Skip to content

Add attended scripts for multi-branch UBI bump and module update PRs - #3430

Merged
simonbaird merged 1 commit into
conforma:mainfrom
simonbaird:ubi-bump-automation
Aug 19, 2026
Merged

Add attended scripts for multi-branch UBI bump and module update PRs#3430
simonbaird merged 1 commit into
conforma:mainfrom
simonbaird:ubi-bump-automation

Conversation

@simonbaird

@simonbaird simonbaird commented Jul 22, 2026

Copy link
Copy Markdown
Member

Summary

  • Adds hack/ubi-bump-prs.sh, an attended script that creates UBI base image bump PRs across all active release branches
  • Wraps hack/ubi-base-image-bump.sh and adds RPM version diffing (via podman run rpm -qa) in both the commit message and PR body
  • Prompts for confirmation before creating each PR
  • Also add a similar script for golang module updates. This script wraps the hack/go-mod-upgrade-helper.sh in a similar way, and produces PRs in three branches.

Ref: https://redhat.atlassian.net/browse/EC-2120

@coderabbitai

coderabbitai Bot commented Jul 22, 2026

Copy link
Copy Markdown

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: dcc341b5-0042-4b7c-8c2b-5360b91e5036

📥 Commits

Reviewing files that changed from the base of the PR and between 747be31 and 10c895b.

📒 Files selected for processing (1)
  • hack/go-mod-upgrade-prs.sh
🚧 Files skipped from review as they are similar to previous changes (1)
  • hack/go-mod-upgrade-prs.sh

Included review availability: Your plan includes up to 12 reviews per rolling hour; 11 remain after this review.


📝 Walkthrough

Walkthrough

The pull request adds two attended Bash scripts. One creates Go module upgrade pull requests across release branches. The other creates UBI base-image bump pull requests. Both validate repository state, process branches, push generated changes, create GitHub pull requests, and report results.

Changes

Go module upgrade pull requests

Layer / File(s) Summary
Prepare and process module upgrades
hack/go-mod-upgrade-prs.sh
Parses options, validates prerequisites and repository state, discovers module versions, runs the upgrade helper, handles failures and no-op updates, and reports changes.
Publish module upgrade pull requests
hack/go-mod-upgrade-prs.sh
Confirms changes, pushes branches with force-with-lease recovery, creates GitHub pull requests, and reports their URLs.

UBI base-image bump pull requests

Layer / File(s) Summary
Prepare and process image bumps
hack/ubi-bump-prs.sh
Configures image settings, validates prerequisites and repository state, resolves the latest UBI digest, runs the bump helper, validates the result, and compares RPM inventories.
Publish image bump pull requests
hack/ubi-bump-prs.sh
Confirms changes, commits digest and RPM details, pushes branches with force-with-lease recovery, creates GitHub pull requests, and reports their URLs.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Merge Risk: ⚪ Minimal · up to 10c89

The PR adds attended automation for UBI and Go module update pull requests; no actionable merge-blocking risk remains after normal checks and review.

Sequence Diagram(s)

sequenceDiagram
  participant Operator
  participant AutomationScript
  participant Git
  participant ExternalTools
  participant GitHub
  Operator->>AutomationScript: select module or image and branches
  AutomationScript->>Git: validate state and fetch upstream
  AutomationScript->>ExternalTools: run upgrade or image bump workflow
  ExternalTools-->>AutomationScript: return update results
  AutomationScript->>Git: commit and push generated branch
  Git-->>AutomationScript: return push result
  AutomationScript->>GitHub: create pull request
  GitHub-->>AutomationScript: return pull request URL
Loading
🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Title check ✅ Passed The title clearly summarizes the addition of attended scripts for UBI and Go module update pull requests.
Description check ✅ Passed The description explains both scripts, their main behavior, and links Jira ticket EC-2120, covering the template's required information.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@qodo-for-conforma

qodo-for-conforma Bot commented Jul 22, 2026

Copy link
Copy Markdown

PR Summary by Qodo

Add attended scripts to open multi-branch UBI and Go module update PRs

✨ Enhancement 🕐 40+ Minutes

Grey Divider

AI Description

• Add attended automation to create UBI base-image bump PRs across active release branches.
• Include RPM-level diff output and digest metadata in commits and PR bodies for traceability.
• Add attended automation to create Go module upgrade PRs across default release branches.
Diagram

graph TD
  A([Developer]) --> B["hack/ubi-bump-prs.sh"] --> C[("git: upstream/origin")]
  C --> D["hack/ubi-base-image-bump.sh"] --> E["skopeo/podman + rpm -qa"] --> F{{"GitHub (gh pr create)"}}
  A --> G["hack/go-mod-upgrade-prs.sh"] --> C --> H["hack/go-mod-upgrade-helper.sh"] --> F
  subgraph Legend
    direction LR
    _u([User]) ~~~ _p[Script/Process] ~~~ _git[(Git repo/remotes)] ~~~ _ext{{External service}}
  end
Loading
High-Level Assessment

The following are alternative approaches to this PR:

1. GitHub Actions workflow for branch fan-out PRs
  • ➕ Removes need for local toolchain (podman/skopeo/gh) on developer machines
  • ➕ Enables scheduled/recurring dependency maintenance with consistent environment
  • ➕ Centralizes credentials and rate limiting
  • ➖ Harder to keep 'attended' human-in-the-loop approvals per branch
  • ➖ More setup/maintenance (workflow permissions, secrets, runner capabilities for podman/skopeo)
  • ➖ Debugging failures can be slower than local iteration
2. Shared library functions to deduplicate PR/push logic
  • ➕ Reduces duplicated push/force-with-lease/summary logic between the two scripts
  • ➕ Makes future multi-branch tooling more consistent and easier to maintain
  • ➖ Adds indirection for simple one-off scripts
  • ➖ May be overkill unless more scripts adopt the same pattern
3. Non-attended mode with a dry-run report
  • ➕ Speeds up bulk maintenance by avoiding per-branch prompts when desired
  • ➕ Dry-run output could be attached to a single tracking issue/PR description
  • ➖ Higher risk of generating unwanted PRs across branches
  • ➖ Requires careful safeguards (branch allowlists, PR existence checks)

Recommendation: The attended wrapper approach is a good fit for multi-branch maintenance because it preserves per-branch review/confirmation while reusing the existing bump/upgrade helpers. If this pattern expands to more automation scripts, consider extracting shared git/gh push+PR creation helpers to reduce duplication; otherwise keeping them as standalone scripts is reasonable.

Files changed (2) +473 / -0

Other (2) +473 / -0
go-mod-upgrade-prs.shAttended multi-branch Go module upgrade PR creator +231/-0

Attended multi-branch Go module upgrade PR creator

• Adds a wrapper script that iterates active branches (default: release-v0.7, release-v0.8, main), checks whether a module is present, runs the existing go module upgrade helper, and creates a PR per branch via 'gh'. Captures old/new module versions and prompts before pushing/creating each PR, with optional JIRA reference and a tidy-error override passthrough.

hack/go-mod-upgrade-prs.sh

ubi-bump-prs.shAttended multi-branch UBI digest bump PR creator with RPM diffs +242/-0

Attended multi-branch UBI digest bump PR creator with RPM diffs

• Adds an attended wrapper around 'hack/ubi-base-image-bump.sh' to bump the ubi-minimal digest across active branches and open a PR per branch. Computes an RPM package diff by running 'rpm -qa' in old/new images and includes digest + RPM diff content in the commit message and PR body, with safeguards for clean working trees and optional force-with-lease retry on push failures.

hack/ubi-bump-prs.sh

@simonbaird

Copy link
Copy Markdown
Member Author

@fullsend-ai-review

fullsend-ai-review Bot commented Jul 22, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 3:13 PM UTC · Completed 3:27 PM UTC
Commit: 87c4a29 · View workflow run →

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@hack/ubi-bump-prs.sh`:
- Around line 172-176: Update the failed-push handling around the git push in
the script to distinguish non-fast-forward failures, fetch the current remote
state before retrying, and use an explicit --force-with-lease instead of -f. Do
not offer or perform an unconditional force push; preserve the existing prompt
and branch variables while ensuring collaborators’ remote commits cannot be
silently overwritten.
- Around line 140-145: In the declined-PR branch of the interactive loop, reset
the work branch to "$UPSTREAM_REMOTE/$BRANCH" before continuing so the bump’s
tracked changes are discarded and later git checkout -B operations can proceed.
Update the logic surrounding the answer check and preserve the existing skip
messages and continue behavior.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: 49eab71c-fba6-403c-b62d-d77c46e186ef

📥 Commits

Reviewing files that changed from the base of the PR and between 8e9b358 and c48f604.

📒 Files selected for processing (1)
  • hack/ubi-bump-prs.sh

Comment thread hack/ubi-bump-prs.sh Outdated
Comment thread hack/ubi-bump-prs.sh Outdated
@qodo-for-conforma

qodo-for-conforma Bot commented Jul 22, 2026

Copy link
Copy Markdown

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📜 Skill insights (0)

Grey Divider


Action required

1. Skip leaves dirty tree ✓ Resolved 🐞 Bug ☼ Reliability
Description
If the user declines PR creation after the bump runs, the script continues without resetting the
working tree, leaving modified files and likely breaking the next branch checkout (and preventing
EXIT cleanup from restoring the original branch). This can stop the multi-branch run mid-way and
leave the repo on a temporary branch with uncommitted changes.
Code

hack/ubi-bump-prs.sh[R105-146]

+	# Run the existing bump script (no commit)
+	hack/ubi-base-image-bump.sh --no-commit
+
+	# Verify the new digest (use whatever the bump script actually wrote)
+	NEW_DIGEST=$(grep -oP "ubi-minimal:latest@sha256:\K[0-9a-f]{64}" Dockerfile | head -1)
+	echo
+	echo "Digest after bump: sha256:${NEW_DIGEST:0:16}..."
+
+	# Generate RPM diff (amd64 — representative for commit/PR info)
+	echo
+	echo "Pulling images for RPM comparison..."
+	OLD_RPMS=$(podman run --rm "${UBI_MINIMAL_REPO}@sha256:$OLD_DIGEST" rpm -qa | sort)
+	NEW_RPMS=$(podman run --rm "${UBI_MINIMAL_REPO}@sha256:$NEW_DIGEST" rpm -qa | sort)
+
+	RPM_DIFF=$(diff \
+		--old-line-format='- %L' \
+		--new-line-format='+ %L' \
+		--unchanged-line-format='' \
+		<(echo "$OLD_RPMS") <(echo "$NEW_RPMS") || true)
+
+	echo
+	if [[ -n "$RPM_DIFF" ]]; then
+		echo "RPM changes:"
+		echo "$RPM_DIFF"
+	else
+		echo "No RPM changes detected."
+	fi
+
+	echo
+	echo "File changes:"
+	git diff --stat
+	echo
+
+	# --- Prompt ---------------------------------------------------------------
+
+	read -rp ">>> Create PR for $BRANCH? [y/N] " answer
+	echo
+	if [[ "${answer,,}" != "y" ]]; then
+		echo "Skipping $BRANCH."
+		echo
+		continue
+	fi
Relevance

●● Moderate

No historical evidence about resetting dirty trees on user skip; only general script cleanup
patterns seen.

PR-#3037

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
The new script runs the bump script before prompting and then continues on non-"y" without any
reset; the bump script demonstrably edits Dockerfiles via sed and runs hack/update-rpm-lock.sh,
so the working tree is left modified unless committed or reset.

hack/ubi-bump-prs.sh[65-67]
hack/ubi-bump-prs.sh[105-146]
hack/ubi-base-image-bump.sh[32-44]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`hack/ubi-bump-prs.sh` runs `hack/ubi-base-image-bump.sh --no-commit` before prompting. If the user answers anything other than `y`, the script `continue`s without cleaning up the modified working tree. That leaves tracked changes in place, which can cause subsequent `git checkout -B ...` to fail (changes would be overwritten) and also makes the EXIT `cleanup()` checkout unreliable (and it currently suppresses failures).

### Issue Context
The bump script edits Dockerfiles and updates `rpms.lock.yaml`, so after the bump step the tree is dirty unless you commit or reset.

### Fix Focus Areas
- hack/ubi-bump-prs.sh[65-67]
- hack/ubi-bump-prs.sh[105-146]

### Suggested fix
- Before each `continue` that skips PR creation (and also before exiting on push/PR-create failures), restore a clean state, e.g.:
 - `git reset --hard` (or `git reset --hard "$UPSTREAM_REMOTE/$BRANCH"`)
 - `git clean -fd` (in case the bump script ever creates files)
- Consider enhancing `cleanup()` to also hard-reset/clean if currently on a work branch, so it can reliably return to `ORIGINAL_BRANCH` even after partial runs.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools



Remediation recommended

2. Fetch aborts on push error ✗ Dismissed 🐞 Bug ☼ Reliability ⭐ New
Description
In go-mod-upgrade-prs.sh and ubi-bump-prs.sh, after a failed push the scripts unconditionally run
git fetch "$PUSH_REMOTE" "$WORK_BRANCH"; because set -o errexit is enabled, a fetch failure can
terminate the run before reaching the force-with-lease retry prompt. This can unexpectedly abort
multi-branch processing when the remote branch doesn’t exist or there are auth/network/remote
issues.
Code

hack/go-mod-upgrade-prs.sh[R177-181]

+  if ! git push -u "$PUSH_REMOTE" "$WORK_BRANCH" 2>&1; then
+    echo
+    echo "Push failed — remote branch may already exist."
+    git fetch "$PUSH_REMOTE" "$WORK_BRANCH"
+    read -rp ">>> Retry with --force-with-lease? [y/N] " force_answer
Relevance

●●● Strong

Reliability fix: under errexit, unguarded fetch can abort before retry prompt; likely to be
accepted.

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
Both scripts are described as enabling set -o errexit and, in the push-failure handling path,
calling git fetch "$PUSH_REMOTE" "$WORK_BRANCH" without guarding its exit status; under errexit,
any non-zero return from that fetch will cause the script to exit immediately, which explains how
failures (e.g., missing remote branch or connectivity/auth problems) can prevent the subsequent
force-with-lease prompt and prematurely end a multi-branch run.

hack/go-mod-upgrade-prs.sh[31-33]
hack/go-mod-upgrade-prs.sh[177-182]
hack/ubi-bump-prs.sh[29-31]
hack/ubi-bump-prs.sh[185-190]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`hack/go-mod-upgrade-prs.sh` and `hack/ubi-bump-prs.sh` use `set -o errexit` and, on push failure, unconditionally run `git fetch "$PUSH_REMOTE" "$WORK_BRANCH"`. If that fetch fails, the scripts exit before prompting for a `--force-with-lease` retry, which can abort multi-branch runs unexpectedly.

## Issue Context
A failed push does not guarantee that a remote branch exists or that the remote is reachable/authenticated (push failures can be caused by permissions, remote downtime, branch policy, auth/network issues, etc.), so the follow-up fetch should not be allowed to terminate the script. If the remote branch doesn’t exist, the force-with-lease prompt may not make sense; the scripts should handle this case gracefully and continue.

## Fix Focus Areas
- hack/go-mod-upgrade-prs.sh[177-181]
- hack/ubi-bump-prs.sh[185-190]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


3. RPM diff arch not pinned ✓ Resolved 🐞 Bug ≡ Correctness
Description
The script claims the RPM diff is "amd64", but the podman run commands do not specify
--platform, so on non-amd64 hosts the RPM list can differ (or fail) and the commit/PR metadata
becomes inaccurate. This repo already pins linux/amd64 for RPM lock generation to avoid
platform-variant issues.
Code

hack/ubi-bump-prs.sh[R113-118]

+	# Generate RPM diff (amd64 — representative for commit/PR info)
+	echo
+	echo "Pulling images for RPM comparison..."
+	OLD_RPMS=$(podman run --rm "${UBI_MINIMAL_REPO}@sha256:$OLD_DIGEST" rpm -qa | sort)
+	NEW_RPMS=$(podman run --rm "${UBI_MINIMAL_REPO}@sha256:$NEW_DIGEST" rpm -qa | sort)
+
Relevance

●●● Strong

PR #3037 added linux/amd64 pin on podman run/build for consistent results; likely to want same here.

PR-#3037

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
The new script runs podman run without --platform even though it states amd64 intent; a related
repo script explicitly pins linux/amd64, indicating this is important for consistent results.

hack/ubi-bump-prs.sh[113-118]
hack/update-rpm-lock.sh[26-29]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The RPM comparison uses `podman run` without `--platform`, so the RPM lists are host-architecture dependent. The script comment says "amd64" but the implementation does not enforce it.

### Issue Context
`hack/update-rpm-lock.sh` explicitly pins `PLATFORM="linux/amd64"` for compatibility with base images, suggesting cross-arch differences are already a known concern in this repo.

### Fix Focus Areas
- hack/ubi-bump-prs.sh[113-118]

### Suggested fix
- Add a `PLATFORM=linux/amd64` variable (optionally overridable via env) and use it for both runs:
 - `podman run --platform "$PLATFORM" --rm ... rpm -qa`
- Update the comment to match the enforced behavior (or remove "amd64" wording if you intend host-arch diffs).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


4. Bash 4-only lowercase ✓ Resolved 🐞 Bug ☼ Reliability
Description
The script uses ${answer,,} / ${force_answer,,} for case-folding, which requires Bash 4+ and
will fail on older Bash installations. This makes the script unexpectedly non-portable for developer
environments.
Code

hack/ubi-bump-prs.sh[R140-176]

+	read -rp ">>> Create PR for $BRANCH? [y/N] " answer
+	echo
+	if [[ "${answer,,}" != "y" ]]; then
+		echo "Skipping $BRANCH."
+		echo
+		continue
+	fi
+
+	# --- Commit ---------------------------------------------------------------
+
+	COMMIT_MSG="chore(deps): Update ubi-minimal base image
+
+Old digest: sha256:$OLD_DIGEST
+New digest: sha256:$NEW_DIGEST"
+
+	if [[ -n "$RPM_DIFF" ]]; then
+		COMMIT_MSG="$COMMIT_MSG
+
+RPM changes:
+
+$RPM_DIFF"
+	fi
+
+	EXISTING_FILES=()
+	for f in "${DOCKER_FILES[@]}" rpms.lock.yaml; do
+		[[ -f "$f" ]] && EXISTING_FILES+=("$f")
+	done
+	git add "${EXISTING_FILES[@]}"
+	git commit -m "$COMMIT_MSG"
+
+	# --- Push -----------------------------------------------------------------
+
+	if ! git push -u "$PUSH_REMOTE" "$WORK_BRANCH" 2>&1; then
+		echo
+		read -rp ">>> Push failed (branch may already exist). Force push? [y/N] " force_answer
+		if [[ "${force_answer,,}" == "y" ]]; then
+			git push -f -u "$PUSH_REMOTE" "$WORK_BRANCH"
Relevance

●● Moderate

No historical reviews found about avoiding Bash 4-only ${var,,}; portability intent unclear despite
macOS tooling.

PR-#2977
PR-#3037

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
The new script uses ${var,,} for prompt handling in two places, which is a Bash 4+ feature and
thus can cause runtime failure in environments with older Bash.

hack/ubi-bump-prs.sh[140-146]
hack/ubi-bump-prs.sh[172-177]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The script uses Bash 4+ case conversion `${var,,}` when checking prompt responses, which breaks on older Bash versions.

### Issue Context
This script is intended as an attended developer tool, so it should either (a) run on common developer shells or (b) explicitly assert a minimum Bash version.

### Fix Focus Areas
- hack/ubi-bump-prs.sh[140-146]
- hack/ubi-bump-prs.sh[174-177]

### Suggested fix
- Replace `${answer,,}` checks with a Bash-3-compatible construct, e.g.:
 - `case "$answer" in [yY]) ... ;; *) ... ;; esac`
- Alternatively, add an early version guard (`BASH_VERSINFO`) with a clear error message if Bash < 4 is detected.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


View medium (1)
5. Non-portable grep -P ✓ Resolved 🐞 Bug ⚙ Maintainability
Description
Digest parsing relies on grep -oP with PCRE-specific \K, which is not universally available
(e.g., BSD grep) and can make the script fail in otherwise valid environments. The repo’s existing
bump script avoids this by using sed -E for digest handling.
Code

hack/ubi-bump-prs.sh[R87-89]

+	OLD_DIGEST=$(git show "$UPSTREAM_REMOTE/$BRANCH:Dockerfile" \
+		| grep -oP "ubi-minimal:latest@sha256:\K[0-9a-f]{64}" | head -1)
+
Relevance

●● Moderate

Repo values macOS portability (explicit platform pin), but no prior grep -P/-oP portability
enforcement evidence.

PR-#3037

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
The new script uses grep -oP for digest extraction; the existing bump script uses sed -E
patterns for digest handling, demonstrating a more portable approach already in-repo.

hack/ubi-bump-prs.sh[87-89]
hack/ubi-bump-prs.sh[108-110]
hack/ubi-base-image-bump.sh[33-37]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`hack/ubi-bump-prs.sh` uses `grep -oP ... \K...` to extract digests. This depends on GNU grep PCRE support and is a common portability failure.

### Issue Context
`hack/ubi-base-image-bump.sh` already uses `sed -E` for digest replacement, which is typically more portable.

### Fix Focus Areas
- hack/ubi-bump-prs.sh[87-89]
- hack/ubi-bump-prs.sh[108-110]

### Suggested fix
- Replace the `grep -oP` extraction with a `sed -nE` capture, e.g.:
 - `sed -nE 's/.*ubi-minimal:latest@sha256:([0-9a-f]{64}).*/\1/p' | head -1`
- Add a clear error if extraction returns empty (so failures are actionable).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools



Informational

6. sha256sum not preflighted ✗ Dismissed 🐞 Bug ☼ Reliability ⭐ New
Description
ubi-bump-prs.sh computes the latest digest using sha256sum, but the prerequisites check only
validates skopeo/podman/gh; if sha256sum is missing, the script will fail later with a less
actionable error. This is a portability/diagnostics gap.
Code

hack/ubi-bump-prs.sh[R50-55]

+for cmd in skopeo podman gh; do
+  if ! command -v "$cmd" &>/dev/null; then
+    echo "Error: $cmd is required but not found."
+    exit 1
+  fi
+done
Relevance

●●● Strong

Small diagnostics/portability improvement: add sha256sum to prereq checks; low-risk and consistent
with existing checks.

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
The prereq loop omits sha256sum, but sha256sum is used immediately after to compute the digest; with
errexit/pipefail this will terminate the script if missing.

hack/ubi-bump-prs.sh[50-55]
hack/ubi-bump-prs.sh[72-74]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`hack/ubi-bump-prs.sh` checks for `skopeo`, `podman`, and `gh`, but later invokes `sha256sum`. On systems without `sha256sum`, the script fails after passing the prereq gate.

### Issue Context
The script advertises a prereq gate; it should include all required commands it directly uses for critical steps.

### Fix Focus Areas
- hack/ubi-bump-prs.sh[50-55]
- hack/ubi-bump-prs.sh[72-74]

### Suggested fix
- Add `sha256sum` (and optionally `awk`) to the prereq loop, or
- Provide a fallback (e.g., `shasum -a 256`) when `sha256sum` is unavailable, with a clear error message if neither exists.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


7. Module version regex mismatch ✗ Dismissed 🐞 Bug ≡ Correctness ⭐ New
Description
go-mod-upgrade-prs.sh interpolates the raw module path into an extended-regex sed pattern to
extract versions; module paths typically include . which is a regex wildcard, so version
extraction can be incorrect in some cases and misreport OLD/NEW versions in output/PR body. This
doesn’t change what gets upgraded, but it can generate misleading PR metadata.
Code

hack/go-mod-upgrade-prs.sh[R123-125]

+  OLD_VERSION=$(git show "$UPSTREAM_REMOTE/$BRANCH:go.mod" \
+    | sed -nE "s|.*${PKG} (v[^ ]+).*|\1|p" | head -1)
+  echo "Current version: ${OLD_VERSION:-unknown}"
Relevance

●●● Strong

Deterministic correctness fix: escape PKG before sed regex to avoid misreported versions.

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
The script sets PKG from user input and directly interpolates it into sed -E regex patterns used for
version extraction.

hack/go-mod-upgrade-prs.sh[68-70]
hack/go-mod-upgrade-prs.sh[122-125]
hack/go-mod-upgrade-prs.sh[152-154]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`hack/go-mod-upgrade-prs.sh` uses `sed -E` with an unescaped `$PKG` embedded in the regex to extract module versions from `go.mod`. Because `$PKG` contains regex metacharacters (notably `.`), the match can broaden and extract the wrong line/version.

### Issue Context
This affects only the displayed/recorded OLD_VERSION/NEW_VERSION values (PR body/output), not the actual dependency update performed by `hack/go-mod-upgrade-helper.sh`.

### Fix Focus Areas
- hack/go-mod-upgrade-prs.sh[122-125]
- hack/go-mod-upgrade-prs.sh[152-154]

### Suggested fix
Replace the `sed` extraction with fixed-field parsing, e.g.:
- `OLD_VERSION=$(git show "$UPSTREAM_REMOTE/$BRANCH:go.mod" | awk -v pkg="$PKG" '$1==pkg && $2 ~ /^v/ {print $2; exit}')`
- `NEW_VERSION=$(awk -v pkg="$PKG" '$1==pkg && $2 ~ /^v/ {print $2; exit}' go.mod)`

Alternatively, escape `$PKG` for ERE safely before using it in `sed`.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


Grey Divider

Context sources
✅ Compliance rules (platform): 36 rules

Grey Divider

Tip of the day
💡 Did you know, you can show, collapse, or hide each part of a finding: code, evidence, and all

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

Grey Divider

Previous reviews

Review updated until commit ca0bd45

Results up to commit c48f604 ⚖️ Balanced


🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)


Action required
1. Skip leaves dirty tree ✓ Resolved 🐞 Bug ☼ Reliability
Description
If the user declines PR creation after the bump runs, the script continues without resetting the
working tree, leaving modified files and likely breaking the next branch checkout (and preventing
EXIT cleanup from restoring the original branch). This can stop the multi-branch run mid-way and
leave the repo on a temporary branch with uncommitted changes.
Code

hack/ubi-bump-prs.sh[R105-146]

+	# Run the existing bump script (no commit)
+	hack/ubi-base-image-bump.sh --no-commit
+
+	# Verify the new digest (use whatever the bump script actually wrote)
+	NEW_DIGEST=$(grep -oP "ubi-minimal:latest@sha256:\K[0-9a-f]{64}" Dockerfile | head -1)
+	echo
+	echo "Digest after bump: sha256:${NEW_DIGEST:0:16}..."
+
+	# Generate RPM diff (amd64 — representative for commit/PR info)
+	echo
+	echo "Pulling images for RPM comparison..."
+	OLD_RPMS=$(podman run --rm "${UBI_MINIMAL_REPO}@sha256:$OLD_DIGEST" rpm -qa | sort)
+	NEW_RPMS=$(podman run --rm "${UBI_MINIMAL_REPO}@sha256:$NEW_DIGEST" rpm -qa | sort)
+
+	RPM_DIFF=$(diff \
+		--old-line-format='- %L' \
+		--new-line-format='+ %L' \
+		--unchanged-line-format='' \
+		<(echo "$OLD_RPMS") <(echo "$NEW_RPMS") || true)
+
+	echo
+	if [[ -n "$RPM_DIFF" ]]; then
+		echo "RPM changes:"
+		echo "$RPM_DIFF"
+	else
+		echo "No RPM changes detected."
+	fi
+
+	echo
+	echo "File changes:"
+	git diff --stat
+	echo
+
+	# --- Prompt ---------------------------------------------------------------
+
+	read -rp ">>> Create PR for $BRANCH? [y/N] " answer
+	echo
+	if [[ "${answer,,}" != "y" ]]; then
+		echo "Skipping $BRANCH."
+		echo
+		continue
+	fi
Relevance

●● Moderate

No historical evidence about resetting dirty trees on user skip; only general script cleanup
patterns seen.

PR-#3037

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
The new script runs the bump script before prompting and then continues on non-"y" without any
reset; the bump script demonstrably edits Dockerfiles via sed and runs hack/update-rpm-lock.sh,
so the working tree is left modified unless committed or reset.

hack/ubi-bump-prs.sh[65-67]
hack/ubi-bump-prs.sh[105-146]
hack/ubi-base-image-bump.sh[32-44]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`hack/ubi-bump-prs.sh` runs `hack/ubi-base-image-bump.sh --no-commit` before prompting. If the user answers anything other than `y`, the script `continue`s without cleaning up the modified working tree. That leaves tracked changes in place, which can cause subsequent `git checkout -B ...` to fail (changes would be overwritten) and also makes the EXIT `cleanup()` checkout unreliable (and it currently suppresses failures).

### Issue Context
The bump script edits Dockerfiles and updates `rpms.lock.yaml`, so after the bump step the tree is dirty unless you commit or reset.

### Fix Focus Areas
- hack/ubi-bump-prs.sh[65-67]
- hack/ubi-bump-prs.sh[105-146]

### Suggested fix
- Before each `continue` that skips PR creation (and also before exiting on push/PR-create failures), restore a clean state, e.g.:
 - `git reset --hard` (or `git reset --hard "$UPSTREAM_REMOTE/$BRANCH"`)
 - `git clean -fd` (in case the bump script ever creates files)
- Consider enhancing `cleanup()` to also hard-reset/clean if currently on a work branch, so it can reliably return to `ORIGINAL_BRANCH` even after partial runs.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools



Remediation recommended
2. RPM diff arch not pinned ✓ Resolved 🐞 Bug ≡ Correctness
Description
The script claims the RPM diff is "amd64", but the podman run commands do not specify
--platform, so on non-amd64 hosts the RPM list can differ (or fail) and the commit/PR metadata
becomes inaccurate. This repo already pins linux/amd64 for RPM lock generation to avoid
platform-variant issues.
Code

hack/ubi-bump-prs.sh[R113-118]

+	# Generate RPM diff (amd64 — representative for commit/PR info)
+	echo
+	echo "Pulling images for RPM comparison..."
+	OLD_RPMS=$(podman run --rm "${UBI_MINIMAL_REPO}@sha256:$OLD_DIGEST" rpm -qa | sort)
+	NEW_RPMS=$(podman run --rm "${UBI_MINIMAL_REPO}@sha256:$NEW_DIGEST" rpm -qa | sort)
+
Relevance

●●● Strong

PR #3037 added linux/amd64 pin on podman run/build for consistent results; likely to want same here.

PR-#3037

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
The new script runs podman run without --platform even though it states amd64 intent; a related
repo script explicitly pins linux/amd64, indicating this is important for consistent results.

hack/ubi-bump-prs.sh[113-118]
hack/update-rpm-lock.sh[26-29]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The RPM comparison uses `podman run` without `--platform`, so the RPM lists are host-architecture dependent. The script comment says "amd64" but the implementation does not enforce it.

### Issue Context
`hack/update-rpm-lock.sh` explicitly pins `PLATFORM="linux/amd64"` for compatibility with base images, suggesting cross-arch differences are already a known concern in this repo.

### Fix Focus Areas
- hack/ubi-bump-prs.sh[113-118]

### Suggested fix
- Add a `PLATFORM=linux/amd64` variable (optionally overridable via env) and use it for both runs:
 - `podman run --platform "$PLATFORM" --rm ... rpm -qa`
- Update the comment to match the enforced behavior (or remove "amd64" wording if you intend host-arch diffs).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


3. Bash 4-only lowercase ✓ Resolved 🐞 Bug ☼ Reliability
Description
The script uses ${answer,,} / ${force_answer,,} for case-folding, which requires Bash 4+ and
will fail on older Bash installations. This makes the script unexpectedly non-portable for developer
environments.
Code

hack/ubi-bump-prs.sh[R140-176]

+	read -rp ">>> Create PR for $BRANCH? [y/N] " answer
+	echo
+	if [[ "${answer,,}" != "y" ]]; then
+		echo "Skipping $BRANCH."
+		echo
+		continue
+	fi
+
+	# --- Commit ---------------------------------------------------------------
+
+	COMMIT_MSG="chore(deps): Update ubi-minimal base image
+
+Old digest: sha256:$OLD_DIGEST
+New digest: sha256:$NEW_DIGEST"
+
+	if [[ -n "$RPM_DIFF" ]]; then
+		COMMIT_MSG="$COMMIT_MSG
+
+RPM changes:
+
+$RPM_DIFF"
+	fi
+
+	EXISTING_FILES=()
+	for f in "${DOCKER_FILES[@]}" rpms.lock.yaml; do
+		[[ -f "$f" ]] && EXISTING_FILES+=("$f")
+	done
+	git add "${EXISTING_FILES[@]}"
+	git commit -m "$COMMIT_MSG"
+
+	# --- Push -----------------------------------------------------------------
+
+	if ! git push -u "$PUSH_REMOTE" "$WORK_BRANCH" 2>&1; then
+		echo
+		read -rp ">>> Push failed (branch may already exist). Force push? [y/N] " force_answer
+		if [[ "${force_answer,,}" == "y" ]]; then
+			git push -f -u "$PUSH_REMOTE" "$WORK_BRANCH"
Relevance

●● Moderate

No historical reviews found about avoiding Bash 4-only ${var,,}; portability intent unclear despite
macOS tooling.

PR-#2977
PR-#3037

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
The new script uses ${var,,} for prompt handling in two places, which is a Bash 4+ feature and
thus can cause runtime failure in environments with older Bash.

hack/ubi-bump-prs.sh[140-146]
hack/ubi-bump-prs.sh[172-177]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The script uses Bash 4+ case conversion `${var,,}` when checking prompt responses, which breaks on older Bash versions.

### Issue Context
This script is intended as an attended developer tool, so it should either (a) run on common developer shells or (b) explicitly assert a minimum Bash version.

### Fix Focus Areas
- hack/ubi-bump-prs.sh[140-146]
- hack/ubi-bump-prs.sh[174-177]

### Suggested fix
- Replace `${answer,,}` checks with a Bash-3-compatible construct, e.g.:
 - `case "$answer" in [yY]) ... ;; *) ... ;; esac`
- Alternatively, add an early version guard (`BASH_VERSINFO`) with a clear error message if Bash < 4 is detected.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


4. Non-portable grep -P ✓ Resolved 🐞 Bug ⚙ Maintainability
Description
Digest parsing relies on grep -oP with PCRE-specific \K, which is not universally available
(e.g., BSD grep) and can make the script fail in otherwise valid environments. The repo’s existing
bump script avoids this by using sed -E for digest handling.
Code

hack/ubi-bump-prs.sh[R87-89]

+	OLD_DIGEST=$(git show "$UPSTREAM_REMOTE/$BRANCH:Dockerfile" \
+		| grep -oP "ubi-minimal:latest@sha256:\K[0-9a-f]{64}" | head -1)
+
Relevance

●● Moderate

Repo values macOS portability (explicit platform pin), but no prior grep -P/-oP portability
enforcement evidence.

PR-#3037

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
The new script uses grep -oP for digest extraction; the existing bump script uses sed -E
patterns for digest handling, demonstrating a more portable approach already in-repo.

hack/ubi-bump-prs.sh[87-89]
hack/ubi-bump-prs.sh[108-110]
hack/ubi-base-image-bump.sh[33-37]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`hack/ubi-bump-prs.sh` uses `grep -oP ... \K...` to extract digests. This depends on GNU grep PCRE support and is a common portability failure.

### Issue Context
`hack/ubi-base-image-bump.sh` already uses `sed -E` for digest replacement, which is typically more portable.

### Fix Focus Areas
- hack/ubi-bump-prs.sh[87-89]
- hack/ubi-bump-prs.sh[108-110]

### Suggested fix
- Replace the `grep -oP` extraction with a `sed -nE` capture, e.g.:
 - `sed -nE 's/.*ubi-minimal:latest@sha256:([0-9a-f]{64}).*/\1/p' | head -1`
- Add a clear error if extraction returns empty (so failures are actionable).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


Grey Divider

Qodo Logo

Comment thread hack/ubi-bump-prs.sh Outdated
Comment thread hack/ubi-bump-prs.sh Outdated
Comment thread hack/ubi-bump-prs.sh Outdated
Comment thread hack/ubi-bump-prs.sh Outdated
@fullsend-ai-review

fullsend-ai-review Bot commented Jul 22, 2026

Copy link
Copy Markdown

Review

Findings

Medium

  • [edge-case] hack/go-mod-upgrade-prs.sh:145 — When HELPER_ARGS is empty (the common case where --ignore-tidy-error is not passed), "${HELPER_ARGS[@]}" triggers an "unbound variable" error under set -o nounset on bash versions prior to 4.4. The #!/usr/bin/env bash shebang does not guarantee bash 4.4+, so this will crash the script on systems with older bash (e.g., macOS default bash 3.2). The project targets RHEL 8+ (bash 4.4+), so this is a portability concern rather than a bug on the primary platform.
    Remediation: Use ${HELPER_ARGS[@]+"${HELPER_ARGS[@]}"} or guard with [[ ${#HELPER_ARGS[@]} -gt 0 ]] before appending.

Low

  • [edge-case] hack/go-mod-upgrade-prs.sh:170 — After the helper runs go mod tidy, a package may be removed from a go.mod if it was an indirect-only dependency. The sed extraction for NEW_VERSIONS would produce empty output, resulting in "unknown" in the PR body (e.g., go.mod: v0.1.0 → unknown). The ${VERSION:-unknown} fallback handles this gracefully, but the created PR body may be misleading.

  • [regex-injection] hack/go-mod-upgrade-prs.sh:122$PKG is interpolated directly into a sed regex on lines 122 and 170. Go module paths contain dots (regex metacharacter), so github.com would match githubXcom. Mitigated by attended execution context and the preceding grep -qF exact-match guard on line 121 that ensures only relevant go.mod files are processed.

  • [hardcoded-branch-list] hack/go-mod-upgrade-prs.sh:75 — Default branch list (release-v0.7 release-v0.8 main) is hardcoded in both scripts and must be updated manually when release branches change. Both scripts accept branch arguments to override the defaults, so this is a convenience-default maintenance concern.

  • [extra-blank-lines] hack/ubi-bump-prs.sh:52 — Double blank lines after argument parsing loop (line 52) and after UBI_MINIMAL assignment (line 73). Existing hack/ scripts use single blank lines consistently.

Previous run

Review

Findings

Low

  • [command-injection] hack/go-mod-upgrade-prs.sh:121$PKG is interpolated into sed regex patterns without escaping (also at line 166). Characters like . in Go module paths act as regex wildcards, matching broader patterns than intended. In practice, the preceding grep -qF uses fixed-string matching and Go module paths rarely collide, so the risk is minimal in this attended-script context.
    Remediation: Escape sed metacharacters in PKG before interpolation, or use grep -F for fixed-string matching followed by awk.

  • [overly-broad-staging] hack/ubi-bump-prs.sh:180git add -A stages all changes in the working tree. The existing ubi-base-image-bump.sh explicitly names files to stage. While the clean-tree guard and fresh checkout mitigate risk, using git add -A could inadvertently commit unexpected artifacts from sub-invocations.
    Remediation: Use explicit file paths in git add to match the pattern established by ubi-base-image-bump.sh.

  • [edge-case] hack/go-mod-upgrade-prs.sh:116declare -A OLD_VERSIONS inside the for loop does not clear the associative array between iterations (same for NEW_VERSIONS at line 164). In bash, re-issuing declare -A on an existing associative array is a no-op — previous entries persist. No observable bug currently since MODULE_PATHS is correctly reset each iteration, but a latent issue if access patterns change.
    Remediation: Add unset OLD_VERSIONS; declare -A OLD_VERSIONS before each iteration.

  • [error-handling-idiom] hack/go-mod-upgrade-prs.sh:195git push -u uses 2>&1 redirect but the output is not captured into a variable. The redirect merges stderr into stdout without clear purpose. Same in hack/ubi-bump-prs.sh:185.
    Remediation: Remove 2>&1 so stderr flows to the terminal normally.

Previous run (2)

Review

Findings

High

  • [logic-error] hack/go-mod-upgrade-prs.sh:195 — The PR body construction loop iterates over ${MODULES_WITH_PKG[@]}, but this variable is never defined anywhere in the script. The script defines MODULE_PATHS and OLD_VERSIONS, but not MODULES_WITH_PKG. With set -o nounset active and no :- fallback, bash will abort with an unbound variable error at this line — after the branch has already been pushed but before the PR is created, leaving an orphaned remote branch.
    Remediation: Replace MODULES_WITH_PKG with MODULE_PATHS or a derived array containing version info.

  • [logic-error] hack/go-mod-upgrade-prs.sh:156 — The variable OLD_VERSION (singular) is referenced, but the script only defines OLD_VERSIONS (plural, an associative array). The ${OLD_VERSION:-unknown} fallback prevents a crash, but the "Old version" line shown to the user before the confirmation prompt will always display "unknown", which is misleading.
    Remediation: Display old versions from the OLD_VERSIONS associative array by iterating over MODULE_PATHS.

Medium

  • [code-organization] hack/ubi-bump-prs.sh:179 — Uses git add -A which stages all changes in the entire working tree. The established pattern in this codebase (e.g., ubi-base-image-bump.sh, go-mod-upgrade-helper.sh) is to explicitly name files being staged. In a script that checks out a clean branch and runs a bump helper, git add -A could accidentally stage unintended files.
    Remediation: Replace git add -A with explicit file names matching what ubi-base-image-bump.sh stages.

  • [edge-case] hack/go-mod-upgrade-prs.sh:141 — When HELPER_ARGS is empty (the common case), ${HELPER_ARGS[@]} expansion under set -o nounset may fail on bash versions prior to 4.4. In bash 4.4+, this is safe.

  • [logic-error] hack/ubi-bump-prs.sh:79 — The digest computation method (skopeo inspect --raw | sha256sum) computes the SHA-256 of the manifest JSON. This is consistent with how the existing ubi-base-image-bump.sh helper works, so the comparison is internally valid. Informational.

Low

  • [logic-error] hack/go-mod-upgrade-prs.sh:116declare -A OLD_VERSIONS inside the loop does not clear the associative array on re-declaration at global scope. Stale entries from a prior branch iteration persist, though they are not practically accessible because MODULE_PATHS is correctly reset each iteration.

  • [command-injection] hack/go-mod-upgrade-prs.sh:80 — The PKG variable is interpolated directly into sed regex patterns without escaping metacharacters. Go module paths routinely contain . (regex wildcard) and the | sed delimiter could be broken by crafted input. Low risk for an attended developer script.

  • [scope-coherence] hack/go-mod-upgrade-prs.sh:76 — Both scripts hardcode the default branch list as (release-v0.7 release-v0.8 main). Since both accept branch arguments to override defaults, and the scripts are attended, this is a minor convenience concern rather than a maintenance blocker.

  • [missing-authorization] No linked issue is associated with this PR. Given the tooling-only scope (new hack/ scripts, no production code changes), this is a minor process gap.

  • [naming-consistency] hack/ubi-bump-prs.sh — The naming relationship between wrapper and helper is inconsistent: ubi-base-image-bump.shubi-bump-prs.sh (drops "base-image"), while go-mod-upgrade-helper.shgo-mod-upgrade-prs.sh (consistent).

  • [pattern-inconsistency] hack/go-mod-upgrade-prs.sh:36 — Both scripts use elaborate section separator comments not found in existing hack/ scripts. Cosmetic only.

  • [code-organization] hack/ubi-bump-prs.sh:47 — Double blank line after UBI_MINIMAL assignment; existing scripts use single blank lines.


Next steps:

  • /fs-fix — agent addresses review findings automatically
  • /fs-fix <your instruction> — agent fixes with your specific guidance
  • Push commits directly — review re-runs automatically on push
  • /fs-fix-stop — disable automatic fix runs for this PR
Previous run (3)

Review

Findings

High

  • [logic-error] hack/go-mod-upgrade-prs.sh:119 — The pathspec '**go.mod' passed to git ls-tree -r --name-only matches zero files. git ls-tree does not support glob-style ** in pathspecs — it treats the argument as a literal path prefix. This was independently verified against this repository: the command returns zero results while there are 4 go.mod files (go.mod, acceptance/go.mod, tools/go.mod, tools/kubectl/go.mod). As a result, MODULES_WITH_PKG will always remain empty, and the script will skip every branch with the message <pkg> not found in any go.mod on <branch>, skipping. — silently failing to do any work.
    Remediation: Replace the pathspec-based filtering with a pipe through grep. Change:
    done < <(git ls-tree -r --name-only "$UPSTREAM_REMOTE/$BRANCH" -- '**go.mod')
    to:
    done < <(git ls-tree -r --name-only "$UPSTREAM_REMOTE/$BRANCH" | grep 'go\.mod$')

Low

  • [overly-broad-staging] hack/ubi-bump-prs.sh:157 — The script uses git add -A which stages all changes in the working tree, not just the files modified by the UBI bump helper. If any sensitive or unintended files exist in the working directory (e.g., .env, credentials, debug artifacts), they will be committed and pushed. The delegated helper script hack/ubi-base-image-bump.sh uses a more targeted git add listing specific files (${DOCKER_FILES[@]} rpms.lock.yaml).
    Remediation: Replace git add -A with an explicit list of files that the UBI bump is expected to modify, mirroring the helper script's approach.

  • [regex-injection] hack/go-mod-upgrade-prs.sh:119 — The variable $PKG (a Go module path like github.com/sigstore/fulcio) is interpolated directly into sed extended regex patterns. Dots in the module path are treated as regex wildcards rather than literal characters. Practical risk is negligible given go.mod formatting constraints, but the pattern is technically imprecise.

  • [scope-coherence] hack/go-mod-upgrade-prs.sh:82 — The default branch list is hardcoded as (release-v0.7 release-v0.8 main) in both scripts independently. This creates a minor maintenance burden when release branches are added or retired, though the attended nature of the scripts (CLI args can override defaults) mitigates the impact.


Next steps:

  • /fs-fix — agent addresses review findings automatically
  • /fs-fix <your instruction> — agent fixes with your specific guidance
  • Push commits directly — review re-runs automatically on push
  • /fs-fix-stop — disable automatic fix runs for this PR
Previous run (4)

Review

Findings

Low

  • [regex-correctness] hack/go-mod-upgrade-prs.sh:124 — The sed regex uses ${PKG} unescaped, so dots in Go module paths (e.g., github.com) are treated as regex wildcards matching any character. While unlikely to cause a false match in practice, it is inconsistent with the grep -qF fixed-string check on the preceding line and could theoretically extract a version from a similarly-named module.
    Remediation: Escape dots in $PKG before interpolating into the sed pattern, e.g., PKG_RE=$(printf '%s' "$PKG" | sed 's/[.]/\\./g').

  • [overly-broad-staging] hack/ubi-bump-prs.sh:185git add -A stages all changes in the working tree, not just the files modified by ubi-base-image-bump.sh. The underlying helper explicitly stages named files (Dockerfile, Dockerfile.dist, acceptance/kubernetes/kind/acceptance.Dockerfile, rpms.lock.yaml). The wrapper should match that specificity to avoid accidentally committing unrelated files.
    Remediation: Replace git add -A with explicit file paths, e.g., git add Dockerfile Dockerfile.dist acceptance/kubernetes/kind/acceptance.Dockerfile rpms.lock.yaml.

  • [edge-case] hack/go-mod-upgrade-prs.sh:135 — When HELPER_ARGS is empty (the common case when --ignore-tidy-error is not passed), "${HELPER_ARGS[@]}" would cause an unbound variable error under set -o nounset on bash < 4.4. Modern bash handles this correctly, and this pattern is already used in the existing go-mod-upgrade-helper.sh.

  • [design-smell] hack/ubi-bump-prs.sh:40 — Both scripts hardcode the default branch list (release-v0.7 release-v0.8 main). The scripts accept branch arguments as overrides, but the hardcoded defaults will need updating when release branches are cut or retired.

  • [structural-duplication] hack/go-mod-upgrade-prs.sh — The two scripts share ~60–70% structural similarity (prerequisite checks, fetch, push retry, summary). Acceptable for two scripts but worth noting if more multi-branch orchestrators are planned.

Previous run (5)

Review

Findings

Medium

  • [scope-mismatch] hack/go-mod-upgrade-prs.sh — The PR title is "Add attended script for multi-branch UBI bump PRs" but the change also adds hack/go-mod-upgrade-prs.sh (231 lines), a second script for creating go module upgrade PRs across branches. The PR body's Summary section only describes ubi-bump-prs.sh. The go-mod-upgrade-prs.sh script is not mentioned in the title or the body, making it easy for reviewers to overlook half the change.
    Remediation: Update the PR title and description to cover both scripts, or split into two PRs.

Low

  • [edge-case] hack/go-mod-upgrade-prs.sh:121 — The sed pattern used to extract OLD_VERSION and NEW_VERSION interpolates $PKG directly into a regex without escaping. Go module paths like github.com/sigstore/fulcio contain dots that are regex wildcards. In practice the risk of a false match in go.mod is negligible since module paths are real domain names, but it is a latent correctness issue. The same pattern is used for NEW_VERSION.
    Remediation: Escape regex metacharacters in $PKG before using it in the sed expression.

  • [staging-idiom] hack/ubi-bump-prs.sh:170 — Uses git add -A to stage all changes before committing. Other scripts in hack/ that commit changes explicitly name the files being staged (e.g., ubi-base-image-bump.sh stages specific Dockerfiles and rpms.lock.yaml). The clean-tree prerequisite check at script start mitigates the risk, but aligning with repo conventions is worthwhile.
    Remediation: Replace git add -A with the known file list from ubi-base-image-bump.sh: git add Dockerfile Dockerfile.dist acceptance/kubernetes/kind/acceptance.Dockerfile rpms.lock.yaml.

  • [edge-case] hack/ubi-bump-prs.sh:78LATEST_DIGEST is computed as sha256sum of the raw manifest from skopeo inspect --raw. This is consistent with how ubi-base-image-bump.sh computes digests today, but creates a fragile coupling — if either script changes its digest computation method, the up-to-date comparison could break silently.

  • [edge-case] hack/go-mod-upgrade-prs.sh:140 — When HELPER_ARGS is empty, ${HELPER_ARGS[@]} can fail with "unbound variable" on Bash < 4.4 under set -o nounset. Note: the existing go-mod-upgrade-helper.sh uses the same pattern, so this is consistent with the codebase.
    Remediation: Use ${HELPER_ARGS[@]+"${HELPER_ARGS[@]}"} for safe expansion on older Bash versions.

Previous run (6)

Review

Findings

Medium

  • [scope-creep] hack/go-mod-upgrade-prs.sh — The PR title and body exclusively describe hack/ubi-bump-prs.sh, but the PR also adds an entirely separate 231-line script hack/go-mod-upgrade-prs.sh for creating Go module upgrade PRs. This second script is not mentioned in the PR title, body, or summary. It wraps a different helper (hack/go-mod-upgrade-helper.sh), serves a different purpose, and could be reviewed and landed independently.
    Remediation: Either (a) split hack/go-mod-upgrade-prs.sh into its own PR with its own description, or (b) update the PR title and body to explicitly cover both scripts so reviewers are aware of the full scope.

  • [error-handling] hack/ubi-bump-prs.sh:109 — The call to hack/ubi-base-image-bump.sh --no-commit is not guarded against failure. With set -o errexit, if the helper fails (e.g., skopeo inspect timeout, network error), the entire multi-branch loop terminates immediately rather than skipping the current branch and continuing to the next one. By contrast, go-mod-upgrade-prs.sh correctly guards its helper call with if ! hack/go-mod-upgrade-helper.sh ...; then ... continue; fi.
    Remediation: Wrap the call in an if ! guard: if ! hack/ubi-base-image-bump.sh --no-commit; then echo "ubi-base-image-bump.sh failed for $BRANCH, skipping."; git reset --hard "$UPSTREAM_REMOTE/$BRANCH"; echo; continue; fi

Low

  • [code-organization] hack/ubi-bump-prs.sh:48 — The DOCKER_FILES array is duplicated verbatim from hack/ubi-base-image-bump.sh. Since ubi-bump-prs.sh already delegates to ubi-base-image-bump.sh for the actual bump, maintaining the list in both places is fragile.
    Remediation: After the bump script runs, detect changed files with git diff --name-only rather than maintaining a hardcoded list, or source the array from a shared location.

Next steps:

  • /fs-fix — agent addresses review findings automatically
  • /fs-fix <your instruction> — agent fixes with your specific guidance
  • Push commits directly — review re-runs automatically on push
  • /fs-fix-stop — disable automatic fix runs for this PR
Previous run (7)

Review

Findings

Medium

  • [error-handling] hack/ubi-bump-prs.sh:120 — When the post-bump digest extraction fails, the script continues to the next branch without resetting the working tree. The hack/ubi-base-image-bump.sh --no-commit call has already modified tracked files (Dockerfiles, rpms.lock.yaml). On the next loop iteration, git checkout -B to a different upstream branch base will fail due to the dirty working tree (which, under set -o errexit, exits the entire script). Compare with the user-decline path at line 157 which correctly does git reset --hard, and go-mod-upgrade-prs.sh which handles the analogous case correctly.
    Remediation: Add git reset --hard "$UPSTREAM_REMOTE/$BRANCH" before the continue on line 120.

Low

  • [scope-mismatch] hack/go-mod-upgrade-prs.sh — The PR title and body describe only hack/ubi-bump-prs.sh, but the PR also adds hack/go-mod-upgrade-prs.sh (227 lines) for Go module upgrade automation. Consider updating the PR description to cover both scripts or splitting into separate PRs.

  • [indentation] hack/go-mod-upgrade-prs.sh — Uses tab indentation throughout, whereas all existing hack/ scripts use 2-space indentation.
    Remediation: Convert tabs to 2-space indentation.

  • [indentation] hack/ubi-bump-prs.sh — Same tab-vs-spaces inconsistency with the rest of hack/.
    Remediation: Convert tabs to 2-space indentation.

  • [regex-correctness] hack/go-mod-upgrade-prs.sh:97$PKG is interpolated into sed regex without escaping metacharacters. Dots in Go module paths (e.g., github.com) match any character in regex. While false positives in go.mod are unlikely and no shell injection is possible, this is technically incorrect. Same pattern at lines 119 and 148.
    Remediation: Escape regex metacharacters in $PKG or use grep -F with awk.

  • [edge-case] hack/go-mod-upgrade-prs.sh:131HELPER_ARGS as an empty array triggers an unbound variable error under set -o nounset in Bash < 4.4.
    Remediation: Use ${HELPER_ARGS[@]+"${HELPER_ARGS[@]}"} or conditionally append.

  • [edge-case] hack/go-mod-upgrade-prs.sh:44--jira without a value argument causes an opaque unbound variable error instead of a clear usage message.
    Remediation: Guard with [[ $# -lt 2 ]] or use ${2:?"--jira requires a value"}.


Next steps:

  • /fs-fix — agent addresses review findings automatically
  • /fs-fix <your instruction> — agent fixes with your specific guidance
  • Push commits directly — review re-runs automatically on push
  • /fs-fix-stop — disable automatic fix runs for this PR
Previous run (8)

Review

Findings

Medium

  • [edge-case] hack/ubi-bump-prs.sh:106 — When NEW_DIGEST extraction fails after the bump script has already modified files (line 100: hack/ubi-base-image-bump.sh --no-commit), the continue on line 106 skips to the next branch iteration without cleaning up the dirty working tree. The next iteration’s git checkout -B will fail because git refuses to overwrite uncommitted modifications. With set -o errexit, this kills the script, and the cleanup trap’s git checkout may also fail for the same reason, leaving the repository in a dirty state on the wrong branch.
    Remediation: Add git reset --hard "$UPSTREAM_REMOTE/$BRANCH" before the continue on line 106, matching the reset done on the user-skip path (line 137).

  • [indentation] hack/ubi-bump-prs.sh:37 — The script uses hard tab indentation throughout, while all other hack/ shell scripts consistently use 2-space indentation (verified against ubi-base-image-bump.sh, cut-release.sh, go-mod-upgrade-helper.sh, derive-version.sh, add-auto-tag.sh, bump-tekton-bundles.sh, and update-rpm-lock.sh).
    Remediation: Convert tab indentation to 2-space indentation: expand -t 2 hack/ubi-bump-prs.sh > tmp && mv tmp hack/ubi-bump-prs.sh

Low

  • [edge-case] hack/ubi-bump-prs.sh:73LATEST_DIGEST is computed once at setup via skopeo inspect --raw | sha256sum, but the inner hack/ubi-base-image-bump.sh runs its own independent skopeo inspect. If the :latest tag moves between calls, the initial printout may differ from the actual digest written. Cosmetic only — commit messages and PR bodies correctly use NEW_DIGEST extracted from the Dockerfile after the bump.

  • [maintenance] hack/ubi-bump-prs.sh:48 — The DOCKER_FILES array duplicates the identical array in hack/ubi-base-image-bump.sh (line 33). If the inner script’s list changes, the outer script’s git add (lines 149–152) would miss newly-modified Dockerfiles, resulting in partial commits. Consider using git add -u to add all modified tracked files, or sourcing the list from a shared location.

  • [command-injection] hack/ubi-bump-prs.sh:37 — Branch names from command-line arguments flow into git show, git checkout -B, git push, and gh pr create --base commands. Mitigated by proper quoting of $BRANCH in all uses and git’s own naming constraints; further reduced by the attended, interactive nature of the script.

  • [command-injection] hack/ubi-bump-prs.sh:113 — Containers run via podman run --rm without explicit security hardening flags (--security-opt, --cap-drop, etc.). Digest values are regex-constrained to [0-9a-f]{64}, preventing injection through the digest string. Matches the existing hack/update-rpm-lock.sh pattern.

Previous run (9)

Review

Findings

Medium

  • [error handling] hack/ubi-bump-prs.sh:87 — The pipeline git show "$UPSTREAM_REMOTE/$BRANCH:Dockerfile" | grep -oP ... | head -1 will exit non-zero (and terminate the entire script due to set -o errexit + set -o pipefail) if the branch does not exist, the Dockerfile is missing on that branch, or the Dockerfile does not contain the expected ubi-minimal:latest@sha256: pattern. Since the script accepts arbitrary branch names as arguments, a typo or a branch that has diverged in Dockerfile format kills the whole script and aborts processing of any remaining branches.
    Remediation: Wrap the OLD_DIGEST extraction in a guard that catches failures and skips the branch, e.g.:
    if ! OLD_DIGEST=$(git show "$UPSTREAM_REMOTE/$BRANCH:Dockerfile" \
        | grep -oP "ubi-minimal:latest@sha256:\K[0-9a-f]{64}" | head -1) || [[ -z "$OLD_DIGEST" ]]; then
        echo "Could not extract current digest for $BRANCH, skipping."
        echo
        continue
    fi

Low

  • [edge case] hack/ubi-bump-prs.sh:100 — The NEW_DIGEST extraction (grep -oP ... Dockerfile | head -1) reads from the local Dockerfile after hack/ubi-base-image-bump.sh --no-commit runs. If the inner script succeeds but the Dockerfile format has changed such that the grep pattern doesn't match, grep returns exit 1 and the script terminates without a clear message. Practically unlikely since both scripts use the same pattern, but the coupling is implicit.

  • [race condition] hack/ubi-bump-prs.sh:73LATEST_DIGEST is computed once at setup via skopeo inspect, then hack/ubi-base-image-bump.sh independently calls skopeo inspect again for each branch. If the upstream image is republished between calls, the staleness check at line 91 may skip a branch that could have been bumped. Unlikely in practice given UBI image update frequency, and the attended nature of the script means the operator would catch it on the next run.


Labels: PR adds developer automation tooling in hack/ for UBI base image management

fullsend-ai-review[bot]

This comment was marked as outdated.

@fullsend-ai-review fullsend-ai-review Bot added requires-manual-review Review requires human judgment tooling labels Jul 22, 2026
@codecov

codecov Bot commented Jul 22, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag Coverage Δ
acceptance 54.38% <ø> (ø)
generative 12.28% <ø> (ø)
integration 23.59% <ø> (ø)
unit 72.20% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@simonbaird
simonbaird force-pushed the ubi-bump-automation branch from c48f604 to a3090fb Compare July 23, 2026 13:26
@github-actions github-actions Bot added size: XL and removed size: L labels Jul 23, 2026
@fullsend-ai-review

fullsend-ai-review Bot commented Jul 23, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 1:27 PM UTC · Completed 1:44 PM UTC
Commit: 87c4a29 · View workflow run →

@simonbaird
simonbaird enabled auto-merge July 23, 2026 13:29
fullsend-ai-review[bot]

This comment was marked as outdated.

@simonbaird

Copy link
Copy Markdown
Member Author

Moving to draft while I look at the fullsend comments.

@simonbaird
simonbaird marked this pull request as draft July 31, 2026 21:29
auto-merge was automatically disabled July 31, 2026 21:29

Pull request was converted to draft

@simonbaird
simonbaird force-pushed the ubi-bump-automation branch from a3090fb to af44b7c Compare August 4, 2026 17:17
@fullsend-ai-review

fullsend-ai-review Bot commented Aug 4, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 5:19 PM UTC · Completed 5:35 PM UTC
Commit: 87c4a29 · View workflow run →

fullsend-ai-review[bot]

This comment was marked as outdated.

@fullsend-ai-review fullsend-ai-review Bot removed the requires-manual-review Review requires human judgment label Aug 4, 2026
@simonbaird
simonbaird force-pushed the ubi-bump-automation branch from af44b7c to 0d74c14 Compare August 4, 2026 20:48
@fullsend-ai-review

fullsend-ai-review Bot commented Aug 4, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 8:49 PM UTC · Completed 9:06 PM UTC
Commit: 87c4a29 · View workflow run →

fullsend-ai-review[bot]

This comment was marked as outdated.

@simonbaird
simonbaird force-pushed the ubi-bump-automation branch from 0d74c14 to 09fa222 Compare August 6, 2026 13:09
@fullsend-ai-review fullsend-ai-review Bot removed the ready-for-merge All reviewers approved — ready to merge label Aug 17, 2026
@simonbaird
simonbaird force-pushed the ubi-bump-automation branch from 747be31 to 99d515b Compare August 17, 2026 15:08
@fullsend-ai-review

fullsend-ai-review Bot commented Aug 17, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 7:40 PM UTC · Completed 7:58 PM UTC

Commit: 87c4a29 · View workflow run →

fullsend-ai-review[bot]

This comment was marked as outdated.

@simonbaird
simonbaird force-pushed the ubi-bump-automation branch from 99d515b to 10c895b Compare August 17, 2026 20:16
@fullsend-ai-review

fullsend-ai-review Bot commented Aug 17, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 8:17 PM UTC · Completed 8:34 PM UTC

Commit: 87c4a29 · View workflow run →

@fullsend-ai-review
fullsend-ai-review Bot dismissed stale reviews from themself August 17, 2026 20:34

Superseded by updated review

fullsend-ai-review[bot]

This comment was marked as outdated.

@fullsend-ai-review fullsend-ai-review Bot added the ready-for-merge All reviewers approved — ready to merge label Aug 17, 2026

@st3penta st3penta left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks good, just one minor suggestion

Comment thread hack/ubi-bump-prs.sh Outdated
st3penta
st3penta previously approved these changes Aug 18, 2026
@fullsend-ai-review

Copy link
Copy Markdown

🤖 Review · ⚠️ Cancelled · Ended 6:23 PM UTC

Commit: 87c4a29 · View workflow run →

@fullsend-ai-review

fullsend-ai-review Bot commented Aug 18, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 6:24 PM UTC · Completed 6:42 PM UTC

Commit: 87c4a29 · View workflow run →

@fullsend-ai-review fullsend-ai-review Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See the review comment for full details.

Comment thread hack/go-mod-upgrade-prs.sh
Comment thread hack/go-mod-upgrade-prs.sh
Comment thread hack/go-mod-upgrade-prs.sh
Comment thread hack/go-mod-upgrade-prs.sh
Comment thread hack/ubi-bump-prs.sh
@fullsend-ai-review fullsend-ai-review Bot added requires-manual-review Review requires human judgment and removed ready-for-merge All reviewers approved — ready to merge labels Aug 18, 2026
@simonbaird

Copy link
Copy Markdown
Member Author

/retest

Wraps existing scripts hack/ubi-base-image-bump.sh and
hack/go-mod-upgrade-helper.sh to automate creating PRs for all
active branches.

For the ubi bump, we look inside the old and new base images to
compare rpm versions, and include that in the commit.

The goal is to make it easier and faster to upgrade ubi base images
and golang deps across all active branches, usually in response to a
CVE scan notification.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@simonbaird
simonbaird force-pushed the ubi-bump-automation branch from e071a15 to ca0bd45 Compare August 18, 2026 20:02
@simonbaird
simonbaird enabled auto-merge August 18, 2026 20:30

@st3penta st3penta left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Couldn't be more polished than this 😆

@simonbaird
simonbaird merged commit a94dbb6 into conforma:main Aug 19, 2026
23 checks passed
@fullsend-ai-retro

fullsend-ai-retro Bot commented Aug 19, 2026

Copy link
Copy Markdown

🤖 Finished Retro · ✅ Success · Started 8:39 AM UTC · Completed 8:59 AM UTC

Commit: 87c4a29 · View workflow run →

@fullsend-ai-retro

Copy link
Copy Markdown

Retro: PR #3430 — Add attended scripts for multi-branch UBI bump and module update PRs

Overall assessment: The fullsend review agent provided substantial value on this PR, catching 3 high-severity runtime-breaking bugs that no other agent or human reviewer found. However, the dominant negative pattern was persistent repetition of 4–5 low-severity findings across 8–10 review rounds despite explicit author rejection, causing visible review fatigue.

Timeline

  1. Jul 22 — PR created by simonbaird (human-authored, ubi-bump-automation branch). Two new shell scripts in hack/ (541 lines added). First agent reviews from coderabbitai, qodo, and fullsend.
  2. Jul 22–Aug 6 — Author fixes ~15 substantive issues across 3 rounds. PR moved to draft Jul 31.
  3. Aug 14 — Major rework of go-mod-upgrade-prs.sh for multi-module support (prompted by coderabbitai finding).
  4. Aug 17 — fullsend review catches 3 critical bugs: broken git ls-tree pathspec (**go.mod not supported), undefined MODULES_WITH_PKG variable, and OLD_VERSION/OLD_VERSIONS name mismatch. Human reviewer st3penta identifies that git fetch before --force-with-lease defeats the lease mechanism.
  5. Aug 18–19 — Final fixes, st3penta approves, PR merged after 28 days.

What went well

  • High-value unique finds: fullsend caught 3 bugs (git ls-tree pathspec, undefined variable, variable name mismatch) that would have caused complete script failure. No other agent found these.
  • Multi-agent collaboration: The three review agents (fullsend, coderabbit, qodo) independently confirmed the dirty-tree-on-skip bug, building confidence.
  • ~20+ substantive fixes made by the author based on agent feedback.

What could go better

  • Repeated rejected findings (core issue): The same 4–5 low-severity findings were raised in nearly every review round despite explicit author rejection: Bash <4.4 compatibility (8 rounds), regex dot escaping (10 rounds), git add -A breadth (9 rounds), hardcoded branch lists (9 rounds). Author frustration escalated from "Not gonna support decade old bash" to "Please stop suggesting" to "Please chill out."
  • Severity inflation: The Bash <4.4 finding was escalated from Low to Medium in later rounds, going against the author's repeated rationale that RHEL 8+ guarantees Bash 4.4+.
  • Missing context calibration: The review agent applied production-code robustness standards to hack/ directory developer utility scripts. The author repeatedly explained these are "low effort/low impact toil reduction scripts" but the agent didn't adjust.
  • Human caught what agents missed: st3penta identified that git fetch before --force-with-lease defeats the lease — a subtle git semantics issue no AI agent caught, despite the review agent having flagged the broader force-push topic.

Evidence for existing open issues

Proposals

1 proposal filed (see below). The core repeated-findings problem is well-covered by existing agent-layer issues; the repo-level signal gap is not.

Proposals filed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

requires-manual-review Review requires human judgment size: XL tooling

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants