Skip to content

feat: enhanced local resource validation#545

Merged
drey merged 26 commits intomainfrom
feat/enchanced-resource-validation
Feb 2, 2026
Merged

feat: enhanced local resource validation#545
drey merged 26 commits intomainfrom
feat/enchanced-resource-validation

Conversation

@drey
Copy link
Contributor

@drey drey commented Jan 26, 2026

Summary by Bito

This pull request enhances the testing infrastructure for local resource validation by refactoring test helpers and adding comprehensive AI-generated test suites for kubeconform and general validation.

Detailed Changes
  • Refactored test constants in helpers_ai_test.go to use a const block for better code organization.
  • Introduced new utility functions newSchemaHandler and setupDefaultSchemaServer in helpers_ai_test.go to reduce duplication in test setups.
  • Added new AI test file kubeconform_ai_test.go with multiple test cases covering valid resources, invalid resources, edge cases, and integration scenarios for kubeconform validation.
  • Introduced AI test suite in validate_ai_test.go for resource validation including codec validation, duplicate detection, namespace protection, and validation skipping.

@drey drey changed the title feat: enhanced local resource validation feat[WIP]: enhanced local resource validation Jan 26, 2026
@drey drey force-pushed the feat/enchanced-resource-validation branch from f82622d to 3f2497a Compare January 26, 2026 19:44
Signed-off-by: Ilya Drey <ilya.drey@flant.com>
@drey drey force-pushed the feat/enchanced-resource-validation branch from 3f2497a to f99e948 Compare January 26, 2026 19:52
@drey drey changed the title feat[WIP]: enhanced local resource validation feat: enhanced local resource validation Jan 27, 2026
@drey drey marked this pull request as ready for review January 27, 2026 17:41
@drey drey requested a review from ilya-lesikov January 27, 2026 17:41
drey added 2 commits January 28, 2026 10:32
Signed-off-by: Ilya Drey <ilya.drey@flant.com>
Signed-off-by: Ilya Drey <ilya.drey@flant.com>
@drey drey requested a review from ilya-lesikov January 28, 2026 13:51
drey added 2 commits January 29, 2026 15:40
Signed-off-by: Ilya Drey <ilya.drey@flant.com>
Signed-off-by: Ilya Drey <ilya.drey@flant.com>
@ilya-lesikov
Copy link
Member

ilya-lesikov commented Jan 29, 2026

Also, please briefly skim through these. Most of them are false positive or BS, but few are suspicious:

PR Review Summary: #545 feat/enchanced-resource-validation

Critical Issues (3 found)

1. Context Leak in Loop - defer cancel() inside loop

File: internal/resource/kubeconform.go#L207-L208

Issue: Context with timeout is created inside a loop with defer cancel(). All cancel functions accumulate and only execute when the function returns, causing resource leaks.

for _, schemaSource := range kc.schemaSources {
    ctx, cancel := context.WithTimeout(ctx, 5*time.Second)
    defer cancel()  // BUG: Only runs when function returns!

Fix: Use an immediately-invoked function or call cancel() explicitly after each HTTP request.


2. Silent Unlock Failures Could Cause Deadlocks

File: internal/resource/kubeconform.go#L300-L302, #L358-L360, #L382-L384, #L407-L409, #L449-L451

Issue: Multiple defer blocks unlock file locks but only log errors. If unlock fails, the lock remains held, potentially causing deadlocks.

Impact: Locks can remain held indefinitely, blocking all future validation operations with no visible error to users.


3. Zero Test Coverage for 565 Lines of Complex Code

File: internal/resource/kubeconform.go

Issue: The new kubeconform.go file (565 lines) has no tests despite containing:

  • File locking logic (deadlock potential)
  • Cache metadata serialization (corruption potential)
  • Network operations with timeouts
  • Concurrent access patterns

Risk: File locking deadlocks, cache corruption, and silent validation failures could go undetected.


Important Issues (6 found)

4. Metadata Merging May Cause Inconsistency

File: internal/resource/kubeconform.go#L496-L498

Issue: loadMetadataFromDisk() merges entries but never removes deleted ones, violating file lock synchronization intent.


5. No Error When All Validators Skip Resource

File: internal/resource/kubeconform.go#L69-L123

Issue: If all validators fail with "could not find schema", the function returns nil. Invalid resources pass validation silently.


6. Missing Validation for Empty Schema Sources

File: internal/resource/kubeconform.go#L141-L173

Issue: If schemaSources is empty, the validator silently does nothing. Should fail fast with clear error.


7. Flag Naming Inconsistency

File: cmd/nelm/common_flags.go#L311

Issue: --local-resource-validation name suggests "enable local" but actually means "disable external". Confusing UX.


8. Constructor Accepts Invalid State

File: internal/resource/kubeconform.go#L42-L48

Issue: NewKubeConformValidator accepts empty schema sources and zero/negative cache lifetime without validation.


9. Race Condition on validators Slice

File: internal/resource/kubeconform.go#L127, #L169

Issue: validators slice is read in findCachedEntry but mutated in getValidatorInstances without synchronization.


Suggestions (5 found)

10. Comment Typo and Grammar

File: internal/resource/kubeconform.go#L113, #L454

Issues:

  • Line 113: "Errors" should be "errors" (not a type)
  • Line 454: "has" should be "have"

11. Incomplete Comments on Critical Logic

File: internal/resource/kubeconform.go#L150-L151, #L175-L177, #L390-L391

Issue: Comments describe what but not why. Missing rationale for design decisions.


12. URL Parsing Error Silently Ignored

File: internal/resource/kubeconform.go#L516-L519

Issue: If url.Parse() fails, error is ignored and treated as local source.


13. Template Errors Lack Context

File: internal/resource/kubeconform.go#L551-L557

Issue: Template parsing/execution errors don't include the template string or parameters.


14. Public Fields on Internal Types

File: internal/resource/kubeconform.go#L238-L250

Issue: kubeConformSchemaSourceParams and kubeConformCacheMetadata have exported fields with no encapsulation.

drey added 2 commits January 29, 2026 22:48
Signed-off-by: Ilya Drey <ilya.drey@flant.com>
Signed-off-by: Ilya Drey <ilya.drey@flant.com>
@bito-code-review
Copy link

bito-code-review bot commented Jan 29, 2026

Changelist by Bito

This pull request implements the following key changes.

Key Change Files Impacted Summary
Testing - Enhanced Resource Validation Testing
Refactored test helpers for better organization, added comprehensive AI test suites for kubeconform validation covering valid resources, edge cases, and integration scenarios, and introduced tests for general resource validation including codec validation, duplicate detection, and validation skipping.

@bito-code-review
Copy link

bito-code-review bot commented Jan 29, 2026

Interaction Diagram by Bito
sequenceDiagram
participant User as User
participant Cmd as ReleaseInstallCmd
participant Flags as AddResourceValidationFlags<br/>🔄 Updated | ●●○ Medium
participant Opts as ResourceValidationOptions
participant Action as ReleaseInstallAction
participant Val as ResourceValidator
participant KConf as KubeConformValidator
participant Cache as SchemaCache
participant ExtSrc as External Schema Source
participant LocSrc as Local Schema Source
User->>Cmd: Run command with --resource-validation-schema
Cmd->>Flags: AddResourceValidationFlags
Flags->>Opts: Populate ResourceValidationOptions
Cmd->>Action: Execute action with opts
Action->>Val: ValidateLocal with opts
Val->>KConf: newKubeConformValidator
KConf->>Cache: Check cache
alt [cache miss]
KConf->>ExtSrc: Fetch schema via HTTP
ExtSrc-->>KConf: Return schema
KConf->>Cache: Store in cache with lock
    end
Val->>KConf: Validate resource
KConf-->>Val: Validation result
Val-->>Action: Validation complete
Action-->>Cmd: Command result
Loading

Critical path: ReleaseInstallCmd -> AddResourceValidationFlags -> ResourceValidationOptions -> ReleaseInstallAction -> ResourceValidator -> KubeConformValidator

Note: The MR adds CLI flags for configuring resource validation options, including schema sources and cache lifetime. It introduces data transformation layers for parsing flag values into validation options, integration points for external schema fetching via HTTP, and persistence for schema caching with file locking. Upstream entrypoints are CLI commands like release install, while downstream impacts include enhanced validation logic.

If the interaction diagram doesn't appear, refresh the page to render it.

You can disable interaction diagrams by customizing agent settings. Refer to documentation.

Copy link

@bito-code-review bito-code-review bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review Agent Run #8d3159

Actionable Suggestions - 8
Review Details
  • Files reviewed - 6 · Commit Range: f99e948..20eee32
    • cmd/nelm/common_flags.go
    • go.mod
    • internal/resource/kubeconform.go
    • internal/resource/validate.go
    • pkg/common/common.go
    • pkg/common/options.go
  • Files skipped - 0
  • Tools
    • Whispers (Secret Scanner) - ✔︎ Successful
    • Detect-secrets (Secret Scanner) - ✔︎ Successful
    • Golangci-lint (Linter) - ✔︎ Successful
    • OWASP (Security Vulnerability) - ✔︎ Successful
    • SNYK (Security Vulnerability) - ✔︎ Successful
    • GOVULNCHECK (Security Vulnerability) - ✖︎ Failed

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

  • /review - Manually triggers a full AI review.

  • /pause - Pauses automatic reviews on this pull request.

  • /resume - Resumes automatic reviews.

  • /resolve - Marks all Bito-posted review comments as resolved.

  • /abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Default Agent You can customize the agent settings here or contact your Bito workspace admin at ilya.lesikov@flant.com.

Documentation & Help

AI Code Review powered by Bito Logo

drey added 2 commits January 30, 2026 00:57
Signed-off-by: Ilya Drey <ilya.drey@flant.com>
Signed-off-by: Ilya Drey <ilya.drey@flant.com>
@bito-code-review
Copy link

bito-code-review bot commented Jan 29, 2026

Code Review Agent Run #267fe1

Actionable Suggestions - 0
Review Details
  • Files reviewed - 6 · Commit Range: 20eee32..19d2e22
    • cmd/nelm/common_flags.go
    • go.mod
    • internal/resource/kubeconform.go
    • internal/resource/validate.go
    • pkg/common/common.go
    • pkg/common/options.go
  • Files skipped - 0
  • Tools
    • Whispers (Secret Scanner) - ✔︎ Successful
    • Detect-secrets (Secret Scanner) - ✔︎ Successful
    • Golangci-lint (Linter) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

  • /review - Manually triggers a full AI review.

  • /pause - Pauses automatic reviews on this pull request.

  • /resume - Resumes automatic reviews.

  • /resolve - Marks all Bito-posted review comments as resolved.

  • /abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Default Agent You can customize the agent settings here or contact your Bito workspace admin at ilya.lesikov@flant.com.

Documentation & Help

AI Code Review powered by Bito Logo

Signed-off-by: Ilya Drey <ilya.drey@flant.com>
@bito-code-review
Copy link

bito-code-review bot commented Jan 30, 2026

Code Review Agent Run #da13ef

Actionable Suggestions - 0
Review Details
  • Files reviewed - 6 · Commit Range: 19d2e22..5ad5474
    • cmd/nelm/common_flags.go
    • go.mod
    • internal/resource/kubeconform.go
    • internal/resource/validate.go
    • pkg/common/common.go
    • pkg/common/options.go
  • Files skipped - 0
  • Tools
    • Whispers (Secret Scanner) - ✔︎ Successful
    • Detect-secrets (Secret Scanner) - ✔︎ Successful
    • Golangci-lint (Linter) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

  • /review - Manually triggers a full AI review.

  • /pause - Pauses automatic reviews on this pull request.

  • /resume - Resumes automatic reviews.

  • /resolve - Marks all Bito-posted review comments as resolved.

  • /abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Default Agent You can customize the agent settings here or contact your Bito workspace admin at ilya.lesikov@flant.com.

Documentation & Help

AI Code Review powered by Bito Logo

Signed-off-by: Ilya Drey <ilya.drey@flant.com>
drey added 2 commits January 30, 2026 14:41
Signed-off-by: Ilya Drey <ilya.drey@flant.com>
Signed-off-by: Ilya Drey <ilya.drey@flant.com>
Copy link

@bito-code-review bito-code-review bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review Agent Run #069bea

Actionable Suggestions - 1
Additional Suggestions - 1
  • go.mod - 1
    • New External Dependency · Line 52-52
      This adds a direct dependency on gopkg.in/resty.v1 v1.12.0. Per AGENTS.md, new external dependencies require explicit approval from the reviewer to proceed.
Review Details
  • Files reviewed - 7 · Commit Range: 5ad5474..f5907a7
    • cmd/nelm/common_flags.go
    • go.mod
    • go.sum
    • internal/resource/kubeconform.go
    • internal/resource/validate.go
    • pkg/common/common.go
    • pkg/common/options.go
  • Files skipped - 0
  • Tools
    • Whispers (Secret Scanner) - ✔︎ Successful
    • Detect-secrets (Secret Scanner) - ✔︎ Successful
    • Golangci-lint (Linter) - ✔︎ Successful
    • OWASP (Security Vulnerability) - ✔︎ Successful
    • SNYK (Security Vulnerability) - ✔︎ Successful
    • GOVULNCHECK (Security Vulnerability) - ✖︎ Failed

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

  • /review - Manually triggers a full AI review.

  • /pause - Pauses automatic reviews on this pull request.

  • /resume - Resumes automatic reviews.

  • /resolve - Marks all Bito-posted review comments as resolved.

  • /abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Default Agent You can customize the agent settings here or contact your Bito workspace admin at ilya.lesikov@flant.com.

Documentation & Help

AI Code Review powered by Bito Logo

Signed-off-by: Ilya Drey <ilya.drey@flant.com>
@bito-code-review
Copy link

bito-code-review bot commented Jan 30, 2026

Code Review Agent Run #1e9f1b

Actionable Suggestions - 0
Additional Suggestions - 1
  • go.mod - 1
    • New External Dependency · Line 21-21
      This adds a new external dependency github.com/go-resty/resty/v2. Per AGENTS.md guidelines, new external dependencies require explicit approval from the reviewer. Although this replaces gopkg.in/resty.v1, the import path change makes it a new dependency.
Review Details
  • Files reviewed - 8 · Commit Range: f5907a7..cd310da
    • cmd/nelm/common_flags.go
    • go.mod
    • go.sum
    • internal/resource/kubeconform.go
    • internal/resource/validate.go
    • pkg/common/common.go
    • pkg/common/options.go
    • pkg/log/logger.go
  • Files skipped - 0
  • Tools
    • Whispers (Secret Scanner) - ✔︎ Successful
    • Detect-secrets (Secret Scanner) - ✔︎ Successful
    • Golangci-lint (Linter) - ✔︎ Successful
    • SNYK (Security Vulnerability) - ✔︎ Successful
    • GOVULNCHECK (Security Vulnerability) - ✖︎ Failed
    • OWASP (Security Vulnerability) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

  • /review - Manually triggers a full AI review.

  • /pause - Pauses automatic reviews on this pull request.

  • /resume - Resumes automatic reviews.

  • /resolve - Marks all Bito-posted review comments as resolved.

  • /abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Default Agent You can customize the agent settings here or contact your Bito workspace admin at ilya.lesikov@flant.com.

Documentation & Help

AI Code Review powered by Bito Logo

Signed-off-by: Ilya Drey <ilya.drey@flant.com>
Copy link

@bito-code-review bito-code-review bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review Agent Run #82b919

Actionable Suggestions - 2
  • internal/util/http.go - 1
  • pkg/log/logger.go - 1
Review Details
  • Files reviewed - 9 · Commit Range: cd310da..7586dfa
    • cmd/nelm/common_flags.go
    • go.mod
    • go.sum
    • internal/resource/kubeconform.go
    • internal/resource/validate.go
    • internal/util/http.go
    • pkg/common/common.go
    • pkg/common/options.go
    • pkg/log/logger.go
  • Files skipped - 0
  • Tools
    • Whispers (Secret Scanner) - ✔︎ Successful
    • Detect-secrets (Secret Scanner) - ✔︎ Successful
    • Golangci-lint (Linter) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

  • /review - Manually triggers a full AI review.

  • /pause - Pauses automatic reviews on this pull request.

  • /resume - Resumes automatic reviews.

  • /resolve - Marks all Bito-posted review comments as resolved.

  • /abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Default Agent You can customize the agent settings here or contact your Bito workspace admin at ilya.lesikov@flant.com.

Documentation & Help

AI Code Review powered by Bito Logo

ilya-lesikov and others added 5 commits January 30, 2026 22:21
Signed-off-by: Ilya Lesikov <ilya@lesikov.com>
Signed-off-by: Ilya Lesikov <ilya@lesikov.com>
Signed-off-by: Ilya Drey <ilya.drey@flant.com>
Signed-off-by: Ilya Lesikov <ilya@lesikov.com>
Copy link

@bito-code-review bito-code-review bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review Agent Run #6566e0

Actionable Suggestions - 1
  • internal/resource/kubeconform_ai_test.go - 1
Review Details
  • Files reviewed - 12 · Commit Range: 7586dfa..ba4d694
    • cmd/nelm/common_flags.go
    • go.mod
    • go.sum
    • internal/resource/helpers_ai_test.go
    • internal/resource/kubeconform.go
    • internal/resource/kubeconform_ai_test.go
    • internal/resource/validate.go
    • internal/resource/validate_ai_test.go
    • internal/util/http.go
    • pkg/common/common.go
    • pkg/common/options.go
    • pkg/log/logger.go
  • Files skipped - 4
    • internal/resource/testdata/schemas/configmap.json - Reason: Filter setting
    • internal/resource/testdata/schemas/deployment.json - Reason: Filter setting
    • internal/resource/testdata/schemas/pod.json - Reason: Filter setting
    • internal/resource/testdata/schemas/service.json - Reason: Filter setting
  • Tools
    • Whispers (Secret Scanner) - ✔︎ Successful
    • Detect-secrets (Secret Scanner) - ✔︎ Successful
    • Golangci-lint (Linter) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

  • /review - Manually triggers a full AI review.

  • /pause - Pauses automatic reviews on this pull request.

  • /resume - Resumes automatic reviews.

  • /resolve - Marks all Bito-posted review comments as resolved.

  • /abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Default Agent You can customize the agent settings here or contact your Bito workspace admin at ilya.lesikov@flant.com.

Documentation & Help

AI Code Review powered by Bito Logo

@bito-code-review
Copy link

bito-code-review bot commented Jan 30, 2026

Code Review Agent Run #af241c

Actionable Suggestions - 0
Review Details
  • Files reviewed - 12 · Commit Range: ba4d694..d0668ea
    • cmd/nelm/common_flags.go
    • go.mod
    • go.sum
    • internal/resource/helpers_ai_test.go
    • internal/resource/kubeconform.go
    • internal/resource/kubeconform_ai_test.go
    • internal/resource/validate.go
    • internal/resource/validate_ai_test.go
    • internal/util/http.go
    • pkg/common/common.go
    • pkg/common/options.go
    • pkg/log/logger.go
  • Files skipped - 4
    • internal/resource/testdata/schemas/configmap.json - Reason: Filter setting
    • internal/resource/testdata/schemas/deployment.json - Reason: Filter setting
    • internal/resource/testdata/schemas/pod.json - Reason: Filter setting
    • internal/resource/testdata/schemas/service.json - Reason: Filter setting
  • Tools
    • Whispers (Secret Scanner) - ✔︎ Successful
    • Detect-secrets (Secret Scanner) - ✔︎ Successful
    • Golangci-lint (Linter) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

  • /review - Manually triggers a full AI review.

  • /pause - Pauses automatic reviews on this pull request.

  • /resume - Resumes automatic reviews.

  • /resolve - Marks all Bito-posted review comments as resolved.

  • /abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Default Agent You can customize the agent settings here or contact your Bito workspace admin at ilya.lesikov@flant.com.

Documentation & Help

AI Code Review powered by Bito Logo

@drey drey merged commit 53505d1 into main Feb 2, 2026
7 checks passed
@drey drey deleted the feat/enchanced-resource-validation branch February 2, 2026 07:09
@bito-code-review
Copy link

Bito Automatic Review Skipped – PR Already Merged

Bito scheduled an automatic review for this pull request, but the review was skipped because this PR was merged before the review could be run.
No action is needed if you didn't intend to review it. To get a review, you can type /review in a comment and save it

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants