.github/workflows/kubernetes-controller.yml (1)

220-225: Keep the PR chart artifact name in one place.

controller-chart-pr is now the contract between the upload step and conformance-pr. Extracting it to a shared env var or build output would make the next rename a one-line change instead of a runtime break.

Also applies to: 473-475

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/kubernetes-controller.yml around lines 220 - 225, The
workflow hardcodes the artifact name "controller-chart-pr" in the "Upload Chart
Artifact" step, creating a fragile contract with the later "conformance-pr"
consumer; extract that artifact name into a single shared value (e.g., a
workflow env var like CHART_ARTIFACT_NAME or a build output) and replace the
literal name in the Upload Chart Artifact step and any consumers (including the
conformance-pr references) with that variable so future renames are a single
change.

.github/workflows/conformance.yml (1)

21-38: Validate artifact/version pairs before the skopeo steps.

cli_version and toolkit_version are only documented as conditionally required, but Line 113 and Line 136 consume them unguarded. If a caller forgets one, this reusable workflow fails later with a fairly opaque oci:...: / skopeo error instead of a direct input validation failure.

Proposed guard step

       - name: Install kind
         run: go install sigs.k8s.io/kind@v0.31.0

+      - name: Validate artifact inputs
+        env:
+          CLI_ARTIFACT: ${{ inputs.cli_artifact }}
+          CLI_VERSION: ${{ inputs.cli_version }}
+          TOOLKIT_IMAGE_ARTIFACT: ${{ inputs.toolkit_image_artifact }}
+          TOOLKIT_VERSION: ${{ inputs.toolkit_version }}
+        run: |
+          if [ -n "${CLI_ARTIFACT}" ] && [ -z "${CLI_VERSION}" ]; then
+            echo "::error::cli_version is required when cli_artifact is set"
+            exit 1
+          fi
+          if [ -n "${TOOLKIT_IMAGE_ARTIFACT}" ] && [ -z "${TOOLKIT_VERSION}" ]; then
+            echo "::error::toolkit_version is required when toolkit_image_artifact is set"
+            exit 1
+          fi
+
       # Artifact mode: Download and prepare CLI image
       - name: Download CLI artifact

Also applies to: 95-137

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/conformance.yml around lines 21 - 38, Add explicit
validation before any skopeo steps to check that artifact/version input pairs
are provided together: if toolkit_image_artifact is set then toolkit_version
must be non-empty, and if cli_artifact is set then cli_version must be
non-empty; when a pair is missing fail fast with a clear error message.
Implement this as a dedicated workflow step (e.g., "Validate artifact/version
inputs") that inspects the inputs toolkit_image_artifact, toolkit_version,
cli_artifact, and cli_version and uses a failing exit (with a descriptive echo)
when the conditional requirement is not met so downstream skopeo invocations are
never reached with missing inputs.

.github/workflows/conformance.yml (2)

147-151: Consider using a more robust glob expansion.

The ls command with a glob pattern could capture multiple files if the artifact contains more than one matching chart. While unlikely in practice, this would cause TOOLKIT_IMAGE to contain multiple paths.

🔧 Safer single-file extraction

      - name: Set toolkit image to local chart
        if: ${{ inputs.toolkit_chart_artifact != '' }}
        run: |
-          CHART_PATH=$(ls tmp/chart-artifact/chart-*.tgz)
+          CHART_PATH=$(ls tmp/chart-artifact/chart-*.tgz | head -n 1)
+          if [ -z "$CHART_PATH" ]; then
+            echo "::error::No chart found in artifact"
+            exit 1
+          fi
          echo "TOOLKIT_IMAGE=${{ github.workspace }}/${CHART_PATH}" >> "$GITHUB_ENV"

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/conformance.yml around lines 147 - 151, The CHART_PATH
assignment uses `ls` with a glob which can expand to multiple files and produce
multiple paths in TOOLKIT_IMAGE; update the step that sets CHART_PATH so it uses
shell globbing to pick a single artifact (e.g., populate an array from
tmp/chart-artifact/chart-*.tgz and assign CHART_PATH to the first element) and
add a guard that fails the job if no match is found, then export TOOLKIT_IMAGE
using that single CHART_PATH value.

---

16-40: Consider adding validation for required input combinations.

The input descriptions state that cli_version is "required when cli_artifact is set" and toolkit_version is "required when toolkit_image_artifact is set", but there's no enforcement. If artifact inputs are provided without their corresponding version inputs, the skopeo commands will use empty tags, potentially causing silent failures.

Since callers are internal reusable workflows, you could either:

1. Add a validation step at the start of the job
2. Document this as a caller responsibility

🔧 Optional validation step

- name: Validate artifact inputs
  if: ${{ inputs.cli_artifact != '' || inputs.toolkit_image_artifact != '' }}
  run: |
    if [ -n "${{ inputs.cli_artifact }}" ] && [ -z "${{ inputs.cli_version }}" ]; then
      echo "::error::cli_version is required when cli_artifact is set"
      exit 1
    fi
    if [ -n "${{ inputs.toolkit_image_artifact }}" ] && [ -z "${{ inputs.toolkit_version }}" ]; then
      echo "::error::toolkit_version is required when toolkit_image_artifact is set"
      exit 1
    fi

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/conformance.yml around lines 16 - 40, Add an input
validation step at the start of the workflow/job to enforce the stated input
combinations: when cli_artifact is non-empty require cli_version, and when
toolkit_image_artifact is non-empty require toolkit_version; implement the check
using the workflow's shell step (e.g., a step named "Validate artifact inputs")
that reads inputs.cli_artifact, inputs.cli_version,
inputs.toolkit_image_artifact and inputs.toolkit_version, emits clear error
messages like "cli_version is required when cli_artifact is set" or
"toolkit_version is required when toolkit_image_artifact is set", and exits
non-zero on failure so the job fails fast rather than allowing skopeo to run
with empty tags.

.github/workflows/conformance.yml (2)

147-151: Consider using a safer glob expansion.

Using ls to capture the chart path works when exactly one file matches, but will break if multiple .tgz files exist (e.g., from a previous failed run or accidental extra files).

🔧 Suggested safer approach

      - name: Set toolkit image to local chart
        if: ${{ inputs.toolkit_chart_artifact != '' }}
        run: |
-          CHART_PATH=$(ls tmp/chart-artifact/chart-*.tgz)
+          shopt -s nullglob
+          CHARTS=(tmp/chart-artifact/chart-*.tgz)
+          if [ ${`#CHARTS`[@]} -ne 1 ]; then
+            echo "::error::Expected exactly 1 chart file, found ${`#CHARTS`[@]}"
+            exit 1
+          fi
+          CHART_PATH=${CHARTS[0]}
           echo "TOOLKIT_IMAGE=${{ github.workspace }}/${CHART_PATH}" >> "$GITHUB_ENV"

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/conformance.yml around lines 147 - 151, The step "Set
toolkit image to local chart" uses `ls` to populate CHART_PATH which breaks if
zero or multiple chart-*.tgz files exist; change the shell logic that sets
CHART_PATH to use a safe glob or find (e.g., expand
tmp/chart-artifact/chart-*.tgz into an array and verify exactly one match or use
find ... -print -quit) and fail with a clear error if none or more than one file
is found so CHART_PATH is always a single, deterministic path.

---

167-178: Validation step is a good addition; error message could be clarified.

The validation ensures both required images are set before running scenarios. However, the error message on line 175 mentions 'toolkit_version' as a required input alongside toolkit_chart_artifact, but toolkit_version is only needed when using toolkit_image_artifact (to tag the controller image), not for the chart itself.

📝 Suggested message refinement

           if [ -z "$TOOLKIT_IMAGE" ]; then
-            echo "::error::TOOLKIT_IMAGE is not set. Provide either 'toolkit_image' or 'toolkit_chart_artifact' + 'toolkit_version' inputs."
+            echo "::error::TOOLKIT_IMAGE is not set. Provide either 'toolkit_image' or 'toolkit_chart_artifact' inputs."
             err=1
           fi

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/conformance.yml around lines 167 - 178, Update the
validation error text for TOOLKIT_IMAGE to accurately reflect required inputs:
change the echo in the TOOLKIT_IMAGE check (the line that currently mentions
"'toolkit_chart_artifact' + 'toolkit_version'") to state that either
'toolkit_image' or 'toolkit_chart_artifact' must be provided, and separately
note that 'toolkit_version' is only required when using the toolkit image
artifact (e.g., 'toolkit_image_artifact' + 'toolkit_version'), not for
chart-only usage; edit the echo message referencing TOOLKIT_IMAGE and the inputs
'toolkit_chart_artifact' and 'toolkit_version' to convey this distinction.