly setting
PERMISSION_MODE=bypassPermissions when running trusted repositories. Ensure
cmd_run continues passing the selected mode to Claude.
In `@plugins/k8s-rebase/scripts/k8s-rebase.sh`:
- Line 322: Remove the hardcoded origin assumption from the default-branch,
module_path, and OCP-stream detection logic surrounding DEFAULT_BRANCH and the
related checks at the other referenced locations. Discover the repository’s
actual remote from git metadata such as git remote -v or git branch -vv, use
that remote consistently, and retain a fallback only when discovery fails.
- Around line 36-45: Preserve and restore an existing pre-push hook in the
k8s-rebase setup flow. Track the backup path created from the existing
"$HOOK_DIR/pre-push", have the generated guard hook instruct users to restore
that backup with mv when present instead of deleting the hook, and update the
script’s final summary to provide the same restoration command while retaining
the removal guidance for repositories without an original hook.
In `@plugins/k8s-rebase/scripts/write-gate-report.sh`:
- Around line 15-16: Validate GATE_NAME immediately after it is read and before
constructing the gate report path, restricting it to the expected safe gate-name
format and rejecting values containing path separators or traversal segments.
Apply the same validation to every output-path use of GATE_NAME, including the
logic around lines 30–32, while preserving the existing verdict handling.
In `@plugins/k8s-rebase/skills/k8s-rebase/SKILL.md`:
- Around line 114-119: Update the Recovery instructions to avoid hardcoding
master in the restart command. Reuse the default branch identified in Step 1
when checking out the base branch, while preserving the existing branch deletion
and rerun steps.
In `@plugins/k8s-rebase/test/gate-hardening.sh`:
- Around line 1074-1084: Initialize gtotal before the conditional gate-directory
setup in the surrounding gate-hardening function, so it is always defined when
the final report block evaluates "$gtotal". Preserve the existing counter
initialization and gate-report behavior when the directory exists, while
ensuring the no-directory path remains safe under set -u.
In `@plugins/k8s-rebase/test/test-skill.sh`:
- Around line 515-518: Update the session tracking block in cmd_run to write the
running/$_repo_key entry unconditionally after launching the background session,
even when _sid is missing or empty. Keep _sid optional in the entry, then remove
the temporary .session_id file as before so the wait loop, auto_record, and make
stop can still track the run.
---
Nitpick comments:
In `@plugins/k8s-rebase/gates/step3-autofix/major-version-imports.md`:
- Around line 51-56: Update the report-writing command in the
step3-major-version-imports gate to use the guarded SCRIPT lookup pattern from
feature-gates.md and patterns-completeness.md. Capture the write-gate-report.sh
path, invoke it only when found, and otherwise print the fallback output so the
gate still produces a report when find returns no result.
In `@plugins/k8s-rebase/gates/step3-autofix/major-version-imports.sh`:
- Around line 37-45: In the generic module scan loop, replace the GNU-only grep
-oP option with portable extended-regex extraction using grep -oE while
preserving the existing pattern. In the BASE classification block, replace the
chained &&/|| expression with an explicit if/else that checks base_has, emits
the same PRE-EXISTING or NEW message, and updates pre or new accordingly.
In `@plugins/k8s-rebase/gates/step3-autofix/patterns-completeness.md`:
- Around line 3-6: Guard the GATE_DIR lookup before invoking
patterns-completeness.sh: detect an empty result and apply the defined fallback
or explicitly stop with a clear error, preserving the intended PATH A/PATH B
selection. Update the command block in patterns-completeness.md without changing
behavior when GATE_DIR is found.
In `@plugins/k8s-rebase/scripts/k8s-rebase-review.sh`:
- Around line 66-70: Update the missing-template handling in
k8s-rebase-review.sh so a missing $TEMPLATE is treated as a configuration error:
keep the warning, remove the APPROVE output, and exit nonzero. Preserve normal
review behavior when the template exists.
In `@plugins/k8s-rebase/test/gate-hardening.sh`:
- Around line 99-212: Extract the duplicated harness routines shared by
mutate_plugin, TAG_TO_PATTERN, _repo_from_key, _do_record_one, and the court
logic from mutate_plugin and test/test-skill.sh into a sourced
test/lib-harness.sh. Update both callers to source and reuse the shared
definitions, preserving mutate_plugin’s redundant-spec suppression and
heading-dedup behavior rather than reverting to the older implementation.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: e1b651de-5d44-403b-9fbd-c4a859e4ecf5
📒 Files selected for processing (63)
.claude-plugin/marketplace.jsondocs/index.htmlplugins/k8s-rebase/.claude-plugin/plugin.jsonplugins/k8s-rebase/Makefileplugins/k8s-rebase/OWNERSplugins/k8s-rebase/README.mdplugins/k8s-rebase/docs/k8s-rebase-patterns.mdplugins/k8s-rebase/gates/step1-rebase/rebase-completeness.mdplugins/k8s-rebase/gates/step2-compilation/build-vet.mdplugins/k8s-rebase/gates/step2-compilation/build-vet.shplugins/k8s-rebase/gates/step2-compilation/diff-scope.mdplugins/k8s-rebase/gates/step2-compilation/fix-correctness.mdplugins/k8s-rebase/gates/step2-compilation/test-compilation.mdplugins/k8s-rebase/gates/step2-compilation/type-conversions.mdplugins/k8s-rebase/gates/step2-compilation/version-consistency.mdplugins/k8s-rebase/gates/step3-autofix/autofix-diff-review.mdplugins/k8s-rebase/gates/step3-autofix/autofix-result.mdplugins/k8s-rebase/gates/step3-autofix/crd-validation.mdplugins/k8s-rebase/gates/step3-autofix/crd-validation.shplugins/k8s-rebase/gates/step3-autofix/dep-release-notes.mdplugins/k8s-rebase/gates/step3-autofix/deprecated-api-remnants.mdplugins/k8s-rebase/gates/step3-autofix/deprecated-calls.mdplugins/k8s-rebase/gates/step3-autofix/e2e-infra.mdplugins/k8s-rebase/gates/step3-autofix/feature-gates.mdplugins/k8s-rebase/gates/step3-autofix/logical-completeness.mdplugins/k8s-rebase/gates/step3-autofix/major-version-imports.mdplugins/k8s-rebase/gates/step3-autofix/major-version-imports.shplugins/k8s-rebase/gates/step3-autofix/patterns-completeness.mdplugins/k8s-rebase/gates/step3-autofix/patterns-completeness.shplugins/k8s-rebase/gates/step4-verification/build-vet-recheck.mdplugins/k8s-rebase/gates/step4-verification/ci-prediction.mdplugins/k8s-rebase/gates/step4-verification/ci-readiness.mdplugins/k8s-rebase/gates/step4-verification/cleanliness.mdplugins/k8s-rebase/gates/step4-verification/commit-messages.mdplugins/k8s-rebase/gates/step4-verification/correctness.mdplugins/k8s-rebase/gates/step4-verification/dep-cve-check.mdplugins/k8s-rebase/gates/step4-verification/deprecated-imports.mdplugins/k8s-rebase/gates/step4-verification/go-version-check.mdplugins/k8s-rebase/gates/step4-verification/gomod-diff-analysis.mdplugins/k8s-rebase/gates/step4-verification/k8s-changelog.mdplugins/k8s-rebase/gates/step4-verification/logical-consistency.mdplugins/k8s-rebase/gates/step4-verification/maintainer-review.mdplugins/k8s-rebase/gates/step4-verification/skill-improvement.mdplugins/k8s-rebase/gates/step4-verification/version-completeness.mdplugins/k8s-rebase/hooks/block-push.mdplugins/k8s-rebase/scripts/check-pre-existing.shplugins/k8s-rebase/scripts/k8s-rebase-autofix.shplugins/k8s-rebase/scripts/k8s-rebase-review-prompt.mdplugins/k8s-rebase/scripts/k8s-rebase-review.shplugins/k8s-rebase/scripts/k8s-rebase-test-harness.shplugins/k8s-rebase/scripts/k8s-rebase-validate.shplugins/k8s-rebase/scripts/k8s-rebase.shplugins/k8s-rebase/scripts/write-gate-report.shplugins/k8s-rebase/skills/k8s-rebase/SKILL.mdplugins/k8s-rebase/test/.matrix-state/.gitignoreplugins/k8s-rebase/test/.matrix-state/known_good_openshift_cluster-network-operatorplugins/k8s-rebase/test/.matrix-state/known_good_openshift_ingress-node-firewallplugins/k8s-rebase/test/.matrix-state/known_good_openshift_multus-cniplugins/k8s-rebase/test/.matrix-state/known_good_ovn-org_ovn-kubernetesplugins/k8s-rebase/test/config.yamlplugins/k8s-rebase/test/gate-hardening.shplugins/k8s-rebase/test/rebase-tracker.yamlplugins/k8s-rebase/test/test-skill.sh
🚧 Files skipped from review as they are similar to previous changes (19)
- plugins/k8s-rebase/.claude-plugin/plugin.json
- plugins/k8s-rebase/OWNERS
- plugins/k8s-rebase/gates/step3-autofix/autofix-diff-review.md
- plugins/k8s-rebase/gates/step2-compilation/fix-correctness.md
- plugins/k8s-rebase/gates/step4-verification/cleanliness.md
- plugins/k8s-rebase/README.md
- plugins/k8s-rebase/scripts/k8s-rebase-review-prompt.md
- docs/index.html
- plugins/k8s-rebase/gates/step4-verification/maintainer-review.md
- plugins/k8s-rebase/gates/step4-verification/ci-readiness.md
- plugins/k8s-rebase/gates/step3-autofix/dep-release-notes.md
- plugins/k8s-rebase/gates/step4-verification/commit-messages.md
- plugins/k8s-rebase/gates/step4-verification/version-completeness.md
- plugins/k8s-rebase/gates/step4-verification/skill-improvement.md
- plugins/k8s-rebase/gates/step3-autofix/e2e-infra.md
- plugins/k8s-rebase/gates/step3-autofix/logical-completeness.md
- plugins/k8s-rebase/gates/step2-compilation/type-conversions.md
- plugins/k8s-rebase/gates/step4-verification/logical-consistency.md
- plugins/k8s-rebase/gates/step4-verification/k8s-changelog.md
| continue | ||
| fi | ||
| echo "CHECK $mod_dir" | ||
| (cd "$mod_dir" && go build ./... 2>&1 && go vet ./... 2>&1) |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Both "exact loop" snippets mis-report build/vet status, and they have diverged from each other. Neither captures the two exit codes independently, so the per-module error count the gates rely on is wrong — and the two copies of what the docs call the same loop now differ.
plugins/k8s-rebase/gates/step2-compilation/build-vet.md#L11-L11: replace the&&chain sogo vetstill runs whengo buildfails, and combine both statuses.plugins/k8s-rebase/gates/step4-verification/build-vet-recheck.md#L11-L11: apply the identical snippet; today{ go build; go vet; }returns only vet's status, so a failed build with clean vet reports success.
🐛 Shared snippet for both files
- (cd "$mod_dir" && go build ./... 2>&1 && go vet ./... 2>&1)
+ (
+ cd "$mod_dir" || exit 1
+ build_rc=0; go build ./... 2>&1 || build_rc=$?
+ vet_rc=0; go vet ./... 2>&1 || vet_rc=$?
+ (( build_rc == 0 && vet_rc == 0 ))
+ )📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| (cd "$mod_dir" && go build ./... 2>&1 && go vet ./... 2>&1) | |
| ( | |
| cd "$mod_dir" || exit 1 | |
| build_rc=0; go build ./... 2>&1 || build_rc=$? | |
| vet_rc=0; go vet ./... 2>&1 || vet_rc=$? | |
| (( build_rc == 0 && vet_rc == 0 )) | |
| ) |
📍 Affects 2 files
plugins/k8s-rebase/gates/step2-compilation/build-vet.md#L11-L11(this comment)plugins/k8s-rebase/gates/step4-verification/build-vet-recheck.md#L11-L11
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@plugins/k8s-rebase/gates/step2-compilation/build-vet.md` at line 11, Update
the build/vet loop snippet in
plugins/k8s-rebase/gates/step2-compilation/build-vet.md at line 11 and apply the
identical change in
plugins/k8s-rebase/gates/step4-verification/build-vet-recheck.md at line 11: run
go vet even when go build fails, capture both command statuses independently,
and combine them so either failure is reported while preserving the per-module
error count.
| build_out=$(cd "$mod_dir" && go build ./... 2>&1) || true | ||
| build_errors=$(echo "$build_out" | grep -c '\.go:' || true) | ||
| if [[ "$build_errors" -gt 0 ]]; then | ||
| echo "BUILD-FAIL $mod_dir: $build_errors errors" | ||
| echo "$build_out" | grep '\.go:' | head -10 | ||
| total_build_errors=$((total_build_errors + build_errors)) | ||
| else | ||
| echo "BUILD-OK $mod_dir" | ||
| fi | ||
|
|
||
| # Vet | ||
| vet_out=$(cd "$mod_dir" && go vet ./... 2>&1) || true | ||
| vet_errors=$(echo "$vet_out" | grep -c '\.go:' || true) | ||
| if [[ "$vet_errors" -gt 0 ]]; then | ||
| echo "VET-FAIL $mod_dir: $vet_errors errors" | ||
| echo "$vet_out" | grep '\.go:' | head -10 | ||
| total_vet_errors=$((total_vet_errors + vet_errors)) | ||
| else | ||
| echo "VET-OK $mod_dir" |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Fail the gate when build or vet exits non-zero.
A failed command with no .go: diagnostic currently emits BUILD-OK or VET-OK, hiding failures such as invalid go.mod, dependency resolution, or toolchain errors. Preserve the diagnostic count, but treat every non-zero exit as at least one failure.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@plugins/k8s-rebase/gates/step2-compilation/build-vet.sh` around lines 28 -
46, Update the build and vet command handling around build_out and vet_out to
capture each go build/go vet exit status instead of unconditionally discarding
it. Preserve the existing .go: diagnostic counts and output, but treat either
non-zero status as at least one failure so BUILD-OK or VET-OK is not emitted for
command failures, including cases without .go: diagnostics.
| For each module, compile tests without executing them: | ||
| `go test -run='^$' -count=0 ./... 2>&1` | ||
| (add `-mod=vendor` if vendor/ exists in the module) | ||
|
|
||
| The flags `-run='^$' -count=0` match zero tests and skip | ||
| execution — this only verifies compilation. Any compilation | ||
| error in a _test.go file is a finding. |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
go help test
go help testflagRepository: openshift-eng/ai-helpers
Length of output: 18167
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Inspect the referenced file and nearby package context without executing repository code.
echo '--- referenced file ---'
sed -n '1,40p' plugins/k8s-rebase/gates/step2-compilation/test-compilation.md
echo '--- go test documentation for -run -list -c ---'
go help testflag | sed -n '/^\t-run /,/^\t-short /p'
go help testflag | sed -n '/^\t-list /p'
go help test | sed -n '/\t-c /,/Flags that apply to the resulting test binary/p'
# Behavioral probe: if the toolchain supports Go modules, create a trivial module under a writable temp dir
# and inspect whether -count=0 still runs TestMain/package init by observing output lines, not test behavior.
tmpdir="$(mktemp -d)"
trap 'rm -rf "$tmpdir"' EXIT
cd "$tmpdir"
go mod init testcompile >/dev/null
cat > package.go <<'EOF'
package testcompile
var initFired bool
func init() { initFired = true }
EOF
cat > package_test.go <<'EOF'
package testcompile
import (
"fmt"
"testing"
)
func init() {
fmt.Println("pkginit-firing")
}
func TestNothing(t *testing.T) { fmt.Println("test-firing") }
func TestMain(m *testing.M) {
fmt.Println("testmain-firing")
m.Run()
}
EOF
echo '--- go test output with -run=^$ -count=0 ---'
go test -run='^$' -count=0 . 2>&1 || true
echo '--- go test -c output ---'
go test -c . 2>&1
echo '--- temp files after -c ---'
find . -type fRepository: openshift-eng/ai-helpers
Length of output: 8707
Use go test -c for read-only test-file compilation.
go test -run='^$' -count=0 still runs the test binary, including package initialization and TestMain, so this read-only gate can trigger repository test side effects with packages like the one under plugins/k8s-rebase/gates/step2-compilation. Compile tests with go test -c -o=/dev/null ./... instead.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@plugins/k8s-rebase/gates/step2-compilation/test-compilation.md` around lines
8 - 14, Update the test-compilation command in the compilation gate to use go
test -c -o=/dev/null ./... instead of go test -run='^$' -count=0 ./...,
preserving the optional -mod=vendor flag for modules with vendor directories.
Revise the surrounding explanation to state that this compiles test files
without running test binaries, package initialization, or TestMain.
| within the same go.mod). For each module with a vendor/ directory, verify | ||
| vendor is in sync with go.mod (check vendor/modules.txt). | ||
| Also run `go mod verify` in vendored modules to check vendor | ||
| consistency mechanically. |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
go help mod verify
go help mod vendor
go help listRepository: openshift-eng/ai-helpers
Length of output: 16887
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== locate file =="
fd -a 'version-consistency.md' . || true
echo "== file contents =="
file="$(fd 'version-consistency.md' . | head -n 1 || true)"
if [ -n "${file:-}" ]; then
cat -n "$file"
fi
echo "== search vendor consistency instructions =="
rg -n "vendor|mod verify|modules.txt|go list|go build" plugins/k8s-rebase/gates .github docs README.md 2>/dev/null | head -n 200Repository: openshift-eng/ai-helpers
Length of output: 20075
Replace go mod verify with vendor-mode package checks.
go mod verify only checks downloaded module source in the module cache, so it cannot detect an out-of-sync vendor/. In modules with vendor/, validate vendor/modules.txt and run go list -m ... / go build ./... using -mod=vendor instead.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@plugins/k8s-rebase/gates/step2-compilation/version-consistency.md` around
lines 3 - 6, Replace the `go mod verify` requirement in the vendor consistency
guidance with vendor-mode validation: verify `vendor/modules.txt`, then run `go
list -m ...` and `go build ./...` using `-mod=vendor` for each module containing
a `vendor/` directory.
| 1. Compare each CRD to the base branch version. Use | ||
| `git show $BASE:<path>` to check the original. | ||
| Flag any validation constraint removed or weakened vs the | ||
| base: deleted pattern, format, minimum/maximum, enum, or | ||
| required entries, or relaxed values. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Initialize and validate BASE before comparing CRDs.
crd-validation.sh cannot export its local BASE into this shell. With it unset, git show $BASE:<path> becomes git show :<path>, which reads the current index and can mask weakened validation.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@plugins/k8s-rebase/gates/step3-autofix/crd-validation.md` around lines 21 -
25, Update the CRD comparison instructions in crd-validation.md to require
initializing BASE from the intended base branch or commit and validating that it
is non-empty and resolvable before running any git show comparisons. Ensure the
subsequent CRD checks use this validated BASE rather than relying on
crd-validation.sh’s local variable.
|
|
||
| # Warn if not on the default branch | ||
| CURRENT_BRANCH=$(git branch --show-current 2>/dev/null || true) | ||
| DEFAULT_BRANCH=$(git symbolic-ref refs/remotes/origin/HEAD 2>/dev/null | sed 's|refs/remotes/origin/||' || true) |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Hardcoded origin remote.
Lines 322, 393, and 824 assume the remote is named origin. On repos where the fork/upstream naming differs, default-branch detection, module_path, and OCP-stream detection all silently degrade. Discover the remote first (e.g. from git branch -vv / git remote -v) and fall back only if discovery fails.
As per coding guidelines: "Code should NEVER assume git remote names like 'origin' or 'upstream' without first discovering them - use git remote -v or git branch -vv to discover remotes first".
Also applies to: 393-393, 824-824
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@plugins/k8s-rebase/scripts/k8s-rebase.sh` at line 322, Remove the hardcoded
origin assumption from the default-branch, module_path, and OCP-stream detection
logic surrounding DEFAULT_BRANCH and the related checks at the other referenced
locations. Discover the repository’s actual remote from git metadata such as git
remote -v or git branch -vv, use that remote consistently, and retain a fallback
only when discovery fails.
Source: Coding guidelines
| GATE_NAME="${2:?Missing gate name}" | ||
| VERDICT="${3:?Missing verdict (PASS, FAIL, or SKIP)}" |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
Validate GATE_NAME before using it as a path component.
A value containing ../ can escape .rebase-tmp/gates/ and create or overwrite an arbitrary reachable *.report file. Restrict it to the expected gate-name format before building the output path.
Also applies to: 30-32
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@plugins/k8s-rebase/scripts/write-gate-report.sh` around lines 15 - 16,
Validate GATE_NAME immediately after it is read and before constructing the gate
report path, restricting it to the expected safe gate-name format and rejecting
values containing path separators or traversal segments. Apply the same
validation to every output-path use of GATE_NAME, including the logic around
lines 30–32, while preserving the existing verdict handling.
| **Recovery:** If a run fails mid-way through Steps 2-4, check | ||
| `git log` on the rebase branch. The mechanical rebase commits | ||
| from Step 1 are always safe. To resume: start a new session on | ||
| the same branch and continue from the failed step. To restart: | ||
| `git checkout master && git branch -D <branch>` and re-run. | ||
|
|
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Do not hardcode master in the recovery command.
The skill supports both master and main, but this recovery command fails outright for main-based repositories. Use the default branch identified at Step 1.
🧰 Tools
🪛 SkillSpector (2.3.11)
[error] 351: [TM1] Tool Parameter Abuse: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Remediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
(Tool Misuse (TM1))
[error] 448: [TM1] Tool Parameter Abuse: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Remediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
(Tool Misuse (TM1))
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@plugins/k8s-rebase/skills/k8s-rebase/SKILL.md` around lines 114 - 119, Update
the Recovery instructions to avoid hardcoding master in the restart command.
Reuse the default branch identified in Step 1 when checking out the base branch,
while preserving the existing branch deletion and rerun steps.
| { | ||
| echo "$ts $spec $short $verdict $detail" | ||
| if [[ -d "$gate_dir" && "$gtotal" -gt 0 ]]; then | ||
| echo "---GATE-REPORTS---" | ||
| for f in "$gate_dir"/*.report; do | ||
| [[ -f "$f" ]] || continue | ||
| echo "=== $(basename "$f" .report) ===" | ||
| cat "$f" | ||
| echo "" | ||
| done | ||
| fi |
There was a problem hiding this comment.
🩺 Stability & Availability | 🔴 Critical | ⚡ Quick win
$gtotal is unbound here when no gate directory exists — set -u aborts the function.
gtotal is declared at Line 991 inside the if [[ -d "$gate_dir" ]] block. When that block never runs (no .rebase-tmp/gates), Line 1076 dereferences an unset variable and, with set -uo pipefail (Line 17), the shell exits — the done file is truncated and running/$repo_key is never cleaned up. Declare the counters before the if.
🐛 Proposed fix
+ local gtotal=0 gpass=0 gfail=0 gskip=0
if [[ -d "$gate_dir" ]]; then
- local gtotal=0 gpass=0 gfail=0 gskip=0
for f in "$gate_dir"/*.report; do📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| { | |
| echo "$ts $spec $short $verdict $detail" | |
| if [[ -d "$gate_dir" && "$gtotal" -gt 0 ]]; then | |
| echo "---GATE-REPORTS---" | |
| for f in "$gate_dir"/*.report; do | |
| [[ -f "$f" ]] || continue | |
| echo "=== $(basename "$f" .report) ===" | |
| cat "$f" | |
| echo "" | |
| done | |
| fi | |
| { | |
| echo "$ts $spec $short $verdict $detail" | |
| local gtotal=0 gpass=0 gfail=0 gskip=0 | |
| if [[ -d "$gate_dir" && "$gtotal" -gt 0 ]]; then | |
| echo "---GATE-REPORTS---" | |
| for f in "$gate_dir"/*.report; do | |
| [[ -f "$f" ]] || continue | |
| echo "=== $(basename "$f" .report) ===" | |
| cat "$f" | |
| echo "" | |
| done | |
| fi |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@plugins/k8s-rebase/test/gate-hardening.sh` around lines 1074 - 1084,
Initialize gtotal before the conditional gate-directory setup in the surrounding
gate-hardening function, so it is always defined when the final report block
evaluates "$gtotal". Preserve the existing counter initialization and
gate-report behavior when the directory exists, while ensuring the no-directory
path remains safe under set -u.
| # Append session ID to running file for reliable stop | ||
| local _sid=$(cat "$RESULTS_DIR/.session_id_$_repo_key" 2>/dev/null) | ||
| [[ -n "$_sid" ]] && printf '%s\t%s\t%s\n' "${specs[*]}" "$(date +%s)" "$_sid" > "$_state_dir/running/$_repo_key" | ||
| rm -f "$RESULTS_DIR/.session_id_$_repo_key" 2>/dev/null |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
Session becomes untracked when the session ID can't be read.
cmd_run has already launched the background session by this point. If .session_id_$_repo_key is missing or empty, no running/ entry is written: the wait loop at Line 524 exits immediately, auto_record never sees the run, and make stop can't find it. Write the running entry unconditionally and treat the sid as optional.
🐛 Proposed fix
local _sid=$(cat "$RESULTS_DIR/.session_id_$_repo_key" 2>/dev/null)
-[[ -n "$_sid" ]] && printf '%s\t%s\t%s\n' "${specs[*]}" "$(date +%s)" "$_sid" > "$_state_dir/running/$_repo_key"
+[[ -z "$_sid" ]] && warn "No session ID captured for $_repo_key — stop/record will rely on gate state"
+printf '%s\t%s\t%s\n' "${specs[*]}" "$(date +%s)" "$_sid" > "$_state_dir/running/$_repo_key"
rm -f "$RESULTS_DIR/.session_id_$_repo_key" 2>/dev/null📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| # Append session ID to running file for reliable stop | |
| local _sid=$(cat "$RESULTS_DIR/.session_id_$_repo_key" 2>/dev/null) | |
| [[ -n "$_sid" ]] && printf '%s\t%s\t%s\n' "${specs[*]}" "$(date +%s)" "$_sid" > "$_state_dir/running/$_repo_key" | |
| rm -f "$RESULTS_DIR/.session_id_$_repo_key" 2>/dev/null | |
| # Append session ID to running file for reliable stop | |
| local _sid=$(cat "$RESULTS_DIR/.session_id_$_repo_key" 2>/dev/null) | |
| [[ -z "$_sid" ]] && warn "No session ID captured for $_repo_key — stop/record will rely on gate state" | |
| printf '%s\t%s\t%s\n' "${specs[*]}" "$(date +%s)" "$_sid" > "$_state_dir/running/$_repo_key" | |
| rm -f "$RESULTS_DIR/.session_id_$_repo_key" 2>/dev/null |
🧰 Tools
🪛 Shellcheck (0.11.0)
[warning] 516-516: Declare and assign separately to avoid masking return values.
(SC2155)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@plugins/k8s-rebase/test/test-skill.sh` around lines 515 - 518, Update the
session tracking block in cmd_run to write the running/$_repo_key entry
unconditionally after launching the background session, even when _sid is
missing or empty. Keep _sid optional in the entry, then remove the temporary
.session_id file as before so the wait loop, auto_record, and make stop can
still track the run.
Automates Kubernetes dependency rebases for Go projects that consume
k8s.io/* packages. The skill scans go.mod, derives version bumps,
runs codegen, updates version references, and applies automated
fixes with 33 adversarial gate verifications.
Components:
- skills/k8s-rebase/SKILL.md: 5-step rebase workflow with scope
discipline, gate-fix loops, and downstream support
- scripts/k8s-rebase.sh: mechanical rebase (go get, tidy, vendor)
- scripts/k8s-rebase-autofix.sh: 22 deterministic fix functions
(x/exp migration, klog v2, CRD validation, feature gates, etc.)
- gates/step{1-4}/: 33 subagent verification prompts across
rebase completeness, compilation, autofix review, and final
verification
- docs/k8s-rebase-patterns.md: documented breakage patterns
- test/test-skill.sh + Makefile: blocking test harness with
adversarial court review, concurrency control, and auto-recording
- test/config.yaml: 6-repo test matrix with known-good references
Tested against: ovn-org/ovn-kubernetes, ovn-kubernetes/ovn-kubernetes-mcp,
openshift/multus-cni, openshift/ingress-node-firewall,
openshift/cloud-network-config-controller, openshift/cluster-network-operator
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
3a1375b to
59771cc
Compare
|
The OWNERS file contains untrusted users, which makes it INVALID. The following users are mentioned in OWNERS file(s) but are untrusted for the following reasons. One way to make the user trusted is to add them as members of the openshift-eng org. You can then trigger verification by writing
|
2 participants
Automates k8s.io/* dependency rebases for Go projects. Handles dep bumps, codegen, version references, compilation fixes, lint migration, feature gate management, and antagonistic review.
The skill improves itself across runs: when a rebase surfaces a new breakage pattern (via gates, local validation, or CI), the agent fixes it and documents the pattern. The next repo or k8s version benefits from that pattern automatically — through autofix functions, gate checks, or patterns doc entries.
Scripts:
29 gate subagents across 4 verification steps verify the rebase before the agent proceeds. Count gates enforce hard constraints (build errors, version mismatches, test skips). Judge gates review diffs for correctness. Discovery gates read external signals (dep release notes, k8s changelog, CVE databases, go.mod risk classification) to catch issues that build/lint/test cannot detect.
Patterns doc catalogs 30+ breakage patterns with fix recipes and extension guide for future k8s versions.
What this PR does / why we need it:
Which issue(s) this PR fixes:
Fixes
Special notes for your reviewer:
Checklist:
Summary by CodeRabbit
New Features
k8s-rebasemarketplace plugin (v0.2.1) to automate Kubernetesk8s.io/*dependency rebases for Go repositories, including deterministic staged processing, code generation updates, repo reference syncing, and fix review/verification flow.Documentation
k8s-rebaseskill guide plus extensive Kubernetes rebase pattern references and step-by-step, read-only gate checklists (build/vet, compilation, autofix review, CI readiness, correctness, CVE checks).