Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
6 changes: 3 additions & 3 deletions .ci-operator.yaml
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
build_root_image:
name: release
namespace: openshift
tag: rhel-9-release-golang-1.25-openshift-4.22
name: openshift-build
namespace: jasee
tag: rhel-9-golang-1.25
2 changes: 1 addition & 1 deletion Dockerfile.ocp
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.25-openshift-4.22 AS builder
FROM quay.io/jacobsee/openshift-build:rhel-9-golang-1.25 AS builder
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify the official OpenShift builder image exists

echo "=== Checking official OpenShift builder images ==="
echo "Personal registry found: quay.io/jacobsee/openshift-build:rhel-9-golang-1.25"
echo "Expected official registry: registry.ci.openshift.org/ocp/builder:*"
echo ""
echo "This appears to be testing infrastructure that should be reverted to official images."

Repository: openshift/api

Length of output: 339


🏁 Script executed:

# Check if Dockerfile.ocp exists and examine its history
git ls-files | grep -i dockerfile

Repository: openshift/api

Length of output: 799


🏁 Script executed:

# Look for the .ci-operator.yaml file
find . -name ".ci-operator.yaml" -o -name "ci-operator.yaml" 2>/dev/null | head -20

Repository: openshift/api

Length of output: 76


🏁 Script executed:

# Search for references to this dockerfile or quay.io/jacobsee
rg -i "jacobsee|quay\.io.*openshift-build" --type yaml --type txt

Repository: openshift/api

Length of output: 39


🏁 Script executed:

cat -n Dockerfile.ocp

Repository: openshift/api

Length of output: 1147


🏁 Script executed:

cat -n .ci-operator.yaml

Repository: openshift/api

Length of output: 171


🏁 Script executed:

# Check git history of Dockerfile.ocp
git log --oneline Dockerfile.ocp | head -20

Repository: openshift/api

Length of output: 88


🏁 Script executed:

# Get full git history with more details
git log --all --pretty=format:"%H %s" -- Dockerfile.ocp | head -20

Repository: openshift/api

Length of output: 1704


🏁 Script executed:

# Check the actual changes in recent commits
git show HEAD:Dockerfile.ocp 2>/dev/null || echo "File not in HEAD"

Repository: openshift/api

Length of output: 986


🏁 Script executed:

# Check git status - is this file modified locally?
git status Dockerfile.ocp

Repository: openshift/api

Length of output: 122


🏁 Script executed:

# Look for any recent changes to Dockerfile.ocp
git diff HEAD~5..HEAD -- Dockerfile.ocp 2>/dev/null || echo "Cannot show diff"

Repository: openshift/api

Length of output: 73


🏁 Script executed:

# Show the specific commit that mentions "update builder images"
git show c63fe74a:Dockerfile.ocp 2>/dev/null | head -20

Repository: openshift/api

Length of output: 916


🏁 Script executed:

# Show the commit message and details
git show --stat c63fe74a

Repository: openshift/api

Length of output: 346


🏁 Script executed:

# Check what was in the version before the personal registry was introduced
git show c63fe74a~1:Dockerfile.ocp 2>/dev/null | head -20

Repository: openshift/api

Length of output: 916


Base image uses personal Quay.io registry instead of official OpenShift registry.

The builder base image has been changed from the official OpenShift registry (registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.24-openshift-4.22) to a personal Quay.io repository (quay.io/jacobsee/openshift-build:rhel-9-golang-1.25). This introduces critical risks:

  1. Supply chain security: Personal registries bypass OpenShift's image scanning, signing, and security controls
  2. Build reproducibility: Downstream consumers cannot reliably build if the personal image is unavailable
  3. Production compliance: Using unofficial base images violates container security best practices

Revert the builder stage to use the official OpenShift registry before merging.

🧰 Tools
🪛 Trivy (0.69.3)

[error] 1-1: Image user should not be 'root'

Specify at least 1 USER command in Dockerfile with non-root user as argument

Rule: DS-0002

Learn more

(IaC/Dockerfile)

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@Dockerfile.ocp` at line 1, The Dockerfile's builder stage uses a personal
Quay image (the FROM line with "AS builder") which must be reverted to the
official OpenShift builder image; replace the current base image reference with
the official OpenShift registry image (e.g.,
registry.ci.openshift.org/ocp/builder:<appropriate-tag>) so the FROM line in the
builder stage uses the trusted official registry and tag that matches your
OpenShift/Golang version and CI policy.

WORKDIR /go/src/github.com/openshift/api
COPY . .
ENV GO_PACKAGE github.com/openshift/api
Expand Down
26 changes: 13 additions & 13 deletions go.mod
Original file line number Diff line number Diff line change
@@ -1,14 +1,14 @@
module github.com/openshift/api

go 1.25.0
go 1.26.0

require (
github.com/blang/semver/v4 v4.0.0
golang.org/x/tools v0.38.0
k8s.io/api v0.35.1
k8s.io/apimachinery v0.35.1
k8s.io/klog/v2 v2.130.1
k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912
golang.org/x/tools v0.40.0
k8s.io/api v0.36.0-rc.1
k8s.io/apimachinery v0.36.0-rc.1
k8s.io/klog/v2 v2.140.0
k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a
sigs.k8s.io/yaml v1.6.0
)

Expand All @@ -31,17 +31,17 @@ require (
github.com/x448/float16 v0.8.4 // indirect
go.yaml.in/yaml/v2 v2.4.3 // indirect
go.yaml.in/yaml/v3 v3.0.4 // indirect
golang.org/x/mod v0.29.0 // indirect
golang.org/x/net v0.47.0 // indirect
golang.org/x/sync v0.18.0 // indirect
golang.org/x/text v0.31.0 // indirect
google.golang.org/protobuf v1.36.8 // indirect
golang.org/x/mod v0.31.0 // indirect
golang.org/x/net v0.49.0 // indirect
golang.org/x/sync v0.19.0 // indirect
golang.org/x/text v0.33.0 // indirect
google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 // indirect
k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 // indirect
sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
sigs.k8s.io/randfill v1.0.0 // indirect
sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
sigs.k8s.io/structured-merge-diff/v6 v6.3.2 // indirect
)

// v3.9.0 is the only tag in openshift/api and it was created before go.mod was
Expand Down
51 changes: 26 additions & 25 deletions go.sum
Original file line number Diff line number Diff line change
Expand Up @@ -43,8 +43,9 @@ github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJ
github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=
github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
github.com/spf13/pflag v1.0.9 h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY=
Expand All @@ -64,18 +65,18 @@ go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
golang.org/x/mod v0.29.0 h1:HV8lRxZC4l2cr3Zq1LvtOsi/ThTgWnUk/y64QSs8GwA=
golang.org/x/mod v0.29.0/go.mod h1:NyhrlYXJ2H4eJiRy/WDBO6HMqZQ6q9nk4JzS3NuCK+w=
golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
golang.org/x/sync v0.18.0 h1:kr88TuHDroi+UVf+0hZnirlk8o8T+4MrK6mr60WkH/I=
golang.org/x/sync v0.18.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM=
golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM=
golang.org/x/tools v0.38.0 h1:Hx2Xv8hISq8Lm16jvBZ2VQf+RLmbd7wVUsALibYI/IQ=
golang.org/x/tools v0.38.0/go.mod h1:yEsQ/d/YK8cjh0L6rZlY8tgtlKiBNTL14pGDJPJpYQs=
google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc=
google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
golang.org/x/mod v0.31.0 h1:HaW9xtz0+kOcWKwli0ZXy79Ix+UW/vOfmWI5QVd2tgI=
golang.org/x/mod v0.31.0/go.mod h1:43JraMp9cGx1Rx3AqioxrbrhNsLl2l/iNAvuBkrezpg=
golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o=
golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8=
golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
golang.org/x/text v0.33.0 h1:B3njUFyqtHDUI5jMn1YIr5B0IE2U0qck04r6d4KPAxE=
golang.org/x/text v0.33.0/go.mod h1:LuMebE6+rBincTi9+xWTY8TztLzKHc/9C1uBCG27+q8=
golang.org/x/tools v0.40.0 h1:yLkxfA+Qnul4cs9QA3KnlFu0lVmd8JJfoq+E41uSutA=
golang.org/x/tools v0.40.0/go.mod h1:Ik/tzLRlbscWpqqMRjyWYDisX8bG13FrdXp3o4Sr9lc=
google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI=
google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
Expand All @@ -84,21 +85,21 @@ gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
k8s.io/api v0.35.1 h1:0PO/1FhlK/EQNVK5+txc4FuhQibV25VLSdLMmGpDE/Q=
k8s.io/api v0.35.1/go.mod h1:28uR9xlXWml9eT0uaGo6y71xK86JBELShLy4wR1XtxM=
k8s.io/apimachinery v0.35.1 h1:yxO6gV555P1YV0SANtnTjXYfiivaTPvCTKX6w6qdDsU=
k8s.io/apimachinery v0.35.1/go.mod h1:jQCgFZFR1F4Ik7hvr2g84RTJSZegBc8yHgFWKn//hns=
k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 h1:Y3gxNAuB0OBLImH611+UDZcmKS3g6CthxToOb37KgwE=
k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912/go.mod h1:kdmbQkyfwUagLfXIad1y2TdrjPFWp2Q89B3qkRwf/pQ=
k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 h1:SjGebBtkBqHFOli+05xYbK8YF1Dzkbzn+gDM4X9T4Ck=
k8s.io/utils v0.0.0-20251002143259-bc988d571ff4/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
k8s.io/api v0.36.0-rc.1 h1:7H6fB1NagVdP1jO4jmxHH1vNoe/54lZjtpauZiyh+MI=
k8s.io/api v0.36.0-rc.1/go.mod h1:HdQ7vctyvpI9V52/FtSr3IX1R+bwYw6eVed1sO6XRU4=
k8s.io/apimachinery v0.36.0-rc.1 h1:GUn8AMC/iXu64a2wauTV2pPwfkg96ozmhpV7zachuTU=
k8s.io/apimachinery v0.36.0-rc.1/go.mod h1:fx0hoLoUO0gmSXPkZA4iPtk/dTM2TGbu7OIv8TU6258=
k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc=
k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0=
k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a h1:xCeOEAOoGYl2jnJoHkC3hkbPJgdATINPMAxaynU2Ovg=
k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a/go.mod h1:uGBT7iTA6c6MvqUvSXIaYZo9ukscABYi2btjhvgKGZ0=
k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 h1:AZYQSJemyQB5eRxqcPky+/7EdBj0xi3g0ZcxxJ7vbWU=
k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
sigs.k8s.io/structured-merge-diff/v6 v6.3.0 h1:jTijUJbW353oVOd9oTlifJqOGEkUw2jB/fXCbTiQEco=
sigs.k8s.io/structured-merge-diff/v6 v6.3.0/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
sigs.k8s.io/structured-merge-diff/v6 v6.3.2 h1:kwVWMx5yS1CrnFWA/2QHyRVJ8jM6dBA80uLmm0wJkk8=
sigs.k8s.io/structured-merge-diff/v6 v6.3.2/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=
6 changes: 0 additions & 6 deletions install.go
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,6 @@ import (
kauthorizationv1beta1 "k8s.io/api/authorization/v1beta1"
kautoscalingv1 "k8s.io/api/autoscaling/v1"
kautoscalingv2 "k8s.io/api/autoscaling/v2"
kautoscalingv2beta1 "k8s.io/api/autoscaling/v2beta1"
kautoscalingv2beta2 "k8s.io/api/autoscaling/v2beta2"
kbatchv1 "k8s.io/api/batch/v1"
kbatchv1beta1 "k8s.io/api/batch/v1beta1"
kcertificatesv1 "k8s.io/api/certificates/v1"
Expand All @@ -40,7 +38,6 @@ import (
krbacv1alpha1 "k8s.io/api/rbac/v1alpha1"
krbacv1beta1 "k8s.io/api/rbac/v1beta1"
kschedulingv1 "k8s.io/api/scheduling/v1"
kschedulingv1alpha1 "k8s.io/api/scheduling/v1alpha1"
kschedulingv1beta1 "k8s.io/api/scheduling/v1beta1"
kstoragev1 "k8s.io/api/storage/v1"
kstoragev1alpha1 "k8s.io/api/storage/v1alpha1"
Expand Down Expand Up @@ -134,8 +131,6 @@ var (
kauthorizationv1beta1.AddToScheme,
kautoscalingv1.AddToScheme,
kautoscalingv2.AddToScheme,
kautoscalingv2beta1.AddToScheme,
kautoscalingv2beta2.AddToScheme,
kbatchv1.AddToScheme,
kbatchv1beta1.AddToScheme,
kcertificatesv1.AddToScheme,
Expand All @@ -160,7 +155,6 @@ var (
krbacv1beta1.AddToScheme,
krbacv1alpha1.AddToScheme,
kschedulingv1.AddToScheme,
kschedulingv1alpha1.AddToScheme,
kschedulingv1beta1.AddToScheme,
kstoragev1.AddToScheme,
kstoragev1beta1.AddToScheme,
Expand Down
Loading