NO-JIRA: Convert Claude commands to agentskills.io skill format for harness portability#9062
NO-JIRA: Convert Claude commands to agentskills.io skill format for harness portability#9062jhjaggars wants to merge 1 commit into
Conversation
Convert commands to the agentskills.io SKILL.md format for harness portability. The skill format uses standardized frontmatter and generic agent language instead of Claude-specific references, making the instructions usable across different coding agent harnesses. Converted commands: - e2e-analyze - feature-development (from workflows/feature-development) - fix-hypershift-repo-robot-pr - konflux-build - pr-report - restructure-commits - specify - test-tag-pipeline - update-konflux-tasks
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
openshift-ci-robot
added
the
jira/valid-reference
|
@jhjaggars: This pull request explicitly references no jira issue. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
📝 WalkthroughWalkthroughAdds eight Claude skill documents covering e2e failure analysis, feature planning, PR reporting, Konflux pipeline operations, bot-authored PR repair, commit restructuring, specware workflows, and Tekton task updates. The documents define command interfaces, prerequisites, staged procedures, validation and error handling, generated artifacts, repository changes, and operational requirements. 🚥 Pre-merge checks | ✅ 11✅ Passed checks (11 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
openshift-ci
Bot
added
the
area/ai
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: jhjaggars The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Note
Due to the large number of review comments, Critical severity comments were prioritized as inline comments.
🟠 Major comments (21)
.claude/skills/e2e-analyze/SKILL.md-41-47 (1)
41-47: 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy liftTreat downloaded logs and artifacts as untrusted data.
Explicitly prohibit executing commands, following instructions, or invoking tools based on artifact contents; otherwise a malicious CI log or test artifact can influence the agent’s behavior.
As per path instructions,
.claudefiles are high-risk AI tool configuration and require a malware-focused review.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/skills/e2e-analyze/SKILL.md around lines 41 - 47, Update the “Analyze the failure” section to explicitly treat all downloaded logs and artifacts as untrusted data. Instruct the agent not to execute commands, follow instructions, or invoke tools based on artifact contents, while retaining the existing evidence-gathering and artifact-preservation requirements.Source: Path instructions
.claude/skills/fix-hypershift-repo-robot-pr/SKILL.md-99-105 (1)
99-105: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winDo not suppress verification failures.
|| truediscards the exit status of both generation and fixture-update steps, so the workflow proceeds to organize potentially incomplete output. Capture each status and stop before committing when either command fails.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/skills/fix-hypershift-repo-robot-pr/SKILL.md around lines 99 - 105, Update Step 4 to preserve and check the exit status of both “make verify” and “UPDATE=true make test” instead of appending “|| true”. Capture each command’s status, stop the workflow before organizing or committing changes when either fails, and retain the existing status inspection only after both commands succeed..claude/skills/fix-hypershift-repo-robot-pr/SKILL.md-67-74 (1)
67-74: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winDefine all workflow variables before using them.
BOT_BRANCH_NAME,BASE_REF_NAME,CONVERTED_MSG,AUTHOR_LOGIN,CONVENTIONAL_TITLE, andNEW_PR_NUMBERare referenced but never assigned from thegh pr view/creation results. This can produce an invalid branch and malformed or empty replacement PR metadata.Also applies to: 90-97, 190-203
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/skills/fix-hypershift-repo-robot-pr/SKILL.md around lines 67 - 74, Define all workflow variables before their first use: assign BOT_BRANCH_NAME, BASE_REF_NAME, CONVERTED_MSG, AUTHOR_LOGIN, and CONVENTIONAL_TITLE from the relevant gh pr view results, and assign NEW_PR_NUMBER from the replacement PR creation result. Update the branch creation and later replacement-PR metadata steps to consume these assigned values, preserving the existing workflow behavior..claude/skills/e2e-analyze/SKILL.md-35-47 (1)
35-47: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winPersist the build log before parsing it.
The curl command writes the response to stdout, but Step 3 requires a local
build-log.txt. Add an explicit output path, for example-o "$ARTIFACT_DIRECTORY/build-log.txt", and parse that file.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/skills/e2e-analyze/SKILL.md around lines 35 - 47, Update the curl command in the build-log retrieval section to save its response to "$ARTIFACT_DIRECTORY/build-log.txt" using an explicit output option, then ensure the Step 3 analysis parses that persisted file rather than stdout or an unspecified path. Preserve the existing retry, timeout, protocol, and size limits..claude/skills/e2e-analyze/SKILL.md-27-38 (1)
27-38: 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy liftRestrict CI URLs to trusted hosts before fetching.
HTTPS-only validation still allows arbitrary hosts, and
-Lfollows redirects. A crafted URL can make the agent fetch attacker-controlled or internal resources. Parse the URL, allowlist the expected CI domains and paths, and validate redirect targets.As per path instructions,
.claudefiles are high-risk AI tool configuration and require scrutiny of broad network access.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/skills/e2e-analyze/SKILL.md around lines 27 - 38, Restrict the CI URL handling in the e2e analysis instructions to an explicit allowlist of trusted CI hostnames and the expected build-log path before invoking curl. Validate every redirect target against the same HTTPS host and path rules, or disable redirects if they are unnecessary; reject arbitrary hosts, paths, and schemes while preserving the existing build-number validation.Source: Path instructions
.claude/skills/fix-hypershift-repo-robot-pr/SKILL.md-145-157 (1)
145-157: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winStage an explicit allowlist instead of
git add -A.This can commit unexpected files produced by tooling, including secrets or unrelated user changes; the later untracked-file check is too late because
git add -Aalready staged them. Enumerate and review generated paths before committing.As per path instructions,
.claudefiles are high-risk AI configuration and require scrutiny of broad filesystem access.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/skills/fix-hypershift-repo-robot-pr/SKILL.md around lines 145 - 157, Replace the git add -A command in the “Other code changes” instructions with an explicit allowlist workflow: enumerate generated paths, review them (especially high-risk .claude files), and stage only the approved files before committing. Move the untracked-file check before staging and ensure unexpected files, secrets, and unrelated user changes are excluded.Source: Path instructions
.claude/skills/pr-report/SKILL.md-112-126 (1)
112-126: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winAlign Jira environment-variable documentation with the implementation.
The implementation also accepts
JIRA_API_TOKEN,JIRA_USERNAME, andJIRA_EMAIL, but this procedure only recognizes theJIRA_EMAIL/JIRA_TOKENcombination. Users with the supported aliases can be sent down the wrong cache/manual-enrichment path.Also applies to: 356-363
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/skills/pr-report/SKILL.md around lines 112 - 126, Update the Jira environment-variable guidance in the cache/manual-enrichment procedure to recognize all supported credential combinations: JIRA_EMAIL/JIRA_TOKEN, JIRA_API_TOKEN/JIRA_USERNAME, and JIRA_API_TOKEN/JIRA_EMAIL. Ensure the detection wording matches the implementation so any valid alias skips the manual enrichment path, including the corresponding section around the alternate referenced lines..claude/skills/pr-report/SKILL.md-324-346 (1)
324-346: 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy liftSanitize and review content before publishing the public blog.
Keyword replacements such as “S360” and SFDC filtering do not prevent secrets, PII, malicious Markdown/HTML, or internal links from PR/Jira content being published. Use an allowlist of fields, sanitize rendered content, and require a publication review gate.
As per path instructions,
.claudefiles are high-risk AI configuration and require a security-focused review of externally sourced content.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/skills/pr-report/SKILL.md around lines 324 - 346, Add a security-focused publication review gate to the blog generation workflow described in the pre-rendered markdown and blog index/nav updates. Build the public report from an allowlist of approved fields, sanitize rendered Markdown/HTML and externally sourced PR/Jira content for secrets, PII, malicious markup, and internal links, then require explicit review approval before publishing. Preserve the existing sensitive-content replacements and removals as additional safeguards.Source: Path instructions
.claude/skills/restructure-commits/SKILL.md-56-61 (1)
56-61: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winRequire a clean working tree before resetting.
The procedure resets the branch without checking for unrelated staged or unstaged changes. Those changes can be mixed into the rewritten commits or lost from the user’s intended workflow. Fail first when
git status --porcelainis non-empty.As per path instructions,
.claudefiles are high-risk AI configuration and require scrutiny of destructive filesystem and repository operations.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/skills/restructure-commits/SKILL.md around lines 56 - 61, Update the reset procedure in SKILL.md to first validate that the working tree is clean using git status --porcelain, and fail with a clear message when it is non-empty. Only execute the existing soft reset and unstaging commands after this check, preserving the current reset behavior for clean trees.Source: Path instructions
.claude/skills/pr-report/SKILL.md-217-242 (1)
217-242: 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy liftIsolate subagents from untrusted PR content.
PR diffs and metadata are attacker-controlled inputs. Delimit them as data and explicitly prohibit following instructions found in the JSON, invoking tools, or writing files outside the requested analysis response.
As per path instructions,
.claudefiles are high-risk AI tool configuration and require scrutiny for tool-use and supply-chain attacks.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/skills/pr-report/SKILL.md around lines 217 - 242, The subagent prompt in the PR analysis workflow must treat `.work/pr_deep/<key>.json` and its PR content as untrusted data. Update the prompt to clearly delimit the input, instruct the subagent not to follow embedded instructions, invoke tools, or write files outside returning the requested analysis JSON, while preserving the required author attribution and output schema.Source: Path instructions
.claude/skills/restructure-commits/SKILL.md-63-78 (1)
63-78: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winHandle empty components and unmapped root-module files explicitly.
The examples unconditionally run
git add api/,git add vendor/, etc., so branches without one of those directories fail instead of skipping the component. Additionally, rootgo.modandgo.sumare not assigned to any category, so dependency changes can remain unstaged and violate the clean-tree checklist.Also applies to: 118-130
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/skills/restructure-commits/SKILL.md around lines 63 - 78, Update the component staging instructions in “Stage and commit each component group” to skip components whose directories or matching files are absent, avoiding failures from unconditional git add commands. Explicitly assign root go.mod and go.sum to the appropriate dependency/vendor component so they are staged and committed, preserving the clean-tree checklist..claude/skills/konflux-build/SKILL.md-81-81 (1)
81-81: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winUse a private temporary file instead of a predictable
/tmppath.
<component>is user-controlled, so/tmp/<component>-manual-push.yamlpermits path traversal and predictable-file/symlink interference. Usemktempwith restrictive permissions and clean it up afteroc create.As per path instructions,
.claudeskill changes require scrutiny of filesystem access.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/skills/konflux-build/SKILL.md at line 81, Update the manual push workflow documentation to replace the predictable `/tmp/<component>-manual-push.yaml` path with a private file created via mktemp using restrictive permissions. Ensure the temporary file is removed after the oc create operation, and avoid using the user-controlled component value directly in the filesystem path.Source: Path instructions
.claude/skills/update-konflux-tasks/SKILL.md-69-73 (1)
69-73: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winHandle both catalog registries during replacement.
Step 3 requires switching
quay.io/redhat-appstudio-tekton-catalog/references toquay.io/konflux-ci/tekton-catalog/, but Step 4 only replaces references already using the latter. Old-registry task references can therefore remain unchanged. Make detection and replacement explicitly cover both registries, then perform the registry migration before digest/version substitution.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/skills/update-konflux-tasks/SKILL.md around lines 69 - 73, Update the “Update Pipeline Files” instructions to detect task references from both quay.io/redhat-appstudio-tekton-catalog/ and quay.io/konflux-ci/tekton-catalog/. Perform the registry migration first, then apply the task version and digest substitutions so no old-registry references remain..claude/skills/update-konflux-tasks/SKILL.md-61-65 (1)
61-65: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winDo not automatically execute migration scripts fetched from
main.A remote migration script is executable code and can modify the repository or run arbitrary commands with the agent’s privileges. Pin it to a reviewed commit, verify its contents and checksum, constrain the allowed files, and require confirmation before execution—or apply the migration manually.
As per path instructions,
.claudeskill changes require scrutiny of scripts and network-sourced content.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/skills/update-konflux-tasks/SKILL.md around lines 61 - 65, Update the migration-script guidance in the task update instructions to prohibit automatic execution of scripts fetched from the remote main branch. Require pinning to a reviewed commit, inspecting and checksum-verifying contents, restricting file scope, and obtaining confirmation before execution; otherwise apply the migration manually. Keep the existing migration-note and script-discovery steps intact.Source: Path instructions
.claude/skills/test-tag-pipeline/SKILL.md-38-45 (1)
38-45: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winVerify the cluster and namespace, not just authentication.
oc whoamionly confirms that credentials exist. The skill then runs a mutating script while displaying URLs for the hard-codedstone-prd-rh01cluster andcrt-redhat-acm-tenantnamespace. Add checks foroc whoami --show-serverandoc project -q, and stop on mismatch, as.claude/skills/konflux-build/SKILL.mdalready does.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/skills/test-tag-pipeline/SKILL.md around lines 38 - 45, Update the cluster verification steps in the test-tag pipeline skill to validate both the server with oc whoami --show-server and the active namespace with oc project -q, not only authentication via oc whoami. Compare these values against the expected stone-prd-rh01 cluster and crt-redhat-acm-tenant namespace, stop execution on mismatch, and retain the existing login guidance for authentication failures..claude/skills/konflux-build/SKILL.md-108-113 (1)
108-113: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winPipelineRun monitoring needs bounded waits and terminal-state handling.
.claude/skills/konflux-build/SKILL.md#L108-L113: add a timeout and handle failure/cancellation/API errors..claude/skills/test-tag-pipeline/SKILL.md#L62-L65: replace the unbounded watch with bounded monitoring and explicit terminal-state handling.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/skills/konflux-build/SKILL.md around lines 108 - 113, Update PipelineRun monitoring in .claude/skills/konflux-build/SKILL.md lines 108-113 to use a bounded timeout, poll every 30 seconds, and explicitly handle successful, failed, cancelled, and API-error states before using the existing skopeo fallback for archived runs. Apply the same bounded monitoring and explicit terminal-state handling to .claude/skills/test-tag-pipeline/SKILL.md lines 62-65, replacing its unbounded watch..claude/skills/konflux-build/SKILL.md-51-64 (1)
51-64: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winUntrusted values are interpolated into agent-executed shell commands. Validate and shell-quote all PR, ref, pipeline-file, component, tag, and branch inputs; restrict paths and use safe positional argument passing.
.claude/skills/konflux-build/SKILL.md#L51-L64: protect PR/base-ref/pipeline-file values..claude/skills/konflux-build/SKILL.md#L73-L80: protect template substitutions and component-derived paths..claude/skills/test-tag-pipeline/SKILL.md#L49-L54: protect tag and branch-spec values.As per path instructions,
.claudeskill changes require close scrutiny of command execution.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/skills/konflux-build/SKILL.md around lines 51 - 64, Untrusted inputs are interpolated into agent-executed shell commands; validate allowed formats and pass values safely as positional arguments or shell-quoted parameters throughout the affected command flows. In .claude/skills/konflux-build/SKILL.md lines 51-64, protect PR, ref, and pipeline-file values; in lines 73-80, protect template substitutions and component-derived paths; and in .claude/skills/test-tag-pipeline/SKILL.md lines 49-54, protect tag and branch-spec values. Use path and branch validation to prevent unintended command or file access.Source: Path instructions
.claude/skills/specify/SKILL.md-21-27 (1)
21-27: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winHandle existing short names before creating a new feature.
The input contract says a short name resumes an existing feature, but Phase 1 always runs
specware feature new-requirements <short-name>. Detect an existing feature and resume it; only create a new requirements directory for feature-description input.Also applies to: 48-50
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/skills/specify/SKILL.md around lines 21 - 27, Update the Phase 1 flow in the skill instructions to distinguish short-name inputs from feature-description inputs before invoking feature creation. Detect whether the supplied short name matches an existing feature and resume that feature; invoke feature new-requirements only for new feature-description input, while preserving clarification for ambiguous input..claude/skills/specify/SKILL.md-67-70 (1)
67-70: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winRestrict web research to non-sensitive queries.
The workflow directs the agent to research repository-specific topics but does not prohibit sending source snippets, internal paths, credentials, or PII to external search services. Add an explicit rule to use only generic/public queries and redact repository-sensitive information.
As per path instructions,
.claudeskill changes require close scrutiny of network access and potential data exposure.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/skills/specify/SKILL.md around lines 67 - 70, Update the research guidance in the SKILL.md workflow to explicitly restrict web searches to generic, publicly safe queries. Instruct agents to omit or redact source snippets, internal paths, credentials, PII, and other repository-sensitive information before using external search services, while preserving repository-local research and context-requirements.md documentation.Source: Path instructions
.claude/skills/feature-development/SKILL.md-12-13 (1)
12-13: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winDo not promise deployment without a deployment stage.
The skill says it progresses “through to deployment,” but the workflow ends at architect review and result aggregation; it never deploys, rolls back, or verifies a deployment. Add an explicit deployment/validation stage or change the description to stop at implementation and review.
Also applies to: 76-83
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/skills/feature-development/SKILL.md around lines 12 - 13, Update the feature-development skill description and workflow so they have matching scope: either add an explicit deployment stage after architect review that deploys, validates, and rolls back on failure, or revise the description to end at implementation and review. Ensure the related workflow section and result aggregation no longer imply deployment unless those deployment and validation steps are actually defined..claude/skills/specify/SKILL.md-49-50 (1)
49-50: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winNormalize
<short-name>before using it in these commands.
It’s derived from user input and reused across multiple shell invocations, so reject anything outside a strict slug like[a-z0-9-]+and pass it as a single argument rather than interpolating it into a shell string.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/skills/specify/SKILL.md around lines 49 - 50, Normalize the generated short-name before the feature workflow commands in the skill instructions: derive a strict lowercase slug containing only letters, numbers, and hyphens, reject invalid or empty values, and pass it as one argument to `specware feature new-requirements` rather than interpolating it into shell command strings.Source: Path instructions
🟡 Minor comments (4)
.claude/skills/pr-report/SKILL.md-102-108 (1)
102-108: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winQuote user-derived shell arguments.
$OUTPUT_DIRis explicitly user-selected, so an output path containing spaces is split into multiple arguments. Quote all variables, e.g."$SINCE_DATE","$END_DATE", and"$OUTPUT_DIR".🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/skills/pr-report/SKILL.md around lines 102 - 108, Update the Step 1 command to quote all user-derived shell variables, including SINCE_DATE, END_DATE, and OUTPUT_DIR, so values containing spaces remain single arguments; preserve the existing optional --blog-data behavior..claude/skills/e2e-analyze/SKILL.md-16-16 (1)
16-16: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winAdd languages to all fenced code blocks.
.claude/skills/e2e-analyze/SKILL.md#L16-L16: label the usage fence, e.g.text..claude/skills/pr-report/SKILL.md#L18-L18: label the usage fence, e.g.text..claude/skills/pr-report/SKILL.md#L220-L220: label the embedded JSON example, e.g.json..claude/skills/fix-hypershift-repo-robot-pr/SKILL.md#L17-L17: label the usage fence..claude/skills/fix-hypershift-repo-robot-pr/SKILL.md#L60-L60: label the error-output fence..claude/skills/fix-hypershift-repo-robot-pr/SKILL.md#L170-L170: label the failure-output fence..claude/skills/restructure-commits/SKILL.md#L17-L17,.claude/skills/restructure-commits/SKILL.md#L60-L60, and.claude/skills/restructure-commits/SKILL.md#L170-L170: label the usage and output fences.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/skills/e2e-analyze/SKILL.md at line 16, Add language identifiers to every listed fenced code block: label the usage fence in .claude/skills/e2e-analyze/SKILL.md:16-16; the usage and embedded JSON fences in .claude/skills/pr-report/SKILL.md:18-18 and :220-220; the usage, error-output, and failure-output fences in .claude/skills/fix-hypershift-repo-robot-pr/SKILL.md:17-17, :60-60, and :170-170; and the corresponding usage and output fences in .claude/skills/restructure-commits/SKILL.md:17-17, :60-60, and :170-170. Use text for prose/output examples and json for the embedded JSON example.Source: Linters/SAST tools
.claude/skills/konflux-build/SKILL.md-17-17 (1)
17-17: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winAdd language identifiers to every flagged fenced block.
.claude/skills/konflux-build/SKILL.md#L17-L17,.claude/skills/konflux-build/SKILL.md#L27-L27,.claude/skills/konflux-build/SKILL.md#L39-L39,.claude/skills/konflux-build/SKILL.md#L43-L43,.claude/skills/konflux-build/SKILL.md#L117-L117: usetextorbashas appropriate..claude/skills/test-tag-pipeline/SKILL.md#L17-L17,.claude/skills/test-tag-pipeline/SKILL.md#L28-L28: usetext..claude/skills/update-konflux-tasks/SKILL.md#L17-L17,.claude/skills/update-konflux-tasks/SKILL.md#L25-L25: usetext.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/skills/konflux-build/SKILL.md at line 17, Add language identifiers to every flagged fenced code block: use text or bash as appropriate in .claude/skills/konflux-build/SKILL.md at lines 17, 27, 39, 43, and 117; use text in .claude/skills/test-tag-pipeline/SKILL.md at lines 17 and 28; and use text in .claude/skills/update-konflux-tasks/SKILL.md at lines 17 and 25.Source: Linters/SAST tools
.claude/skills/specify/SKILL.md-110-117 (1)
110-117: 🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick winUse one canonical path for technical specs. Phase 2 writes to a generic “spec sub-directory,” but
.spec/<feature>/doesn’t define one. Make the destination explicit and have later phases read from that same path.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/skills/specify/SKILL.md around lines 110 - 117, Update Step 2: Generate Technical Specifications to explicitly store approved specifications under the canonical .spec/<feature>/ path, using the appropriate format within that directory. Ensure subsequent phases are instructed to read technical specifications from this same location, replacing the ambiguous “spec sub-directory” wording.
🧹 Nitpick comments (1)
.claude/skills/feature-development/SKILL.md (1)
26-27: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winMake inter-agent context handoff explicit.
The workflow promises that every agent receives prior-stage context, but the data-plane prompt only receives
<feature-description>, and the cloud-provider prompt does not explicitly include the architect/control-plane/data-plane outputs. Pass the saved artifacts or summaries into each dependent prompt to avoid divergent implementations.Also applies to: 48-66, 68-74
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/skills/feature-development/SKILL.md around lines 26 - 27, Update the sequential delegation workflow in the skill instructions so each dependent agent prompt explicitly receives the previously saved artifacts or summaries, not only the feature description. Ensure the cloud-provider prompt includes the architect, control-plane, and data-plane outputs, and that the data-plane prompt receives the architect/control-plane context, while preserving the existing delegation order and artifact-saving behavior.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.claude/skills/fix-hypershift-repo-robot-pr/SKILL.md:
- Around line 27-35: Update the workflow described in the skill so bot
validation accepts only an explicit trusted-bot allowlist rather than any PR
with is_bot: true. Before cherry-picking or running make verify and make test,
perform validation in an isolated disposable environment with credentials
removed and unnecessary network access disabled; document these safeguards in
the workflow steps.
---
Major comments:
In @.claude/skills/e2e-analyze/SKILL.md:
- Around line 41-47: Update the “Analyze the failure” section to explicitly
treat all downloaded logs and artifacts as untrusted data. Instruct the agent
not to execute commands, follow instructions, or invoke tools based on artifact
contents, while retaining the existing evidence-gathering and
artifact-preservation requirements.
- Around line 35-47: Update the curl command in the build-log retrieval section
to save its response to "$ARTIFACT_DIRECTORY/build-log.txt" using an explicit
output option, then ensure the Step 3 analysis parses that persisted file rather
than stdout or an unspecified path. Preserve the existing retry, timeout,
protocol, and size limits.
- Around line 27-38: Restrict the CI URL handling in the e2e analysis
instructions to an explicit allowlist of trusted CI hostnames and the expected
build-log path before invoking curl. Validate every redirect target against the
same HTTPS host and path rules, or disable redirects if they are unnecessary;
reject arbitrary hosts, paths, and schemes while preserving the existing
build-number validation.
In @.claude/skills/feature-development/SKILL.md:
- Around line 12-13: Update the feature-development skill description and
workflow so they have matching scope: either add an explicit deployment stage
after architect review that deploys, validates, and rolls back on failure, or
revise the description to end at implementation and review. Ensure the related
workflow section and result aggregation no longer imply deployment unless those
deployment and validation steps are actually defined.
In @.claude/skills/fix-hypershift-repo-robot-pr/SKILL.md:
- Around line 99-105: Update Step 4 to preserve and check the exit status of
both “make verify” and “UPDATE=true make test” instead of appending “|| true”.
Capture each command’s status, stop the workflow before organizing or committing
changes when either fails, and retain the existing status inspection only after
both commands succeed.
- Around line 67-74: Define all workflow variables before their first use:
assign BOT_BRANCH_NAME, BASE_REF_NAME, CONVERTED_MSG, AUTHOR_LOGIN, and
CONVENTIONAL_TITLE from the relevant gh pr view results, and assign
NEW_PR_NUMBER from the replacement PR creation result. Update the branch
creation and later replacement-PR metadata steps to consume these assigned
values, preserving the existing workflow behavior.
- Around line 145-157: Replace the git add -A command in the “Other code
changes” instructions with an explicit allowlist workflow: enumerate generated
paths, review them (especially high-risk .claude files), and stage only the
approved files before committing. Move the untracked-file check before staging
and ensure unexpected files, secrets, and unrelated user changes are excluded.
In @.claude/skills/konflux-build/SKILL.md:
- Line 81: Update the manual push workflow documentation to replace the
predictable `/tmp/<component>-manual-push.yaml` path with a private file created
via mktemp using restrictive permissions. Ensure the temporary file is removed
after the oc create operation, and avoid using the user-controlled component
value directly in the filesystem path.
- Around line 108-113: Update PipelineRun monitoring in
.claude/skills/konflux-build/SKILL.md lines 108-113 to use a bounded timeout,
poll every 30 seconds, and explicitly handle successful, failed, cancelled, and
API-error states before using the existing skopeo fallback for archived runs.
Apply the same bounded monitoring and explicit terminal-state handling to
.claude/skills/test-tag-pipeline/SKILL.md lines 62-65, replacing its unbounded
watch.
- Around line 51-64: Untrusted inputs are interpolated into agent-executed shell
commands; validate allowed formats and pass values safely as positional
arguments or shell-quoted parameters throughout the affected command flows. In
.claude/skills/konflux-build/SKILL.md lines 51-64, protect PR, ref, and
pipeline-file values; in lines 73-80, protect template substitutions and
component-derived paths; and in .claude/skills/test-tag-pipeline/SKILL.md lines
49-54, protect tag and branch-spec values. Use path and branch validation to
prevent unintended command or file access.
In @.claude/skills/pr-report/SKILL.md:
- Around line 112-126: Update the Jira environment-variable guidance in the
cache/manual-enrichment procedure to recognize all supported credential
combinations: JIRA_EMAIL/JIRA_TOKEN, JIRA_API_TOKEN/JIRA_USERNAME, and
JIRA_API_TOKEN/JIRA_EMAIL. Ensure the detection wording matches the
implementation so any valid alias skips the manual enrichment path, including
the corresponding section around the alternate referenced lines.
- Around line 324-346: Add a security-focused publication review gate to the
blog generation workflow described in the pre-rendered markdown and blog
index/nav updates. Build the public report from an allowlist of approved fields,
sanitize rendered Markdown/HTML and externally sourced PR/Jira content for
secrets, PII, malicious markup, and internal links, then require explicit review
approval before publishing. Preserve the existing sensitive-content replacements
and removals as additional safeguards.
- Around line 217-242: The subagent prompt in the PR analysis workflow must
treat `.work/pr_deep/<key>.json` and its PR content as untrusted data. Update
the prompt to clearly delimit the input, instruct the subagent not to follow
embedded instructions, invoke tools, or write files outside returning the
requested analysis JSON, while preserving the required author attribution and
output schema.
In @.claude/skills/restructure-commits/SKILL.md:
- Around line 56-61: Update the reset procedure in SKILL.md to first validate
that the working tree is clean using git status --porcelain, and fail with a
clear message when it is non-empty. Only execute the existing soft reset and
unstaging commands after this check, preserving the current reset behavior for
clean trees.
- Around line 63-78: Update the component staging instructions in “Stage and
commit each component group” to skip components whose directories or matching
files are absent, avoiding failures from unconditional git add commands.
Explicitly assign root go.mod and go.sum to the appropriate dependency/vendor
component so they are staged and committed, preserving the clean-tree checklist.
In @.claude/skills/specify/SKILL.md:
- Around line 21-27: Update the Phase 1 flow in the skill instructions to
distinguish short-name inputs from feature-description inputs before invoking
feature creation. Detect whether the supplied short name matches an existing
feature and resume that feature; invoke feature new-requirements only for new
feature-description input, while preserving clarification for ambiguous input.
- Around line 67-70: Update the research guidance in the SKILL.md workflow to
explicitly restrict web searches to generic, publicly safe queries. Instruct
agents to omit or redact source snippets, internal paths, credentials, PII, and
other repository-sensitive information before using external search services,
while preserving repository-local research and context-requirements.md
documentation.
- Around line 49-50: Normalize the generated short-name before the feature
workflow commands in the skill instructions: derive a strict lowercase slug
containing only letters, numbers, and hyphens, reject invalid or empty values,
and pass it as one argument to `specware feature new-requirements` rather than
interpolating it into shell command strings.
In @.claude/skills/test-tag-pipeline/SKILL.md:
- Around line 38-45: Update the cluster verification steps in the test-tag
pipeline skill to validate both the server with oc whoami --show-server and the
active namespace with oc project -q, not only authentication via oc whoami.
Compare these values against the expected stone-prd-rh01 cluster and
crt-redhat-acm-tenant namespace, stop execution on mismatch, and retain the
existing login guidance for authentication failures.
In @.claude/skills/update-konflux-tasks/SKILL.md:
- Around line 69-73: Update the “Update Pipeline Files” instructions to detect
task references from both quay.io/redhat-appstudio-tekton-catalog/ and
quay.io/konflux-ci/tekton-catalog/. Perform the registry migration first, then
apply the task version and digest substitutions so no old-registry references
remain.
- Around line 61-65: Update the migration-script guidance in the task update
instructions to prohibit automatic execution of scripts fetched from the remote
main branch. Require pinning to a reviewed commit, inspecting and
checksum-verifying contents, restricting file scope, and obtaining confirmation
before execution; otherwise apply the migration manually. Keep the existing
migration-note and script-discovery steps intact.
---
Minor comments:
In @.claude/skills/e2e-analyze/SKILL.md:
- Line 16: Add language identifiers to every listed fenced code block: label the
usage fence in .claude/skills/e2e-analyze/SKILL.md:16-16; the usage and embedded
JSON fences in .claude/skills/pr-report/SKILL.md:18-18 and :220-220; the usage,
error-output, and failure-output fences in
.claude/skills/fix-hypershift-repo-robot-pr/SKILL.md:17-17, :60-60, and
:170-170; and the corresponding usage and output fences in
.claude/skills/restructure-commits/SKILL.md:17-17, :60-60, and :170-170. Use
text for prose/output examples and json for the embedded JSON example.
In @.claude/skills/konflux-build/SKILL.md:
- Line 17: Add language identifiers to every flagged fenced code block: use text
or bash as appropriate in .claude/skills/konflux-build/SKILL.md at lines 17, 27,
39, 43, and 117; use text in .claude/skills/test-tag-pipeline/SKILL.md at lines
17 and 28; and use text in .claude/skills/update-konflux-tasks/SKILL.md at lines
17 and 25.
In @.claude/skills/pr-report/SKILL.md:
- Around line 102-108: Update the Step 1 command to quote all user-derived shell
variables, including SINCE_DATE, END_DATE, and OUTPUT_DIR, so values containing
spaces remain single arguments; preserve the existing optional --blog-data
behavior.
In @.claude/skills/specify/SKILL.md:
- Around line 110-117: Update Step 2: Generate Technical Specifications to
explicitly store approved specifications under the canonical .spec/<feature>/
path, using the appropriate format within that directory. Ensure subsequent
phases are instructed to read technical specifications from this same location,
replacing the ambiguous “spec sub-directory” wording.
---
Nitpick comments:
In @.claude/skills/feature-development/SKILL.md:
- Around line 26-27: Update the sequential delegation workflow in the skill
instructions so each dependent agent prompt explicitly receives the previously
saved artifacts or summaries, not only the feature description. Ensure the
cloud-provider prompt includes the architect, control-plane, and data-plane
outputs, and that the data-plane prompt receives the architect/control-plane
context, while preserving the existing delegation order and artifact-saving
behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 063439fa-3409-45bf-bfb0-90f156196053
📒 Files selected for processing (9)
.claude/skills/e2e-analyze/SKILL.md.claude/skills/feature-development/SKILL.md.claude/skills/fix-hypershift-repo-robot-pr/SKILL.md.claude/skills/konflux-build/SKILL.md.claude/skills/pr-report/SKILL.md.claude/skills/restructure-commits/SKILL.md.claude/skills/specify/SKILL.md.claude/skills/test-tag-pipeline/SKILL.md.claude/skills/update-konflux-tasks/SKILL.md
| 1. Validates the PR is authored by a bot (`is_bot: true`) | ||
| 2. Fetches the bot's PR commits | ||
| 3. Creates a new branch `fix/<original-branch-name>` from the base branch | ||
| 4. Cherry-picks commits and converts to conventional commit format | ||
| 5. Runs `make verify` to regenerate all necessary files | ||
| 6. Runs `UPDATE=true make test` to update test fixtures | ||
| 7. Organizes changes into logical, well-structured commits | ||
| 8. Runs `make verify` and `make test` for final validation | ||
| 9. If successful: creates new PR and closes/comments on original |
There was a problem hiding this comment.
🔒 Security & Privacy | 🔴 Critical | 🏗️ Heavy lift
Do not run arbitrary bot PR code on a privileged workspace.
is_bot: true accepts any bot identity, then the workflow cherry-picks its changes and executes repository-controlled make verify and make test. Use a trusted-bot allowlist and run validation in an isolated, disposable environment without credentials or unnecessary network access.
As per path instructions, .claude files are high-risk AI configuration and require scrutiny of scripts, filesystem access, and supply-chain attacks.
Also applies to: 99-105
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.claude/skills/fix-hypershift-repo-robot-pr/SKILL.md around lines 27 - 35,
Update the workflow described in the skill so bot validation accepts only an
explicit trusted-bot allowlist rather than any PR with is_bot: true. Before
cherry-picking or running make verify and make test, perform validation in an
isolated disposable environment with credentials removed and unnecessary network
access disabled; document these safeguards in the workflow steps.
Source: Path instructions
|
@jhjaggars: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #9062 +/- ##
==========================================
+ Coverage 43.50% 44.44% +0.93%
==========================================
Files 771 781 +10
Lines 95722 98705 +2983
==========================================
+ Hits 41648 43868 +2220
- Misses 51174 51758 +584
- Partials 2900 3079 +179 see 97 files with indirect coverage changes
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
2 participants
Summary
Convert all Claude Code commands from
.claude/commands/to the agentskills.io SKILL.md format under.claude/skills/. This enables harness portability — the skill format uses standardized frontmatter and generic agent language instead of Claude-specific references, making the instructions usable across different coding agent harnesses.Converted Commands
e2e-analyze.md.claude/skills/e2e-analyze/SKILL.mdfix-hypershift-repo-robot-pr.md.claude/skills/fix-hypershift-repo-robot-pr/SKILL.mdkonflux-build.md.claude/skills/konflux-build/SKILL.mdpr-report.md.claude/skills/pr-report/SKILL.mdrestructure-commits.md.claude/skills/restructure-commits/SKILL.mdspecify.md.claude/skills/specify/SKILL.mdtest-tag-pipeline.md.claude/skills/test-tag-pipeline/SKILL.mdupdate-konflux-tasks.md.claude/skills/update-konflux-tasks/SKILL.mdworkflows/feature-development.md.claude/skills/feature-development/SKILL.mdWhat Changed
name(validated: lowercase, hyphens, ≤64 chars) anddescription(≤1024 chars, includes when-to-use guidance)allowed-tools,model,user_invocable,argument-hint$ARGUMENTS,{{args.0}}) with documented usage/argument sectionsSummary by CodeRabbit