feat: expose metrics for the git commit#1249
feat: expose metrics for the git commit#1249xcoulon merged 5 commits intocodeready-toolchain:masterfrom
Conversation
new `HostOperatorCommitGaugeVec` and `HostOperatorShortCommitGaugeVec` metrics to reflect the current git commit and short commit of the host-operator the metrics are named `sandbox_host_operator_commit` and `sandbox_host_operator_short_commit` and the relevant label is `commit` also, update the tests to assert the value of the metric. also, deprecated the `HostOperatorVersionGaugeVec` metric (will be removed in a future release, once Grafana is updated to support the new metrics) Signed-off-by: Xavier Coulon <xcoulon@redhat.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✅ Files skipped from review due to trivial changes (1)
WalkthroughThis pull request refactors the metrics system to replace a single version gauge with two separate Prometheus gauge vectors for host-operator commits. Two new gauges ( Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan for PR comments
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@pkg/metrics/metrics_test.go`:
- Around line 46-71: The test uses float64(time.Minute) as the delta in
assert.InDelta which is nanoseconds (60,000,000,000) while SetToCurrentTime()
and now.Unix() are in seconds; update the delta in both assertions in
TestGitCommitGauge to a seconds value (e.g. use time.Minute.Seconds() or 60.0)
so the comparison between float64(now.Unix()) and
promtestutil.ToFloat64(metrics.HostOperatorCommitGaugeVec.WithLabelValues(...).SetToCurrentTime())/HostOperatorShortCommitGaugeVec
is done with a correct seconds-based tolerance.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 2fc176c1-c2a0-4bda-bbc0-f521dc77170a
📒 Files selected for processing (2)
pkg/metrics/metrics.gopkg/metrics/metrics_test.go
Signed-off-by: Xavier Coulon <xcoulon@redhat.com>
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.govulncheck.yaml:
- Around line 2-13: The suppression entries in .govulncheck.yaml are incorrectly
silencing stdlib CVEs for your active Go version: remove the suppressions for
GO-2026-4601, GO-2026-4602, and GO-2026-4603 unless you also include a toolchain
bump to go1.25.8 or later in the same change; likewise remove the GO-2026-4599
and GO-2026-4600 suppressions which target go1.26.0 because the repo is
currently on go1.24.13 (or update the repo Go version to 1.26 if that upgrade is
intended), and ensure any remaining suppressions include the correct target Go
version and a planned upgrade note.
| # Incorrect enforcement of email constraints in crypto/x509 | ||
| # Found in: crypto/x509@go1.26.0 | ||
| # Fixed in: crypto/x509@go1.26.1 | ||
| - id: GO-2026-4599 | ||
| info: https://pkg.go.dev/vuln/GO-2026-4599 | ||
| silence-until: 2026-04-09 | ||
| # Panic in name constraint checking for malformed certificates in crypto/x509 | ||
| # Found in: crypto/x509@go1.26.0 | ||
| # Fixed in: crypto/x509@go1.26.1 | ||
| - id: GO-2026-4600 | ||
| info: https://pkg.go.dev/vuln/GO-2026-4600 | ||
| silence-until: 2026-04-09 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== Go version declarations =="
rg -n --hidden \
-g 'go.mod' \
-g '.github/workflows/*.yml' \
-g '.github/workflows/*.yaml' \
-g '**/Dockerfile*' \
-e '^[[:space:]]*go[[:space:]][0-9]+\.[0-9]+' \
-e '^[[:space:]]*toolchain[[:space:]]+go[0-9]+\.[0-9]+(\.[0-9]+)?' \
-e 'go-version:[[:space:]]*["'\'']?[0-9]+\.[0-9]+(\.[0-9]+)?' \
-e 'golang:[0-9]+\.[0-9]+(\.[0-9]+)?'
echo
echo "== govulncheck config usage =="
rg -n --hidden '\.govulncheck\.yaml|govulncheck'
echo
echo "== Newly added suppressions =="
sed -n '1,20p' .govulncheck.yamlRepository: codeready-toolchain/host-operator
Length of output: 1393
🏁 Script executed:
cat .govulncheck.yamlRepository: codeready-toolchain/host-operator
Length of output: 1237
🏁 Script executed:
# Check if there are any changes to go.mod or toolchain configuration
git diff HEAD~1 go.mod 2>/dev/null | head -50 || echo "No git diff available or go.mod unchanged"Repository: codeready-toolchain/host-operator
Length of output: 59
Don't suppress stdlib CVEs for the currently-used Go version without a corresponding upgrade plan.
This change suppresses three vulnerabilities affecting your current Go version (1.24.13): GO-2026-4601 (net/url), GO-2026-4602 (os), and GO-2026-4603 (html/template), all fixed in go1.25.8+. Suppressing active vulnerabilities keeps vuln scanning green while the vulnerable stdlib remains in production. Either include the toolchain bump to go1.25.8 or later in the same change, or defer these suppressions until the upgrade is merged.
Additionally, GO-2026-4599 and GO-2026-4600 are suppressed for go1.26.0, but the repository is currently on go1.24.13—these suppressions have no effect and should be removed unless a go1.26 upgrade is planned alongside this change.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.govulncheck.yaml around lines 2 - 13, The suppression entries in
.govulncheck.yaml are incorrectly silencing stdlib CVEs for your active Go
version: remove the suppressions for GO-2026-4601, GO-2026-4602, and
GO-2026-4603 unless you also include a toolchain bump to go1.25.8 or later in
the same change; likewise remove the GO-2026-4599 and GO-2026-4600 suppressions
which target go1.26.0 because the repo is currently on go1.24.13 (or update the
repo Go version to 1.26 if that upgrade is intended), and ensure any remaining
suppressions include the correct target Go version and a planned upgrade note.
Signed-off-by: Xavier Coulon <xcoulon@redhat.com>
| # Incorrect enforcement of email constraints in crypto/x509 | ||
| # Found in: crypto/x509@go1.26.0 | ||
| # Fixed in: crypto/x509@go1.26.1 | ||
| - id: GO-2026-4599 | ||
| info: https://pkg.go.dev/vuln/GO-2026-4599 | ||
| silence-until: 2026-04-09 | ||
| # Panic in name constraint checking for malformed certificates in crypto/x509 | ||
| # Found in: crypto/x509@go1.26.0 | ||
| # Fixed in: crypto/x509@go1.26.1 | ||
| - id: GO-2026-4600 | ||
| info: https://pkg.go.dev/vuln/GO-2026-4600 | ||
| silence-until: 2026-04-09 |
There was a problem hiding this comment.
those should not be needed I think , but there might be other vulnerabilities related to go.1.24.13
There was a problem hiding this comment.
ok, let me check that
There was a problem hiding this comment.
removed in bdecb4d
I did not realize that vulns found in go 1.26.0 should not apply for this repository 🤦♂️
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: alexeykazakov, drpaneas, mfrancisc, rajivnathan, xcoulon The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Signed-off-by: Xavier Coulon <xcoulon@redhat.com>
|
similar to codeready-toolchain/host-operator#1249 Signed-off-by: Xavier Coulon <xcoulon@redhat.com>
similar to codeready-toolchain/host-operator#1249 --------- Signed-off-by: Xavier Coulon <xcoulon@redhat.com>
similar to codeready-toolchain/host-operator#1249 Signed-off-by: Xavier Coulon <xcoulon@redhat.com>
similar to codeready-toolchain/host-operator#1249 Signed-off-by: Xavier Coulon <xcoulon@redhat.com>
similar to codeready-toolchain/host-operator#1249 Signed-off-by: Xavier Coulon <xcoulon@redhat.com>
similar to codeready-toolchain/host-operator#1249 Signed-off-by: Xavier Coulon <xcoulon@redhat.com>
similar to codeready-toolchain/host-operator#1249 Signed-off-by: Xavier Coulon <xcoulon@redhat.com>
5 participants
new
HostOperatorCommitGaugeVecandHostOperatorShortCommitGaugeVecmetricsto reflect the current git commit and short commit of the host-operator
the metrics are named
sandbox_host_operator_commitandsandbox_host_operator_short_commitand the relevant label is
commitalso, update the tests to assert the value of the metric.
also, deprecated the
HostOperatorVersionGaugeVecmetric (will be removedin a future release, once Grafana is updated to support the new metrics)
Signed-off-by: Xavier Coulon xcoulon@redhat.com
Summary by CodeRabbit
New Features
Tests
Chores