Skip to content

fix(kubescape): preserve native summary metadata during repair - #5455

Merged
devantler merged 4 commits into
mainfrom
codex/storage-native-codec-5419
Oct 28, 2026
Merged

devantler merged 4 commits into
mainfrom
codex/storage-native-codec-5419

Conversation

@devantler

Copy link
Copy Markdown
Contributor

🤖 Generated by the Agentic Engineer

Why

The current summary repair rejects the format used by the service, leaving scan updates blocked.

What

Builds a corrected repair that preserves existing records and their safety checks. Publishing and deploying the resulting image remain separate steps tracked in #5419.

Part of #5419

@devantler

Copy link
Copy Markdown
Contributor Author

🤖 Generated by the Agentic Engineer

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Oct 27, 2026 •

Copy link
Copy Markdown
Contributor
⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@coderabbitai

coderabbitai Bot commented Oct 27, 2026

Copy link
Copy Markdown
Contributor

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 56 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration
Commits

Reviewing files that changed from the base of the PR and between 410d561 and 958ddec.

Files selected for processing: 3
  • .github/workflows/publish-kubescape-storage-hotfix.yaml
  • k8s/bases/infrastructure/controllers/kubescape/storage-v0.0.297-summary-native-codec.patch
  • scripts/tests/test-kubescape-storage-hotfix.sh
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@devantler

Copy link
Copy Markdown
Contributor Author

🤖 Generated by the Agentic Engineer

cr:no-gate@958ddec — CodeRabbit did not review this head. Its authenticated rate-limit receipt, posted 2026-10-27 at 19:58:12 UTC and freshly read at 19:59 UTC, states that this repository has no included review available and gives a 56-minute refill window, ending about 20:54:12 UTC. The command reply also reports that the action was not completed. There is no substantive verdict or finding in either artifact. Advancing to Codex under the existing request lock; no paid review or bypass is requested.

@devantler

Copy link
Copy Markdown
Contributor Author

🤖 Generated by the Agentic Engineer

@codex review

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 27, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-27T22:54:45.577314Z 36a4ec7 Manual request
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@devantler

devantler commented Oct 27, 2026 •

Copy link
Copy Markdown
Contributor Author

🤖 Generated by the Agentic Engineer

codex:no-gate@958ddec — The request at 20:00:05 UTC received an eyes reaction and a running summary at 20:00:24 UTC. Fresh complete comment, review, thread and inline reads immediately before this record still show that unchanged running summary, no substantive verdict and no findings. This acknowledged request has exceeded a generous 30-minute response window without published progress. The no-gate guard admits the record. Advancing to Bugbot under the request lock; any later Codex verdict or finding supersedes this stall record and must be addressed.

@devantler

Copy link
Copy Markdown
Contributor Author

🤖 Generated by the Agentic Engineer

@devantler

Copy link
Copy Markdown
Contributor Author

@cursor review

@cursor cursor Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

Reviewed by Cursor Bugbot for commit 958ddec. Configure here.

Copy link
Copy Markdown
Contributor Author

🤖 Generated by the Agentic Engineer

Readiness at 958ddec: the current check set has 38 successes and 11 intentional skips; CodeRabbit's neutral result is its documented quota refusal. Bugbot completed a successful review of this exact head. Fresh complete discussion, review, inline and thread reads show no unresolved finding or maintainer requirement. The commit signature is verified, the branch is clean, and GitHub reports it mergeable against the fetched main revision a7fc527.

The repair was exercised against the native record representation, including preserved payloads, normal updates, watches, stale writes and refusal controls. The full race suite and build pass. The Linux image verification run succeeded. All readable required checks and workflows pass; native code quality remains UNVERIFIED because it has no readable result and is left to normal protected enforcement. No bypass is requested.

Promoting for the protected queue. Publication, signed-image verification, separate deployment, native repair results and complete scan coverage remain acceptance gates on #5419; this source readiness does not establish their completion.

@devantler
devantler marked this pull request as ready for review October 27, 2026 20:43
@devantler
devantler added this pull request to the merge queue Oct 27, 2026
@devantler
devantler marked this pull request as draft October 27, 2026 22:14
@devantler
devantler removed this pull request from the merge queue due to a manual request Oct 27, 2026

Copy link
Copy Markdown
Contributor Author

🤖 Generated by the Agentic Engineer

Updated to 36a4ec7. The earlier readiness record applies only to 958ddec and is superseded. This PR is draft and was explicitly removed from the queue before changes; no deployment candidate for it had started.

The publisher now installs its signing tools through the checksum-verified repository helper. The generated codec patch is bound to exact source bytes before and after application, and an independent temporary-index replay confirms the repaired Go source is identical to the version already tested. The compatibility-image contract, installer refusal controls, signing-validator tests, Actionlint, workflow security audit, ShellCheck and full PR whitespace validation pass. Fresh Linux factory CI and a new current-head review remain required before promotion and protected enqueueing.

Publication, signed-digest verification, separate adoption and native repair/coverage acceptance remain on #5419.

Copy link
Copy Markdown
Contributor Author

🤖 Generated by the Agentic Engineer

cr:no-gate@36a4ec7 — CodeRabbit's freshly authenticated repository quota receipt remains valid until 22:59:41 UTC with margin. No CodeRabbit review or finding has been delivered at this new head; the live no-gate guard admits this record. All current-head CI checks are settled green or intentionally skipped, including Linux image verification. Advancing once to Codex under this head's owned request lock.

Copy link
Copy Markdown
Contributor Author

🤖 Generated by the Agentic Engineer

@codex review

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: 36a4ec70fb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Copy link
Copy Markdown
Contributor Author

🤖 Generated by the Agentic Engineer

Readiness at 36a4ec70fb94a6ac38a022481911584819793728: fresh Linux factory verification and CI pass. The complete current-head check set is settled, with only intentional skips. Codex completed this head without findings; fresh complete discussion/review/thread reads contain no unresolved finding.

User evaluation exercised the native record format, normal updates/watches and refusal/race controls. The regenerated patch produces byte-identical tested Go source, with exact before/after identities enforced by the image factory. The checksum-verified signing-tool path and its failure controls pass. The signed branch is clean and GitHub reports CLEAN. All readable required gates pass; configured native code quality remains independently UNVERIFIED and is left to normal protected enforcement. The live-health gate exits zero.

Promoting for the protected queue. Publication, signed-digest verification, separate adoption, observed native repair and complete scan coverage remain acceptance gates on #5419; the previous 958ddec readiness record remains superseded.

@devantler
devantler marked this pull request as ready for review October 27, 2026 22:56
@devantler
devantler added this pull request to the merge queue Oct 27, 2026
Merged via the queue into main with commit f8fd002 Oct 28, 2026
49 checks passed
@devantler
devantler deleted the codex/storage-native-codec-5419 branch October 28, 2026 03:58
@github-project-automation github-project-automation Bot moved this from 🫴 Ready to ✅ Done in 🌊 Project Board Oct 28, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: ✅ Done

Development

Successfully merging this pull request may close these issues.

1 participant