Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (4)
✅ Files skipped from review due to trivial changes (4)
📝 WalkthroughWalkthroughUpdated Go toolchain from 1.25.3 to 1.25.5 across modules, refreshed numerous dependency versions in module files, updated Docker build-stage base images, and added Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ❌ 3❌ Failed checks (2 warnings, 1 inconclusive)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 golangci-lint (2.11.4)Error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Review Summary by QodoUpdate buildkit to v0.28.1 and bump Go dependencies
WalkthroughsDescription• Update Go version from 1.25.3 to 1.25.5 • Upgrade buildkit from v0.26.3 to v0.28.1 • Update multiple indirect dependencies for security and compatibility • Bump AWS SDK, containerd, Docker, and other core dependencies Diagramflowchart LR
A["Go 1.25.3"] -->|upgrade| B["Go 1.25.5"]
C["buildkit v0.26.3"] -->|upgrade| D["buildkit v0.28.1"]
E["Multiple dependencies"] -->|update| F["Latest compatible versions"]
D --> G["Updated go.mod"]
F --> G
G --> H["Updated go.sum"]
File Changes1. go.mod
|
Code Review by QodoLooking for bugs?Check back in a few minutes. An AI review agent is analyzing this pull request.
|
|
Thanks for the PR! I'm not sure how important it is, but we usually try and keep the golang version the same across all |
| module github.com/conforma/cli | ||
|
|
||
| go 1.25.3 | ||
| go 1.25.5 |
There was a problem hiding this comment.
When we update golang we have to also update the builder base image in two dockerfiles.
There was a problem hiding this comment.
Actually I can push a commit on top of this to do that.
Also update go version in all go.mod files so it's consistently 1.25.5.
Oh I did this also. 👍 |
|
You should be able to reproduce the test failure locally with this: Something to do with |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@benchmark/offliner/offliner.go`:
- Line 1: The build constraint `//go:build benchmark` at the top of
benchmark/offliner/*.go (e.g., offliner.go) causes all package files to be
excluded when `go run .` is invoked without tags; update either the source or
the Makefile: either remove or conditionally guard the `//go:build benchmark`
line from the Go files so they build normally, or modify the Makefile benchmark
target to invoke `go run -tags=benchmark .` (or add `-tags=benchmark` to `go
build`/`go test` invocations) so the files are included; change the approach
consistently across the package (files like offliner.go, base_images.go,
refs.go) to ensure the package is not empty at build time.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 75a805fe-92a8-4cf5-b870-7afdf5a00686
📒 Files selected for processing (14)
benchmark/internal/registry/registry.gobenchmark/internal/suite/closer.gobenchmark/internal/suite/suite.gobenchmark/internal/untar/untar.gobenchmark/offliner/base_images.gobenchmark/offliner/nab.gobenchmark/offliner/offliner.gobenchmark/offliner/offliner_test.gobenchmark/offliner/referrers.gobenchmark/offliner/refs.gobenchmark/offliner/related.gobenchmark/offliner/scans.gobenchmark/offliner/subjects.gobenchmark/simple/simple.go
✅ Files skipped from review due to trivial changes (11)
- benchmark/offliner/base_images.go
- benchmark/internal/suite/closer.go
- benchmark/offliner/subjects.go
- benchmark/offliner/scans.go
- benchmark/internal/suite/suite.go
- benchmark/offliner/related.go
- benchmark/offliner/referrers.go
- benchmark/offliner/nab.go
- benchmark/internal/registry/registry.go
- benchmark/offliner/refs.go
- benchmark/internal/untar/untar.go
| @@ -1,3 +1,5 @@ | |||
| //go:build benchmark | |||
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "1) Confirm benchmark build tags on offliner sources:"
rg -n '^//go:build benchmark' benchmark/offliner/offliner.go benchmark/offliner/offliner_test.go
echo
echo "2) Confirm benchmark run target does/doesn't pass tags:"
rg -n -C3 'benchmark_%|go run \.|-tags=benchmark' MakefileRepository: conforma/cli
Length of output: 1772
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "1) Checking for build tags in benchmark/offliner files:"
if fd offliner.go benchmark/offliner/ 2>/dev/null; then
fd offliner.go benchmark/offliner/ | head -5 | while read -r f; do
echo "File: $f"
head -1 "$f"
done
fi
echo
echo "2) Checking Makefile for benchmark target:"
if [ -f Makefile ]; then
grep -n -A5 'benchmark_%' Makefile || echo "Pattern not found"
fiRepository: conforma/cli
Length of output: 457
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Files in benchmark/offliner/:"
ls -la benchmark/offliner/ 2>/dev/null || echo "Directory listing failed"
echo
echo "Checking for other offliner files with build tags:"
find benchmark/offliner/ -name "*.go" -type f -exec head -1 {} + 2>/dev/null | head -20Repository: conforma/cli
Length of output: 1278
Benchmark target breaks—all Go files are excluded by the build constraint
Line 1 adds //go:build benchmark, but ALL nine Go files in benchmark/offliner/ (base_images.go, nab.go, offliner.go, offliner_test.go, referrers.go, refs.go, related.go, scans.go, subjects.go) have this constraint. The Makefile benchmark target runs go run . without -tags=benchmark (line 170), which excludes every buildable file and causes the build to fail with no source files.
Proposed fix (Makefile)
.PHONY: benchmark_%
benchmark_%: benchmark/%/data.tar.gz
`@cd` benchmark/$*
- `@go` run .
+ `@go` run -tags=benchmark .🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@benchmark/offliner/offliner.go` at line 1, The build constraint `//go:build
benchmark` at the top of benchmark/offliner/*.go (e.g., offliner.go) causes all
package files to be excluded when `go run .` is invoked without tags; update
either the source or the Makefile: either remove or conditionally guard the
`//go:build benchmark` line from the Go files so they build normally, or modify
the Makefile benchmark target to invoke `go run -tags=benchmark .` (or add
`-tags=benchmark` to `go build`/`go test` invocations) so the files are
included; change the approach consistently across the package (files like
offliner.go, base_images.go, refs.go) to ensure the package is not empty at
build time.
3 participants
https://redhat.atlassian.net/issues?jql=project%20in%20(%22Trusted%20Artifact%20Signer%22)%0Aand%20issuetype%20%3D%20Vulnerability%0Aand%20status%20not%20in%20(Closed%2C%20%22Release%20Pending%22)%0Aand%20affectedVersion%20%3D%201.3.0%0AORDER%20BY%20due%20DESC&selectedIssue=SECURESIGN-4078