OCPEDGE-2543: add CONTRIBUTING.md - #100
Conversation
Contributor guide covering fork model, development workflow, code standards, testing, security, documentation, commit conventions, and PR process. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
openshift-ci-robot
added
the
jira/valid-reference
|
@fonta-rh: This pull request references OCPEDGE-2543 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: fonta-rh The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
WalkthroughAdded ChangesContribution Guidance
Estimated code review effort: 1 (Trivial) | ~3 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 10 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (10 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
coderabbitai
Bot
added
the
ready-for-human-review
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (1)
CONTRIBUTING.md (1)
151-152: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winUpdate the OWNERS references.
Use the exact aliases from
OWNERS:edge-enablement-approversandteam-dragonfly-approvers.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@CONTRIBUTING.md` around lines 151 - 152, Update the OWNERS references in the review guidance to use the exact aliases edge-enablement-approvers and team-dragonfly-approvers instead of the shorter team names.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@CONTRIBUTING.md`:
- Around line 98-106: Make the Python ruff requirement executable by updating
the Makefile: add a maintained ruff target and include it in the verify target
alongside shellcheck, yamlfmt, and ansible-lint. Ensure make verify runs the
documented Python lint check locally.
- Around line 62-68: Update the lint behavior documentation in CONTRIBUTING.md:
state that make shellcheck only lints without modifying files, make yamlfmt
formats files by default, and make verify runs both commands in validate-only
mode without modifications.
- Around line 22-25: Update the container-based linter workflow documentation to
reflect the OPENSHIFT_CI behavior: ensure hack/yamlfmt.sh safely handles an
unset OPENSHIFT_CI value using an empty default, and document that setting
OPENSHIFT_CI makes all three scripts run locally with the required local-tool
prerequisites, or remove those local-tool branches so the documented container
workflow remains accurate.
- Around line 18-21: Update the commit-signing guidance in the contributor setup
steps to recommend GPG or SSH signing without stating that the repository
enforces signatures or rejects unsigned commits. Retain the link to GitHub’s
signing documentation.
---
Nitpick comments:
In `@CONTRIBUTING.md`:
- Around line 151-152: Update the OWNERS references in the review guidance to
use the exact aliases edge-enablement-approvers and team-dragonfly-approvers
instead of the shorter team names.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 112f7526-1a29-4744-8c1a-26bcfcc4c18b
📒 Files selected for processing (1)
CONTRIBUTING.md
| 3. Set up commit signing (GPG or SSH). The repo enforces signature | ||
| verification — unsigned commits are rejected. See [GitHub's signing | ||
| docs](https://docs.github.com/en/authentication/managing-commit-signature-verification) | ||
| for setup instructions. |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
gh api repos/openshift-eng/two-node-toolbox/branches/main/protection/required_signatures \
--jq '.enabled'Repository: openshift-eng/two-node-toolbox
Length of output: 399
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- CONTRIBUTING.md ---'
sed -n '1,60p' CONTRIBUTING.md
printf '%s\n' '--- repository policy references ---'
rg -n -i 'signed commit|commit signing|signature|unsigned|ruleset|branch protection|protected branch' \
-g '!CONTRIBUTING.md' -g '!*.lock' . || true
printf '%s\n' '--- public GitHub branch and ruleset metadata ---'
curl -fsSL -H 'Accept: application/vnd.github+json' \
https://api.github.com/repos/openshift-eng/two-node-toolbox/branches/main \
| jq '{name, protected, protection_url, required_signatures_url: ._links.self.href}'
curl -sS -D /tmp/tnt-ruleset-headers \
-o /tmp/tnt-rulesets.json \
-H 'Accept: application/vnd.github+json' \
https://api.github.com/repos/openshift-eng/two-node-toolbox/rulesets
printf '%s\n' '--- rulesets response status ---'
head -n 1 /tmp/tnt-ruleset-headers
cat /tmp/tnt-rulesets.jsonRepository: openshift-eng/two-node-toolbox
Length of output: 2489
🏁 Script executed:
#!/bin/bash
set -euo pipefail
curl -fsSL -H 'Accept: application/vnd.github+json' \
https://api.github.com/repos/openshift-eng/two-node-toolbox/branches/main/protection/required_signatures \
| jq .Repository: openshift-eng/two-node-toolbox
Length of output: 219
🌐 Web query:
openshift-eng/two-node-toolbox main branch signed commits required signatures ruleset
💡 Result:
As of July 31, 2026, the openshift-eng/two-node-toolbox repository does not have a publicly visible GitHub ruleset enforced that mandates signed commits [1]. While commit signature verification is a common practice for security in OpenShift-related repositories, commit history in this repository shows that both signed and unsigned commits have been accepted [2][3][4][5][6]. Specifically, while many recent commits are marked as "Verified" (often associated with automated processes or contributors with configured GPG/SSH signing keys) [2][3][5][6], there is no indication from the repository's configuration that signed commits are a mandatory requirement enforced via a GitHub ruleset. You can verify the active rulesets for any public GitHub repository by navigating to the "Rulesets" tab in the repository settings (if you have appropriate permissions) or by appending /rules to the repository URL (e.g., https://github.com/openshift-eng/two-node-toolbox/rules) [7]. GitHub rulesets, when configured, can mandate signed commits for all pushes to target branches [8][9][10].
Citations:
- 1: https://github.com/openshift-eng/two-node-toolbox
- 2: 6ff90e0
- 3: b39843c
- 4: 4da6437
- 5: 50d1579
- 6: 0261d1a
- 7: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/managing-rulesets-for-a-repository
- 8: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/about-rulesets
- 9: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets
- 10: https://docs.github.com/en/enterprise-cloud@latest/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/troubleshooting-rules
Correct the commit-signing guidance.
The repository does not publicly enforce signed commits on main, so unsigned commits are not guaranteed to be rejected. Recommend GPG or SSH signing without claiming repository enforcement.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@CONTRIBUTING.md` around lines 18 - 21, Update the commit-signing guidance in
the contributor setup steps to recommend GPG or SSH signing without stating that
the repository enforces signatures or rejects unsigned commits. Retain the link
to GitHub’s signing documentation.
There was a problem hiding this comment.
Won't fix — commit signature verification was recently enabled on this repo. The enforcement claim is accurate.
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
gh api \
repos/openshift-eng/two-node-toolbox/branches/main/protection/required_signatures \
--jq '{enabled: .enabled}'Length of output: 693
@fonta-rh, verification failed because the GitHub integration cannot read the branch-protection endpoint. It returned HTTP 403: Resource not accessible by integration.
Please retry with credentials that can read main branch protection, or provide the enabled setting from the repository configuration. I will leave the finding unresolved until the setting is verifiable.
✏️ Learnings added
Learnt from: fonta-rh
Repo: openshift-eng/two-node-toolbox PR: 100
File: CONTRIBUTING.md:18-21
Timestamp: 2026-07-31T16:20:25.876Z
Learning: For `openshift-eng/two-node-toolbox`, maintainer `fonta-rh` states that GitHub commit signature verification was recently enabled. Guidance in `CONTRIBUTING.md` may accurately state that unsigned commits are rejected, but reviewers must verify the current `main` branch protection setting because the policy can change.
Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.
You are interacting with an AI system.
Auto-applied: - CONTRIBUTING.md:62-68: shellcheck is read-only, not auto-fix Accepted after review: - CONTRIBUTING.md:98-100: clarify ruff is checked by CodeRabbit, not make verify Co-Authored-By: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
Re: CodeRabbit nitpick — use exact OWNERS alias names Won't fix — the short names (edge-enablement, team-dragonfly) are more readable for a contributor guide. The full alias names (edge-enablement-approvers, edge-enablement-reviewers, etc.) would add noise without helping contributors who don't interact with OWNERS files directly. |
coderabbitai
Bot
removed
the
ready-for-human-review
2 participants
Summary
References
Summary by CodeRabbit