[ompushkara]

No description provided.

[qodo-for-securesign]

PR Summary by Qodo

Harden CI and E2E GitHub Actions workflows

⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Limit CI token permissions and prevent checkout from storing credentials across both workflows.
• Pass E2E inputs through environment variables to avoid shell injection.
• Validate operator image names and fail early when E2E commands fail.

Diagram

graph TD
  CI["CI jobs"] --> Token["Read-only token"] --> Checkout["Credential-free checkout"]
  E2E["E2E job"] --> Image{"Image supplied?"} -->|yes| Pull["Validate and pull"] --> Deploy["Deploy and test"]
  Image -->|no| Build["Build image"] --> Deploy
  E2E --> Checkout

Loading

High-Level Assessment

Keep the workflow-level permission restriction and credential-free checkouts: they directly reduce token exposure. Passing dynamic values through environment variables rather than interpolating them into shell scripts is appropriate here; no additional abstraction is warranted for two workflows.

Files changed (2) +39 / -13

Other (2) +39 / -13

ci.ymlRestrict CI token access and checkout credentials +7/-0

Restrict CI token access and checkout credentials

• Sets workflow permissions to read-only repository contents. Disables credential persistence for both lint and unit-test checkouts.

.github/workflows/ci.yml

e2e.ymlProtect E2E checkouts and shell inputs +32/-13

Protect E2E checkouts and shell inputs

• Disables credential persistence for both checkouts and moves image and OIDC values out of inline shell interpolation. Validates supplied image names, quotes shell variables, and enables strict shell error handling in affected steps.

.github/workflows/e2e.yml

[qodo-for-securesign]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. End-to-end tests stop before running ✓ Resolved

Description

Run E2E tests enables set -u before sourcing tas-env-variables.sh, which reads
OIDC_CLIENT_ID before assigning its default. Because the workflow does not set that variable,
sourcing the script exits with an unbound-variable error before Playwright installation or the tests
run.

Code

.github/workflows/e2e.yml[156]

+          set -euo pipefail

Relevance

●●● Strong

Concrete workflow blocker; prior E2E failure fixes show the team accepts deterministic test-stopping
bugs.

PR-#99
PR-#75

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The E2E step defines no OIDC_CLIENT_ID, enables nounset, and then sources the script. The script
expands $OIDC_CLIENT_ID in its condition before it can assign the default.

.github/workflows/e2e.yml[150-167]
tas-env-variables.sh[7-9]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The E2E step enables nounset, but the sourced script reads `OIDC_CLIENT_ID` before assigning its default, so the step exits before running tests.

## Fix Focus Areas
- .github/workflows/e2e.yml[150-167]
- tas-env-variables.sh[7-9]

## Recommended Fix
Change the script's default check to use `${OIDC_CLIENT_ID:-}` so an unset variable does not fail under `set -u`. Keep the existing default value and verify the E2E step can source the script without defining `OIDC_CLIENT_ID`.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context sources

✅ Cross-repo context — repo relationships

  Explored: repo: securesign/secure-sign-operator (sha: 65aaabf9) — View relationship

Review mode: Auto: ⚖️ Balanced: Security-sensitive workflow changes require careful single-pass review.

Tip of the day

💡 Did you know, you can turn these tips off under Display > Comment parts

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗