Skip to content

TELCOV10N-923 - add eco gotests step#77999

Draft
rdiscala wants to merge 1 commit intoopenshift:mainfrom
rdiscala:TELCOV10N-923-add-eco-gotests-step
Draft

TELCOV10N-923 - add eco gotests step#77999
rdiscala wants to merge 1 commit intoopenshift:mainfrom
rdiscala:TELCOV10N-923-add-eco-gotests-step

Conversation

@rdiscala
Copy link
Copy Markdown
Contributor

@rdiscala rdiscala commented Apr 18, 2026

Add telcov10n-functional-cnf-ran-eco-gotests-sno-worker step to the
cnf-ran-sno-day2-worker-4.20 job. The step runs eco-gotests against
the spoke cluster's day-2 worker node after ZTP provisioning.

The step:
- Builds Ansible inventory from its own credential mounts
- Extracts the spoke kubeconfig from the hub cluster
- Waits for the worker node to reach Ready state (30m timeout)
- Generates and runs eco-gotests per feature via Ansible and SSH
- Mirrors eco-gotests images to the disconnected registry
- Collects JUnit and Polarion XMLreports as CI artifacts
- Uses a failure flag so all features run even if one fails

Summary by CodeRabbit

  • Chores
    • Added new eco-gotests testing step for CNF-RAN SNO worker configurations
    • Integrated support for GitOps ZTP deployment types testing
    • Enhanced CI pipeline with disconnected registry configuration
    • Established new test step registry with defined ownership and approval controls for eco-gotests workflow

@openshift-ci openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Apr 18, 2026
@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci Bot commented Apr 18, 2026

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci Bot commented Apr 18, 2026

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: rdiscala

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 18, 2026
@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai Bot commented Apr 18, 2026

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: ab37cb49-712e-464c-8121-40d98cf3ae02

📥 Commits

Reviewing files that changed from the base of the PR and between f1edd70 and dcd810a.

📒 Files selected for processing (6)
  • ci-operator/config/openshift-kni/eco-ci-cd/openshift-kni-eco-ci-cd-main__cnf-ran-sno-day2-worker-4.20.yaml
  • ci-operator/step-registry/telcov10n/functional/cnf-ran/cnf-tests-sno-worker/telcov10n-functional-cnf-ran-cnf-tests-sno-worker-ref.metadata.json
  • ci-operator/step-registry/telcov10n/functional/cnf-ran/eco-gotests-sno-worker/OWNERS
  • ci-operator/step-registry/telcov10n/functional/cnf-ran/eco-gotests-sno-worker/telcov10n-functional-cnf-ran-eco-gotests-sno-worker-commands.sh
  • ci-operator/step-registry/telcov10n/functional/cnf-ran/eco-gotests-sno-worker/telcov10n-functional-cnf-ran-eco-gotests-sno-worker-ref.metadata.json
  • ci-operator/step-registry/telcov10n/functional/cnf-ran/eco-gotests-sno-worker/telcov10n-functional-cnf-ran-eco-gotests-sno-worker-ref.yaml
✅ Files skipped from review due to trivial changes (2)
  • ci-operator/step-registry/telcov10n/functional/cnf-ran/eco-gotests-sno-worker/OWNERS
  • ci-operator/step-registry/telcov10n/functional/cnf-ran/eco-gotests-sno-worker/telcov10n-functional-cnf-ran-eco-gotests-sno-worker-ref.metadata.json
🚧 Files skipped from review as they are similar to previous changes (2)
  • ci-operator/step-registry/telcov10n/functional/cnf-ran/cnf-tests-sno-worker/telcov10n-functional-cnf-ran-cnf-tests-sno-worker-ref.metadata.json
  • ci-operator/step-registry/telcov10n/functional/cnf-ran/eco-gotests-sno-worker/telcov10n-functional-cnf-ran-eco-gotests-sno-worker-ref.yaml

Walkthrough

A new CI test step telcov10n-functional-cnf-ran-eco-gotests-sno-worker is being added to automate eco-gotests execution for CNF-RAN SNO worker configurations. The step orchestrates inventory setup, bastion SSH connectivity, spoke cluster validation, ansible playbook execution, and test artifact collection. An existing CI pipeline configuration is updated to include this new step reference.

Changes

Cohort / File(s) Summary
Main Pipeline Configuration
ci-operator/config/openshift-kni/eco-ci-cd/openshift-kni-eco-ci-cd-main__cnf-ran-sno-day2-worker-4.20.yaml
Updated cnf-ran-ztp-tests step to add new pre-ref telcov10n-functional-cnf-ran-eco-gotests-sno-worker and set environment variables: ECO_GOTESTS_FEATURES=gitopsztp deploymenttypes, HUB_CLUSTER=kni-qe-106, MIRROR_REGISTRY=disconnected.registry.local:5000.
eco-gotests-sno-worker Step Registry
ci-operator/step-registry/telcov10n/functional/cnf-ran/eco-gotests-sno-worker/*
Added complete step registry for eco-gotests: metadata JSON, YAML reference with container config/env vars/secret mounts, shell script implementing inventory processing, bastion SSH connectivity, kubeconfig retrieval, ansible playbook orchestration, and remote test artifact collection, plus OWNERS approvers list.
cnf-tests-sno-worker Step Registry
ci-operator/step-registry/telcov10n/functional/cnf-ran/cnf-tests-sno-worker/telcov10n-functional-cnf-ran-cnf-tests-sno-worker-ref.metadata.json
Added metadata JSON file defining path reference and approvers ownership for cnf-tests-sno-worker step.

Sequence Diagram(s)

sequenceDiagram
    participant CI as CI System
    participant Script as eco-gotests Script
    participant Inv as Inventory<br/>Processing
    participant SSH as SSH/Bastion
    participant Ans as Ansible<br/>Playbook
    participant Spoke as Spoke<br/>Cluster
    participant Report as Artifact<br/>Collection

    CI->>Script: Execute eco-gotests-sno-worker step
    Script->>Inv: Process inventory directories<br/>(common, hub, spoke)
    Inv->>Inv: Filter & normalize<br/>SPOKE_CLUSTER, HUB_CLUSTER
    Script->>SSH: Extract bastion IP/user<br/>from inventory
    Script->>SSH: Establish SSH connection<br/>with private key
    SSH->>SSH: Create remote temp<br/>working directory
    Script->>SSH: Fetch spoke kubeconfig<br/>secret from hub
    SSH->>Spoke: Retrieve & decode<br/>kubeconfig
    Script->>Spoke: Wait for worker nodes<br/>to reach Ready (30m)
    Script->>Ans: For each feature in<br/>ECO_GOTESTS_FEATURES
    Ans->>Spoke: Run deploy-run-eco-gotests<br/>playbook with config
    Script->>SSH: Execute eco-gotests-run.sh<br/>on bastion
    SSH->>SSH: Run tests remotely
    Script->>Report: Collect report/*.xml<br/>files via scp
    Report->>CI: Copy formatted artifacts<br/>to SHARED_DIR
    Script->>CI: Exit with status
Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

🚥 Pre-merge checks | ✅ 11 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (11 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and specifically summarizes the main change: adding a new eco-gotests step to the CI pipeline.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed This pull request does not contain any Ginkgo test files or test definitions. The PR adds CI/CD configuration files (YAML and JSON metadata), an OWNERS file, and a Bash shell script for orchestrating eco-gotests execution in a CI pipeline. None of these file types contain Ginkgo test syntax (It(), Describe(), Context(), When(), etc.). Since no Ginkgo tests are present in the changes, there are no test names to evaluate for stability and determinism.
Test Structure And Quality ✅ Passed This PR contains CI infrastructure configuration files only, with no Ginkgo test code present.
Microshift Test Compatibility ✅ Passed No new Ginkgo test definitions found. PR only adds CI infrastructure (YAML, shell scripts) without introducing new Go test files.
Single Node Openshift (Sno) Test Compatibility ✅ Passed This PR does not add any new Ginkgo e2e tests. The changes consist entirely of CI/CD infrastructure files including bash scripts, YAML configurations, and JSON metadata for a new step that runs existing tests against SNO worker nodes.
Topology-Aware Scheduling Compatibility ✅ Passed This PR adds CI operator configuration files and testing scripts, not deployment manifests or operator code with pod scheduling constraints.
Ote Binary Stdout Contract ✅ Passed OTE Binary Stdout Contract check is not applicable; PR contains only CI infrastructure files (YAML, JSON, shell scripts) with no Go binaries or OTE test code.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed This PR contains only CI/CD infrastructure changes (YAML, JSON, OWNERS, bash scripts) with no Ginkgo e2e tests or Go test files.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@rdiscala rdiscala force-pushed the TELCOV10N-923-add-eco-gotests-step branch from f1edd70 to 694581e Compare April 18, 2026 09:22
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 5

🧹 Nitpick comments (1)
ci-operator/config/openshift-kni/eco-ci-cd/openshift-kni-eco-ci-cd-main__cnf-ran-sno-day2-worker-4.20.yaml (1)

27-61: Wire the CNF worker step or remove the inert env override.

Line 27 configures CNF_TESTS_FEATURES, and this PR adds telcov10n-functional-cnf-ran-cnf-tests-sno-worker, but Line 61 only wires the eco-gotests ref. If CNF tests are expected in this workflow, the CNF step will not run; otherwise this env override is dead config.

Possible wiring if CNF tests should run here
     - ref: telcov10n-functional-cnf-ran-mirror-spoke-operators
     - ref: telcov10n-functional-cnf-ran-deploy-spoke-sno
     - ref: telcov10n-functional-cnf-ran-deploy-spoke-sno-day2-worker
+    - ref: telcov10n-functional-cnf-ran-cnf-tests-sno-worker
     - ref: telcov10n-functional-cnf-ran-eco-gotests-sno-worker
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In
`@ci-operator/config/openshift-kni/eco-ci-cd/openshift-kni-eco-ci-cd-main__cnf-ran-sno-day2-worker-4.20.yaml`
around lines 27 - 61, The CNF_TESTS_FEATURES env var is set but the CNF job is
not wired into the pre steps; either add the CNF test ref
telcov10n-functional-cnf-ran-cnf-tests-sno-worker to the pre list (alongside the
existing telcov10n-functional-cnf-ran-eco-gotests-sno-worker) so the
CNF_TESTS_FEATURES flag actually triggers the CNF job, or remove the
CNF_TESTS_FEATURES line entirely to avoid a dead override; update the pre array
(refs) or the env block accordingly to keep CNF_TESTS_FEATURES and the workflow
in sync.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In
`@ci-operator/step-registry/telcov10n/functional/cnf-ran/cnf-tests-sno-worker/telcov10n-functional-cnf-ran-cnf-tests-sno-worker-commands.sh`:
- Around line 161-165: The ansible-playbook invocation passes
features=${CNF_TESTS_FEATURES} as a single key=value string which will split a
space-separated CNF_TESTS_FEATURES into separate args; instead write a temporary
extra-vars YAML (containing features: "<value>" plus kubeconfig and cnf_test_dir
keys) and pass it with --extra-vars `@/tmp/whatever.yaml` to the ansible-playbook
call (update the command around deploy-run-cnf-tests-script.yaml and the
features/CNF_TESTS_FEATURES usage); ensure the temp file is created safely
(e.g., mktemp), populated with the three vars (features, kubeconfig using
SPOKE_KUBECONFIG, cnf_test_dir using CNF_TEST_DIR), and removed after the
playbook finishes.
- Around line 229-233: The script currently prepends /usr/local/go/bin but not
the directory where go install writes binaries, so ensure the installed ginkgo
is picked up by exporting the Go install bin directory into PATH (use the output
of go env GOBIN if set, otherwise $(go env GOPATH)/bin) before invoking
cnf-tests-run.sh; update the export PATH line around the existing export
PATH="/usr/local/go/bin:$PATH" and/or immediately after the go install
github.com/onsi/ginkgo/v2/ginkgo step so that the script uses the newly
installed ginkgo binary when cnf-tests-run.sh runs.

In
`@ci-operator/step-registry/telcov10n/functional/cnf-ran/eco-gotests-sno-worker/telcov10n-functional-cnf-ran-eco-gotests-sno-worker-commands.sh`:
- Around line 117-119: The temp SSH key is created with default umask then
tightened, leaving a brief window of world-readable permissions; update the
creation to write the file atomically with restrictive permissions—either set a
temporary umask 077 around the write to "${WORKDIR}/temp_ssh_key" or replace the
redirection with an atomic tool that sets mode 600 (e.g., install -m 600 or
equivalent) when writing from
/var/group_variables/common/all/ansible_ssh_private_key so the file is never
created with broader permissions.
- Around line 138-143: The SSH-run remote extraction can hide failures because
the pipeline "oc ... | base64 -d" runs without pipefail; change the ssh
invocation that uses "${SSH_OPTS[@]}", "${BASTION_USER}@${BASTION_IP}" and the
remote "oc ... | base64 -d > '${SPOKE_KUBECONFIG}'" so the remote shell runs
with pipefail (e.g. wrap the remote command in bash -o pipefail -c '...') or
otherwise enable set -o pipefail before running oc, ensuring ssh returns
non-zero if oc fails and the local script (set -e) will abort immediately with
the original error instead of creating an empty ${SPOKE_KUBECONFIG}.
- Around line 36-42: The single-quote replacement in the branch that echoes a
single-quoted YAML scalar currently strips single quotes because
`${content//\'/''}` uses an empty replacement; update the parameter expansion
used when constructing the single-quoted scalar so each single-quote in
`content` is replaced by two single-quote characters (i.e., the single-quote is
doubled) instead of removed, and keep the surrounding single quotes around the
substituted value when echoing `${varname}` into `${dest_file}`.

---

Nitpick comments:
In
`@ci-operator/config/openshift-kni/eco-ci-cd/openshift-kni-eco-ci-cd-main__cnf-ran-sno-day2-worker-4.20.yaml`:
- Around line 27-61: The CNF_TESTS_FEATURES env var is set but the CNF job is
not wired into the pre steps; either add the CNF test ref
telcov10n-functional-cnf-ran-cnf-tests-sno-worker to the pre list (alongside the
existing telcov10n-functional-cnf-ran-eco-gotests-sno-worker) so the
CNF_TESTS_FEATURES flag actually triggers the CNF job, or remove the
CNF_TESTS_FEATURES line entirely to avoid a dead override; update the pre array
(refs) or the env block accordingly to keep CNF_TESTS_FEATURES and the workflow
in sync.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 42be6aa0-826c-43cd-b3e8-d175d4059036

📥 Commits

Reviewing files that changed from the base of the PR and between 3ecf6ba and f1edd70.

📒 Files selected for processing (9)
  • ci-operator/config/openshift-kni/eco-ci-cd/openshift-kni-eco-ci-cd-main__cnf-ran-sno-day2-worker-4.20.yaml
  • ci-operator/step-registry/telcov10n/functional/cnf-ran/cnf-tests-sno-worker/OWNERS
  • ci-operator/step-registry/telcov10n/functional/cnf-ran/cnf-tests-sno-worker/telcov10n-functional-cnf-ran-cnf-tests-sno-worker-commands.sh
  • ci-operator/step-registry/telcov10n/functional/cnf-ran/cnf-tests-sno-worker/telcov10n-functional-cnf-ran-cnf-tests-sno-worker-ref.metadata.json
  • ci-operator/step-registry/telcov10n/functional/cnf-ran/cnf-tests-sno-worker/telcov10n-functional-cnf-ran-cnf-tests-sno-worker-ref.yaml
  • ci-operator/step-registry/telcov10n/functional/cnf-ran/eco-gotests-sno-worker/OWNERS
  • ci-operator/step-registry/telcov10n/functional/cnf-ran/eco-gotests-sno-worker/telcov10n-functional-cnf-ran-eco-gotests-sno-worker-commands.sh
  • ci-operator/step-registry/telcov10n/functional/cnf-ran/eco-gotests-sno-worker/telcov10n-functional-cnf-ran-eco-gotests-sno-worker-ref.metadata.json
  • ci-operator/step-registry/telcov10n/functional/cnf-ran/eco-gotests-sno-worker/telcov10n-functional-cnf-ran-eco-gotests-sno-worker-ref.yaml

Comment on lines +161 to +165
echo "Run ansible playbook to generate CNF test scripts"
ansible-playbook ./playbooks/cnf/deploy-run-cnf-tests-script.yaml \
-i ./inventories/cnf/switch-config.yaml \
--extra-vars "kubeconfig=${SPOKE_KUBECONFIG} features=${CNF_TESTS_FEATURES} cnf_test_dir=${CNF_TEST_DIR}" \
-vv
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

# First, locate and examine the script file
fd -t f "telcov10n-functional-cnf-ran-cnf-tests-sno-worker-commands.sh"

Repository: openshift/release

Length of output: 198


🏁 Script executed:

# Search for CNF_TESTS_FEATURES definition and usage
rg "CNF_TESTS_FEATURES" -A 2 -B 2

Repository: openshift/release

Length of output: 3408


🏁 Script executed:

# Look for documentation or README files that might document CNF_TESTS_FEATURES
fd -t f "README|readme" | head -20

Repository: openshift/release

Length of output: 823


🏁 Script executed:

# Search for the Ansible playbook mentioned
fd -t f "deploy-run-cnf-tests-script.yaml"

Repository: openshift/release

Length of output: 43


🏁 Script executed:

cat -n ci-operator/step-registry/telcov10n/functional/cnf-ran/cnf-tests-sno-worker/telcov10n-functional-cnf-ran-cnf-tests-sno-worker-commands.sh | sed -n '155,175p'

Repository: openshift/release

Length of output: 993


🏁 Script executed:

# Get the full ref.yaml to understand CNF_TESTS_FEATURES documentation
cat ci-operator/step-registry/telcov10n/functional/cnf-ran/cnf-tests-sno-worker/telcov10n-functional-cnf-ran-cnf-tests-sno-worker-ref.yaml

Repository: openshift/release

Length of output: 1874


🌐 Web query:

Ansible --extra-vars key-value string space-separated values parsing behavior

💡 Result:

Ansible's --extra-vars (or -e) option parses space-separated key-value strings using a custom shell-like splitter that respects quotes and escapes, preventing premature splitting on spaces within quoted values. Key parsing behavior: - The extra-vars argument string is first split into individual arguments using ansible.parsing.splitter.split_args, which splits on whitespace but intelligently handles quotes (single ', double "), backslashes, and Jinja2 blocks. - Each split argument is then processed by parse_kv: if it contains '=', it's split into key and value; the value is unquoted (ansible.parsing.quoting.unquote) and stored as a string. - Spaces within unquoted values cause splitting into separate arguments (treated as additional key= or free params). - Properly quoted values preserve internal spaces: e.g., -e 'key="value with spaces"' or -e "key='value with spaces'" sets key to the full string "value with spaces". - Multiple vars: -e "key1=val1 key2=val2" (whole quoted) or separate -e flags. - Shell processes outer quotes first, so nest appropriately (outer single for shell vars, inner double for Ansible). Examples: - ansible-playbook playbook.yml -e 'SSH_KEY="ssh-rsa AAA... comment"' # Preserves full public key with spaces - Without quotes: -e SSH_KEY=ssh-rsa AAA... # SSH_KEY="ssh-rsa", "AAA..." as separate var (fails) All key=value values are strings by default. Use JSON for non-strings: -e '{"list":["a b","c"]}'. This behavior is consistent across recent Ansible versions (2.10+ to latest), as seen in splitter.py source.

Citations:


Fix Ansible extra-vars parsing for space-separated feature list.

Line 164 passes features=${CNF_TESTS_FEATURES} through Ansible's key-value string format. Since CNF_TESTS_FEATURES is documented as a space-separated list, multi-value features will be misparsed (e.g., "reboot power-management" becomes separate arguments). Use an extra-vars YAML file instead to preserve the full value.

Safer extra-vars file approach
 echo "Run ansible playbook to generate CNF test scripts"
+CNF_EXTRA_VARS_FILE="${WORKDIR}/cnf-extra-vars.yml"
+cat > "${CNF_EXTRA_VARS_FILE}" <<EOF
+kubeconfig: "${SPOKE_KUBECONFIG}"
+features: "${CNF_TESTS_FEATURES}"
+cnf_test_dir: "${CNF_TEST_DIR}"
+EOF
+
 ansible-playbook ./playbooks/cnf/deploy-run-cnf-tests-script.yaml \
   -i ./inventories/cnf/switch-config.yaml \
-  --extra-vars "kubeconfig=${SPOKE_KUBECONFIG} features=${CNF_TESTS_FEATURES} cnf_test_dir=${CNF_TEST_DIR}" \
+  --extra-vars "@${CNF_EXTRA_VARS_FILE}" \
   -vv
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
echo "Run ansible playbook to generate CNF test scripts"
ansible-playbook ./playbooks/cnf/deploy-run-cnf-tests-script.yaml \
-i ./inventories/cnf/switch-config.yaml \
--extra-vars "kubeconfig=${SPOKE_KUBECONFIG} features=${CNF_TESTS_FEATURES} cnf_test_dir=${CNF_TEST_DIR}" \
-vv
echo "Run ansible playbook to generate CNF test scripts"
CNF_EXTRA_VARS_FILE="${WORKDIR}/cnf-extra-vars.yml"
cat > "${CNF_EXTRA_VARS_FILE}" <<EOF
kubeconfig: "${SPOKE_KUBECONFIG}"
features: "${CNF_TESTS_FEATURES}"
cnf_test_dir: "${CNF_TEST_DIR}"
EOF
ansible-playbook ./playbooks/cnf/deploy-run-cnf-tests-script.yaml \
-i ./inventories/cnf/switch-config.yaml \
--extra-vars "@${CNF_EXTRA_VARS_FILE}" \
-vv
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In
`@ci-operator/step-registry/telcov10n/functional/cnf-ran/cnf-tests-sno-worker/telcov10n-functional-cnf-ran-cnf-tests-sno-worker-commands.sh`
around lines 161 - 165, The ansible-playbook invocation passes
features=${CNF_TESTS_FEATURES} as a single key=value string which will split a
space-separated CNF_TESTS_FEATURES into separate args; instead write a temporary
extra-vars YAML (containing features: "<value>" plus kubeconfig and cnf_test_dir
keys) and pass it with --extra-vars `@/tmp/whatever.yaml` to the ansible-playbook
call (update the command around deploy-run-cnf-tests-script.yaml and the
features/CNF_TESTS_FEATURES usage); ensure the temp file is created safely
(e.g., mktemp), populated with the three vars (features, kubeconfig using
SPOKE_KUBECONFIG, cnf_test_dir using CNF_TEST_DIR), and removed after the
playbook finishes.

Comment on lines +229 to +233
export PATH="/usr/local/go/bin:$PATH"
cd "${CNF_TEST_DIR}/cnf-features-deploy"

go install -mod=vendor github.com/onsi/ginkgo/v2/ginkgo

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Add Go’s install bin directory to PATH before running CNF tests.

Line 232 installs ginkgo, but go install writes binaries to GOBIN or GOPATH/bin; Line 229 only prepends /usr/local/go/bin. If cnf-tests-run.sh invokes ginkgo, it may use a stale binary or fail to find it.

Ensure the installed Ginkgo binary is used
 CNF_TEST_DIR="$1"
 export PATH="/usr/local/go/bin:$PATH"
+GO_BIN_DIR="$(go env GOBIN)"
+if [[ -z "${GO_BIN_DIR}" ]]; then
+  GO_BIN_DIR="$(go env GOPATH)/bin"
+fi
+export PATH="${GO_BIN_DIR}:${PATH}"
 cd "${CNF_TEST_DIR}/cnf-features-deploy"
 
 go install -mod=vendor github.com/onsi/ginkgo/v2/ginkgo
+hash -r
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
export PATH="/usr/local/go/bin:$PATH"
cd "${CNF_TEST_DIR}/cnf-features-deploy"
go install -mod=vendor github.com/onsi/ginkgo/v2/ginkgo
export PATH="/usr/local/go/bin:$PATH"
GO_BIN_DIR="$(go env GOBIN)"
if [[ -z "${GO_BIN_DIR}" ]]; then
GO_BIN_DIR="$(go env GOPATH)/bin"
fi
export PATH="${GO_BIN_DIR}:${PATH}"
cd "${CNF_TEST_DIR}/cnf-features-deploy"
go install -mod=vendor github.com/onsi/ginkgo/v2/ginkgo
hash -r
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In
`@ci-operator/step-registry/telcov10n/functional/cnf-ran/cnf-tests-sno-worker/telcov10n-functional-cnf-ran-cnf-tests-sno-worker-commands.sh`
around lines 229 - 233, The script currently prepends /usr/local/go/bin but not
the directory where go install writes binaries, so ensure the installed ginkgo
is picked up by exporting the Go install bin directory into PATH (use the output
of go env GOBIN if set, otherwise $(go env GOPATH)/bin) before invoking
cnf-tests-run.sh; update the export PATH line around the existing export
PATH="/usr/local/go/bin:$PATH" and/or immediately after the go install
github.com/onsi/ginkgo/v2/ginkgo step so that the script uses the newly
installed ginkgo binary when cnf-tests-run.sh runs.

Comment on lines +36 to +42
if [[ "$content" == *$'\n'* ]]; then
echo "${varname}: |"
echo "$content" | sed 's/^/ /'
else
echo "${varname}: '${content//\'/''}'"
fi
done > "${dest_file}"
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🌐 Web query:

In bash parameter expansion ${var//pattern/replacement}, is '' interpreted as an empty string or two literal single quotes?

💡 Result:

In bash parameter expansion ${var//pattern/replacement}, '' is interpreted as an empty string, not two literal single quotes. The replacement string undergoes expansions including quote removal, so the quotes are removed, leaving null (empty). This causes matches of pattern to be deleted from var, as stated in the official Bash manual: "If the expansion of string is null, matches of pattern are deleted". The syntax ${var//pattern/} (omitting the / after pattern when replacement is null) is equivalent.

Citations:


Single-quote replacement is a no-op (deletes quotes instead of escaping them).

In bash parameter expansion ${content//\'/''}, the replacement '' is an empty string (after quote removal), so any ' in content is stripped, not escaped. For YAML single-quoted scalars, the correct escape requires doubling the quote character, meaning the replacement must be two literal single-quote characters.

Consequences:

  • A credential value like p'wd is silently emitted as pwd (data corruption).
  • A value like it's becomes its.
  • Variables containing single quotes yield corrupted inventory entries consumed by downstream Ansible.

Fix line 40:

-          echo "${varname}: '${content//\'/''}'"
+          # Escape single quotes for YAML single-quoted scalars by doubling them.
+          escaped=${content//\'/\'\'}
+          echo "${varname}: '${escaped}'"
🧰 Tools
🪛 Shellcheck (0.11.0)

[style] 38-38: See if you can use ${variable//search/replace} instead.

(SC2001)

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In
`@ci-operator/step-registry/telcov10n/functional/cnf-ran/eco-gotests-sno-worker/telcov10n-functional-cnf-ran-eco-gotests-sno-worker-commands.sh`
around lines 36 - 42, The single-quote replacement in the branch that echoes a
single-quoted YAML scalar currently strips single quotes because
`${content//\'/''}` uses an empty replacement; update the parameter expansion
used when constructing the single-quoted scalar so each single-quote in
`content` is replaced by two single-quote characters (i.e., the single-quote is
doubled) instead of removed, and keep the surrounding single quotes around the
substituted value when echoing `${varname}` into `${dest_file}`.

@rdiscala rdiscala force-pushed the TELCOV10N-923-add-eco-gotests-step branch from 694581e to 3afa0dc Compare April 18, 2026 09:42
@rdiscala
Copy link
Copy Markdown
Contributor Author

@coderabbitai review

@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai Bot commented Apr 18, 2026

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@rdiscala
Copy link
Copy Markdown
Contributor Author

/pj-rehearse periodic-ci-openshift-kni-eco-ci-cd-main-cnf-ran-sno-day2-worker-4.20-cnf-ran-ztp-tests

@openshift-merge-bot
Copy link
Copy Markdown
Contributor

@rdiscala: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@openshift-ci
Copy link
Copy Markdown
Contributor

openshift-ci Bot commented Apr 18, 2026

@rdiscala: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/rehearse/periodic-ci-openshift-kni-eco-ci-cd-main-cnf-ran-sno-day2-worker-4.20-cnf-ran-ztp-tests 3afa0dc link unknown /pj-rehearse periodic-ci-openshift-kni-eco-ci-cd-main-cnf-ran-sno-day2-worker-4.20-cnf-ran-ztp-tests

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Add telcov10n-functional-cnf-ran-eco-gotests-sno-worker step to the
cnf-ran-sno-day2-worker-4.20 job. The step runs eco-gotests against
the spoke cluster's day-2 worker node after ZTP provisioning.

The step:
- Builds Ansible inventory from its own credential mounts
- Extracts the spoke kubeconfig from the hub cluster
- Waits for the worker node to reach Ready state (30m timeout)
- Generates and runs eco-gotests per feature via Ansible and SSH
- Mirrors eco-gotests images to the disconnected registry
- Collects JUnit and Polarion XML reports as CI artifacts
- Uses a failure flag so all features run even if one fails

Also adds ECO_GOTESTS_FEATURES and MIRROR_REGISTRY env vars to the
test configuration for explicit control of test scope and registry.
@rdiscala rdiscala force-pushed the TELCOV10N-923-add-eco-gotests-step branch from 3afa0dc to dcd810a Compare April 24, 2026 11:15
@openshift-merge-bot
Copy link
Copy Markdown
Contributor

[REHEARSALNOTIFIER]
@rdiscala: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name Repo Type Reason
periodic-ci-openshift-kni-eco-ci-cd-main-cnf-ran-sno-day2-worker-4.20-cnf-ran-ztp-tests N/A periodic Ci-operator config changed
Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant