LCORE-5106: regenerated rpm lock yaml for lightspeed stack (0.8.0rc1) by snuryyeva · Pull Request #3025 · lightspeed-core/lightspeed-stack

snuryyeva · 2026-10-26T17:25:42Z

Description

Type of change

Tools used to create PR

Identify any AI code assistants used in this PR (for transparency and review context)

Assisted-by: (e.g., Claude, CodeRabbit, Ollama, etc., N/A if not used)
Generated by: (e.g., tool name and version; N/A if not used)

Related Tickets & Documents

Related Issue #
Closes #

Checklist before requesting a review

I have performed a self-review of my code.
PR has passed all pre-merge test jobs.
If it is a core feature, I have added thorough tests.

Testing

Please provide detailed steps to perform tests related to this code change.
How were the fix/results from this change verified? Please provide relevant screenshots or results.

Summary by CodeRabbit

Chores
- Updated the base images used for build and runtime environments.
- Removed Python packages from the configured package set for supported architectures.
- Added the Brotli library to the configured package set for supported architectures.

coderabbitai · 2026-10-26T17:26:01Z

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

Run configuration

Source mode: Auto
Repository: lightspeed-core/lightspeed-stack
Branch: main
File: .coderabbit.yaml
Commit: 401a7b5
Layers: Repository YAML
Review profile: ASSERTIVE
Plan: Advanced
Run ID: e7e9961a-334a-4dfa-89b5-ee8636654d25

Commits

Reviewing files that changed from the base of the PR and between a4243f3 and e86464c.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

No actionable comments were generated in the recent review.

Recent review info

Run configuration

Source mode: Auto
Repository: lightspeed-core/lightspeed-stack
Branch: main
File: .coderabbit.yaml
Commit: c79135e
Layers: Repository YAML
Review profile: ASSERTIVE
Plan: Advanced
Run ID: c49adde7-d85c-4639-a2f3-309d0bfbe9da

Commits

Reviewing files that changed from the base of the PR and between 8eed9c5 and f2fb549.

Files selected for processing: 2

.konflux/rpms.in.yaml
.konflux/rpms.lock.yaml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Recent review details

Context from checks skipped due to timeout: 27

GitHub Check: Red Hat Konflux / sans-ogx / pr group
GitHub Check: Red Hat Konflux / lightspeed-core-0-8-enterprise-contract / pr group
GitHub Check: check_dependencies
GitHub Check: unit_tests (3.14)
GitHub Check: bandit
GitHub Check: unit_tests (3.13)
GitHub Check: integration_tests (3.12)
GitHub Check: spectral
GitHub Check: unit_tests (3.12)
GitHub Check: build-pr
GitHub Check: integration_tests (3.14)
GitHub Check: Pylinter
GitHub Check: list_outdated_dependencies
GitHub Check: shellcheck
GitHub Check: pydocstyle
GitHub Check: Pyright
GitHub Check: integration_tests (3.13)
GitHub Check: mypy
GitHub Check: black
GitHub Check: Red Hat Konflux / rag-content-0-8-e2e-tests / lightspeed-stack-0-8
GitHub Check: Red Hat Konflux / lightspeed-core-0-8-enterprise-contract / lightspeed-stack-0-8
GitHub Check: Red Hat Konflux / lightspeed-stack-0-8-e2e-tests / lightspeed-stack-0-8
GitHub Check: dispatch / Route
GitHub Check: dispatch / Harness dispatch
GitHub Check: Konflux kflux-prd-rh02 / lightspeed-stack-0-8-on-pull-request
GitHub Check: authorize / Check repository owner or member
GitHub Check: check

Additional comments: 2

.konflux/rpms.in.yaml: 1

12-12: LGTM!

.konflux/rpms.lock.yaml: 1

77-83: LGTM!

Also applies to: 158-164

Walkthrough

The Konflux build configuration updates the builder and runtime base images. It replaces python3 and python3-libs with libbrotli in the upgrade package list and RPM lockfile.

Changes

Konflux build inputs

Layer / File(s)	Summary
Base image tags `.konflux/build-args-konflux.conf`	The builder and runtime base image tags change to `cpu:3.5.5-1793042162`. The DNF command remains unchanged.
RPM package update `.konflux/rpms.in.yaml`, `.konflux/rpms.lock.yaml`	The upgrade package list and lockfile replace `python3` and `python3-libs` with `libbrotli` for `aarch64` and `x86_64`.

Priority: Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Possibly related PRs

lightspeed-core/lightspeed-stack#2998: This PR removes the same RPM packages from the upgrade list and both architecture-specific lock entries. It updates the base-image settings to different tags.

Suggested reviewers: tisnik, jrobertboos

Merge Risk: Minimal · previous review f2fb5

No concrete build, runtime, or package-locking issue was identified in the reviewed changes.

Pre-merge checks: 7

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly describes the RPM lockfile regeneration and identifies the relevant Lightspeed stack version. It matches the main package and lockfile changes, although it does not mention the base …
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Performance And Algorithmic Complexity		PASS. The pull request changes only Konflux image and RPM configuration. It replaces `python3`/`python3-libs` with `libbrotli` and updates the base image for two architectures. No handlers, loops, API…
Security And Secret Handling		PASSED. The pull request changes only Konflux image and RPM configuration. Added values are public image/package references and SHA-256 checksums. No plaintext secrets, tokens, API credentials, endpoi…

Full details: Title check

Explanation

The title clearly describes the RPM lockfile regeneration and identifies the relevant Lightspeed stack version. It matches the main package and lockfile changes, although it does not mention the base image update.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

Full details: Performance And Algorithmic Complexity

Explanation

PASS. The pull request changes only Konflux image and RPM configuration. It replaces python3/python3-libs with libbrotli and updates the base image for two architectures. No handlers, loops, API or database calls, list operations, caches, watchers, or unbounded buffers changed. No meaningful performance regression condition is introduced.

Full details: Security And Secret Handling

Explanation

PASSED. The pull request changes only Konflux image and RPM configuration. Added values are public image/package references and SHA-256 checksums. No plaintext secrets, tokens, API credentials, endpoints, injection vectors, sensitive response/logging code, or Kubernetes Secret resources were introduced.

Finishing Touches

🧪 Generate unit tests (beta)

Create a new PR

✨ Simplify code

Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

tisnik · 2026-10-27T08:03:10Z

/test

openshift-ci · 2026-10-27T08:03:14Z

@tisnik: No presubmit jobs available for lightspeed-core/lightspeed-stack@main

Details

In response to this:

/test

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

jrobertboos

This should be squashed into a single commit :) TY!

jrobertboos · 2026-10-29T16:24:39Z

/ok-to-test

tisnik

LGTM

fullsend-ai-retro · 2026-10-29T18:05:28Z

🤖 Finished Retro · ✅ Success · Started 6:05 PM UTC · Completed 6:12 PM UTC

Commit: e86464c · View workflow run →

Runtime: pi · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.03

fullsend-ai-retro · 2026-10-29T18:12:47Z

Retro for PR #3025 — Config-only CVE fix, no agent involvement.

PR #3025 was a human-authored CVE fix by snuryyeva that updated Konflux build configuration: base image tags and RPM lockfile changes (replacing python3/python3-libs with libbrotli). Three files changed, +15/−30 lines.

Workflow timeline:

PR created Oct 26. CodeRabbit skipped review (no reviewable source changes).
jrobertboos requested squashing into a single commit (Oct 29). Author complied.
jrobertboos approved, then tisnik approved with "LGTM". Merged Oct 29.

Agent activity: No fullsend review agent was dispatched — the routing correctly determined that review was not needed (PR author authorization gate). Retro was triggered on merge as expected. Eight fullsend workflow runs occurred, seven with all agents skipped — normal routing behavior for a PR that didn't meet dispatch criteria.

Assessment: The workflow operated correctly. The config-only changes were appropriately handled by human reviewers with minimal rework (one commit-squash request). No improvement opportunities identified.

jrobertboos changed the title ~~LCORE-5106: regenerated rpm lock yaml for lightspeed stack~~ LCORE-5106: regenerated rpm lock yaml for lightspeed stack (0.8.0rc1) Oct 26, 2026

jrobertboos requested changes Oct 29, 2026

View reviewed changes

LCORE-5106: fix CVEs and regenerate rpm lock

e86464c

snuryyeva force-pushed the snuryyeva/CVE_fix branch from a4243f3 to e86464c Compare October 29, 2026 15:52

snuryyeva requested a review from jrobertboos October 29, 2026 15:53

jrobertboos approved these changes Oct 29, 2026

View reviewed changes

openshift-ci Bot added the ok-to-test label Oct 29, 2026

tisnik approved these changes Oct 29, 2026

View reviewed changes

tisnik merged commit 3ef16c4 into lightspeed-core:main Oct 29, 2026
93 checks passed

Navigation Menu

Repository navigation

LCORE-5106: regenerated rpm lock yaml for lightspeed stack (0.8.0rc1) - #3025

LCORE-5106: regenerated rpm lock yaml for lightspeed stack (0.8.0rc1)#3025
tisnik merged 1 commit into
lightspeed-core:mainfrom
snuryyeva:snuryyeva/CVE_fix

snuryyeva commented Oct 26, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Oct 26, 2026 •

edited

Loading

Review skipped

Uh oh!

tisnik commented Oct 27, 2026

Uh oh!

openshift-ci Bot commented Oct 27, 2026

Uh oh!

jrobertboos left a comment

Uh oh!

jrobertboos commented Oct 29, 2026

Uh oh!

tisnik left a comment

Uh oh!

Uh oh!

fullsend-ai-retro Bot commented Oct 29, 2026 •

edited

Loading

Uh oh!

fullsend-ai-retro Bot commented Oct 29, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

snuryyeva commented Oct 26, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Type of change

Tools used to create PR

Related Tickets & Documents

Checklist before requesting a review

Testing

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Walkthrough

Changes

Uh oh!

tisnik commented Oct 27, 2026

Uh oh!

openshift-ci Bot commented Oct 27, 2026

Uh oh!

jrobertboos left a comment

Choose a reason for hiding this comment

Uh oh!

jrobertboos commented Oct 29, 2026

Uh oh!

tisnik left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

fullsend-ai-retro Bot commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fullsend-ai-retro Bot commented Oct 29, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

snuryyeva commented Oct 26, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Oct 26, 2026 •

edited

Loading

fullsend-ai-retro Bot commented Oct 29, 2026 •

edited

Loading