You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Built-in TechDocs updated if needed. Note that TechDocs changes may need to be reviewed by a Product Manager and/or Architect to ensure content accuracy, clarity, and alignment with user needs.
How to test changes / Special notes to the reviewer
Here are some key observations to aid the review process:
⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪
🔒 Security concerns
Supply chain integrity: The workflow downloads a docker-compose binary via curl from GitHub releases and executes it without checksum/signature verification. Consider verifying a published SHA256 (or using a package-managed install) to reduce risk of tampering/MITM or compromised release artifacts.
The job name expression appears to include a nested GitHub expression (${{ matrix.os }}) inside another ${{ ... }} block, which is not supported. This may cause the workflow to fail to parse or render the job name incorrectly; consider concatenating matrix.os within the same expression (e.g., via format() or direct string concatenation) instead of nesting expressions.
The workflow matrix introduces ubuntu-24.04-arm as an OS dimension, but the broader codebase convention for ARM64 appears to be aarch64. Verify that the chosen runner label is intentional and that downstream tooling/scripts (if any) that key off architecture naming won’t mis-detect or skip ARM-specific behavior. (Ref 1)
Reference reasoning: Existing YAML configuration enumerates supported architectures as x86_64 and aarch64, indicating a consistent convention for referring to ARM64. Aligning CI runner/arch naming with that convention (or explicitly mapping between them) helps avoid mismatches where other configs expect aarch64 but CI exposes arm-style identifiers.
Why: This suggestion correctly identifies and fixes a critical bug in the job name expression where nested interpolation (${{...}}) would fail, ensuring the job name is rendered correctly.
High
General
Use runner context for architecture
Replace the shell command uname -m with the GitHub Actions runner.arch context variable to determine the system architecture for the download URL.
Why: The suggestion offers a more robust, platform-agnostic way to determine the architecture using runner.arch, improving maintainability, although the current uname -m implementation is correct and functional.
Here are some key observations to aid the review process:
⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪
🔒 Security concerns
Supply chain risk: The workflow downloads docker-compose directly from GitHub Releases via curl and installs it without checksum/signature verification, then executes it. Consider validating the downloaded artifact (e.g., SHA256) to mitigate tampering/MITM risks.
The matrix now targets ubuntu-24.04-arm; validate that this runner label is available in the target GitHub environment and that the job’s dependencies (notably Docker installation via apt) work reliably on ARM runners. In particular, confirm Docker CE packages are available for the runner’s architecture and that the installation steps don’t assume x86_64-specific behavior.
The workflow downloads a prebuilt docker-compose binary via curl and executes it; consider adding integrity verification (checksum/signature) to reduce supply-chain risk, especially now that the architecture is dynamic via uname -m.
# Install standalone docker-compose for consistent version across docker/podman testsecho "Installing docker-compose $DOCKER_COMPOSE_VERSION..."sudo curl -fsSL "https://github.com/docker/compose/releases/download/${DOCKER_COMPOSE_VERSION}/docker-compose-linux-$(uname -m)" \-o /usr/local/bin/docker-composesudo chmod +x /usr/local/bin/docker-compose# Also install as Docker CLI pluginsudo mkdir -p /usr/local/lib/docker/cli-pluginssudo ln -sf /usr/local/bin/docker-compose /usr/local/lib/docker/cli-plugins/docker-compose
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Which issue(s) does this PR fix or relate to
Relates to RHDHBUGS-2747
PR acceptance criteria
How to test changes / Special notes to the reviewer