Conversation
Signed-off-by: Ilya Buziuk <ibuziuk@redhat.com>
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: ibuziuk The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
📝 WalkthroughWalkthroughBoth ChangesMise Installation
Estimated code review effort: 1 (Trivial) | ~5 minutes Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Hi! I'm che-ai-assistant — I help with your pull requests. Available commands:
|
There was a problem hiding this comment.
🧹 Nitpick comments (1)
universal/ubi9/Dockerfile (1)
558-564: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueUnpinned mise version breaks reproducibility pattern used elsewhere.
Every other tool in this Dockerfile pins an explicit version (
KAMEL_VERSION,OC_VERSION,TKN_VERSION,KUBECTL_VERSION, etc.), butdnf -y install misepulls whatever is latest in the COPR repo at build time, making builds non-reproducible and letting an upstream COPR update silently change behavior.Also, the COPR repo remains enabled in the final image after installation (only the dnf cache is cleaned, not the repo definition), leaving a third-party repository active at runtime.
♻️ Suggested tightening
## mise RUN dnf -y install 'dnf-command(copr)' && \ dnf -y copr enable jdxcode/mise centos-stream+epel-next-9 && \ - dnf -y install mise && \ + dnf -y install mise-<PIN_VERSION> && \ + dnf -y copr disable jdxcode/mise && \ dnf clean all && \ rm -rf /var/cache/dnf🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@universal/ubi9/Dockerfile` around lines 558 - 564, The mise install is unpinned and leaves the COPR repo enabled in the final image, breaking reproducibility and runtime hardening. Update the Dockerfile’s mise setup to install a specific mise version in the same pattern used for KAMEL_VERSION, OC_VERSION, and KUBECTL_VERSION, and ensure the COPR repo is removed or disabled after installation so no third-party repo remains active in the final image.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@universal/ubi9/Dockerfile`:
- Around line 558-564: The mise install is unpinned and leaves the COPR repo
enabled in the final image, breaking reproducibility and runtime hardening.
Update the Dockerfile’s mise setup to install a specific mise version in the
same pattern used for KAMEL_VERSION, OC_VERSION, and KUBECTL_VERSION, and ensure
the COPR repo is removed or disabled after installation so no third-party repo
remains active in the final image.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 93aee4d8-4d31-41df-a35e-bf59cec8956f
📒 Files selected for processing (2)
universal/ubi10/Dockerfileuniversal/ubi9/Dockerfile
https://mise.en.dev/installing-mise.html
Summary by CodeRabbit
miseruntime manager to the UBI 9 and UBI 10 container images.