onboard universal training images to ODH konflux-central#184
Merged
Conversation
Contributor
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Central YAML (base), Organization UI (inherited) Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (6)
Cache: Disabled due to data retention organization setting Knowledge base: Disabled due to data retention organization setting 📝 WalkthroughWalkthroughAdds six new Tekton PipelineRun YAML manifests under pipelineruns/distributed-workloads for multi-arch container builds targeting CPU, CUDA 13.0, and ROCm 6.4 variants. Each variant includes both pull-request and push trigger manifests. Files declare metadata, pipeline parameters (git-url, revision, output-image, dockerfile, path-context, pipeline-type, additional-tags), a git resolver referencing opendatahub-io/odh-konflux-central.git (pathInRepo: pipeline/multi-arch-container-build.yaml), taskRunTemplate with a serviceAccountName, and a git-auth workspace backed by a secret. Annotations include pipelines-as-code settings and CEL expressions for trigger conditions. All changes are additive (≈305 lines across six files). Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Security & Quality Issues
🚥 Pre-merge checks | ✅ 2✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In
`@pipelineruns/distributed-workloads/odh-th06-cpu-torch291-py312-pull-request.yaml`:
- Around line 16-18: The manifest for the CPU pull-request is incorrectly using
CUDA identifiers: replace occurrences of the CUDA variant in the
appstudio.openshift.io/component value and the resource name (currently
containing "odh-th06-cuda130-torch291-py312" and
"odh-th06-cuda130-torch291-py312-on-pull-request") with the correct CPU variant
identifier (e.g., "odh-th06-cpu-torch291-py312" and
"odh-th06-cpu-torch291-py312-on-pull-request"); also update any other keys in
this file that contain "cuda130" (notably the values referenced around the 27–32
and 42 areas) so the CPU pull-request manifest targets the CPU
image/context/service account instead of CUDA. Ensure all occurrences of the
string "cuda130" in resource names and component labels are swapped to the CPU
equivalent to prevent building/pushing the wrong artifact.
In `@pipelineruns/distributed-workloads/odh-th06-cpu-torch291-py312-push.yaml`:
- Around line 33-41: The PipelineRun uses a mutable branch reference: locate the
pipelineRef block (keys pipelineRef, resolver: git, params list with name:
revision currently set to "main") and replace the mutable "main" revision with a
specific immutable git commit SHA for the referenced repo; do this consistently
across all six manifests (odh-th06-rocm64-torch291-py312-push.yaml,
odh-th06-rocm64-torch291-py312-pull-request.yaml,
odh-th06-cuda130-torch291-py312-push.yaml,
odh-th06-cuda130-torch291-py312-pull-request.yaml,
odh-th06-cpu-torch291-py312-push.yaml,
odh-th06-cpu-torch291-py312-pull-request.yaml so the params entry where name:
revision uses the chosen commit SHA instead of "main").
ℹ️ Review info
⚙️ Run configuration
Configuration used: Central YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: 8e91eb37-d994-404d-bd60-c0499c03888a
📒 Files selected for processing (6)
pipelineruns/distributed-workloads/odh-th06-cpu-torch291-py312-pull-request.yamlpipelineruns/distributed-workloads/odh-th06-cpu-torch291-py312-push.yamlpipelineruns/distributed-workloads/odh-th06-cuda130-torch291-py312-pull-request.yamlpipelineruns/distributed-workloads/odh-th06-cuda130-torch291-py312-push.yamlpipelineruns/distributed-workloads/odh-th06-rocm64-torch291-py312-pull-request.yamlpipelineruns/distributed-workloads/odh-th06-rocm64-torch291-py312-push.yaml
pipelineruns/distributed-workloads/odh-th06-cpu-torch291-py312-pull-request.yaml
Outdated
Show resolved
Hide resolved
Comment on lines
+33
to
+41
| pipelineRef: | ||
| resolver: git | ||
| params: | ||
| - name: url | ||
| value: https://github.com/opendatahub-io/odh-konflux-central.git | ||
| - name: revision | ||
| value: main | ||
| - name: pathInRepo | ||
| value: pipeline/multi-arch-container-build.yaml |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# First, verify the specific file exists and its contents
if [ -f "pipelineruns/distributed-workloads/odh-th06-cpu-torch291-py312-push.yaml" ]; then
echo "=== File contents ==="
cat -n "pipelineruns/distributed-workloads/odh-th06-cpu-torch291-py312-push.yaml"
else
echo "File not found. Listing distributed-workloads directory:"
find pipelineruns/distributed-workloads -type f -name "*.yaml" 2>/dev/null | head -20
fiRepository: opendatahub-io/odh-konflux-central
Length of output: 2168
🏁 Script executed:
#!/bin/bash
# Search for git resolver patterns in the directory
echo "=== Git resolver patterns in distributed-workloads ==="
rg -l 'resolver:\s*git' pipelineruns/distributed-workloads/ 2>/dev/null || echo "No git resolvers found"Repository: opendatahub-io/odh-konflux-central
Length of output: 608
🏁 Script executed:
#!/bin/bash
# Search for revision patterns in pipelineRef sections
echo "=== Revision value patterns in pipelineRef ==="
rg -B2 -A2 'name:\s*revision' pipelineruns/distributed-workloads/ 2>/dev/null | head -50Repository: opendatahub-io/odh-konflux-central
Length of output: 4612
Pin pipelineRef to an immutable revision across all git resolvers (Critical, CWE-494/CWE-829).
All six PipelineRun manifests in pipelineruns/distributed-workloads/ use mutable main branch for remotely resolved pipeline definitions. Exploit scenario: upstream compromise or force-push enables attacker-controlled build logic execution, leading to secret exfiltration or poisoned container image publication.
🔧 Remediation (pin to commit SHA)
pipelineRef:
resolver: git
params:
- name: url
value: https://github.com/opendatahub-io/odh-konflux-central.git
- name: revision
- value: main
+ value: "<40-char-immutable-commit-sha>"
- name: pathInRepo
value: pipeline/multi-arch-container-build.yamlApply to all files:
odh-th06-rocm64-torch291-py312-push.yamlodh-th06-rocm64-torch291-py312-pull-request.yamlodh-th06-cuda130-torch291-py312-push.yamlodh-th06-cuda130-torch291-py312-pull-request.yamlodh-th06-cpu-torch291-py312-push.yamlodh-th06-cpu-torch291-py312-pull-request.yaml
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@pipelineruns/distributed-workloads/odh-th06-cpu-torch291-py312-push.yaml`
around lines 33 - 41, The PipelineRun uses a mutable branch reference: locate
the pipelineRef block (keys pipelineRef, resolver: git, params list with name:
revision currently set to "main") and replace the mutable "main" revision with a
specific immutable git commit SHA for the referenced repo; do this consistently
across all six manifests (odh-th06-rocm64-torch291-py312-push.yaml,
odh-th06-rocm64-torch291-py312-pull-request.yaml,
odh-th06-cuda130-torch291-py312-push.yaml,
odh-th06-cuda130-torch291-py312-pull-request.yaml,
odh-th06-cpu-torch291-py312-push.yaml,
odh-th06-cpu-torch291-py312-pull-request.yaml so the params entry where name:
revision uses the chosen commit SHA instead of "main").
MohammadiIram
approved these changes
Mar 5, 2026
pipelineruns/distributed-workloads/odh-th06-cpu-torch291-py312-pull-request.yaml
Outdated
Show resolved
Hide resolved
pipelineruns/distributed-workloads/odh-th06-cpu-torch291-py312-pull-request.yaml
Outdated
Show resolved
Hide resolved
MohammadiIram
requested changes
Mar 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
How Has This Been Tested?
Merge criteria:
Summary by CodeRabbit