Original edivisive algorithm#78880
Conversation
Signed-off-by: Vishnu Challa <vchalla@redhat.com>
WalkthroughThis pull request adds an experimental code block to the Orion CI script that downloads and executes an alternative "original e-divisive" Orion binary in parallel with the existing flow. The main Orion execution remains unchanged; the experimental block runs in isolation and will not block the job if it fails. ChangesExperimental Orion Binary Execution
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ✅ 12✅ Passed checks (12 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: vishnuchalla The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
|
/hold |
openshift-ci
Bot
added
the
do-not-merge/hold
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@ci-operator/step-registry/openshift-qe/orion/openshift-qe-orion-commands.sh`:
- Around line 317-321: The script downloads an experimental binary directly into
$EXP_BINARY and makes it executable without any integrity checks; modify the
block that uses curl
"https://github.com/cloud-bulldozer/orion/releases/download/orig-edivisive-exp/orion-amd64"
to also download a signed artifact or checksum (e.g., .sha256 or .asc), verify
the checksum with sha256sum -c or verify the GPG signature with gpg --verify
against a trusted key, and only proceed to chmod +x "$EXP_BINARY" and execute
the binary if the verification succeeds; ensure failure paths exit non-zero and
remove the downloaded file on verification failure to avoid executing tampered
artifacts.
- Around line 324-327: The experiment is run in the shared workspace and then
glob-copied, which can mix unrelated files into EXP_DIR; instead, create and use
an isolated run directory (e.g., a subdir under EXP_DIR) before invoking the
experiment binary (referencing EXP_BINARY, EXP_DIR, FILENAME, EXTRA_FLAGS), run
the command from that isolated directory (or direct its outputs there), and
change the cp step to copy only from that isolated run directory into the
experimental artifacts folder; ensure you clean up or keep the isolated
directory name deterministic per run to avoid collisions.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 999a2921-672a-4260-9a26-be8e2f3e5ae7
📒 Files selected for processing (1)
ci-operator/step-registry/openshift-qe/orion/openshift-qe-orion-commands.sh
| if ! curl -fsSL "https://github.com/cloud-bulldozer/orion/releases/download/orig-edivisive-exp/orion-amd64" -o "$EXP_BINARY"; then | ||
| echo "Failed to download experimental orion binary, skipping." | ||
| exit 0 | ||
| fi | ||
| chmod +x "$EXP_BINARY" |
There was a problem hiding this comment.
Add integrity verification before executing the downloaded binary.
The block on Line 317 downloads and executes a binary with no checksum/signature validation. That creates a supply-chain execution risk in CI.
Suggested hardening
+ EXP_SHA256="${ORION_ORIG_EDIVISIVE_SHA256:-}"
echo "Downloading experimental orion binary..."
if ! curl -fsSL "https://github.com/cloud-bulldozer/orion/releases/download/orig-edivisive-exp/orion-amd64" -o "$EXP_BINARY"; then
echo "Failed to download experimental orion binary, skipping."
exit 0
fi
+ if [[ -n "$EXP_SHA256" ]]; then
+ echo "${EXP_SHA256} ${EXP_BINARY}" | sha256sum -c - || {
+ echo "Checksum verification failed for experimental binary, skipping."
+ exit 0
+ }
+ else
+ echo "No ORION_ORIG_EDIVISIVE_SHA256 provided; skipping experimental binary execution."
+ exit 0
+ fi
chmod +x "$EXP_BINARY"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@ci-operator/step-registry/openshift-qe/orion/openshift-qe-orion-commands.sh`
around lines 317 - 321, The script downloads an experimental binary directly
into $EXP_BINARY and makes it executable without any integrity checks; modify
the block that uses curl
"https://github.com/cloud-bulldozer/orion/releases/download/orig-edivisive-exp/orion-amd64"
to also download a signed artifact or checksum (e.g., .sha256 or .asc), verify
the checksum with sha256sum -c or verify the GPG signature with gpg --verify
against a trusted key, and only proceed to chmod +x "$EXP_BINARY" and execute
the binary if the verification succeeds; ensure failure paths exit non-zero and
remove the downloaded file on verification failure to avoid executing tampered
artifacts.
| "$EXP_BINARY" --node-count ${IGNORE_JOB_ITERATIONS} --config ${ORION_CONFIG} ${EXTRA_FLAGS} --viz | tee "$EXP_DIR/${FILENAME}.txt" || true | ||
|
|
||
| # Copy all results except .xml files into the experimental artifacts subdirectory | ||
| cp *.csv *.json *.txt *.html "$EXP_DIR/" 2>/dev/null || true |
There was a problem hiding this comment.
Isolate experimental outputs from the main workspace.
Running on Line 324 in the shared directory and then glob-copying on Line 327 can mix unrelated artifacts into orion-original-edivisive, making results harder to trust.
Suggested isolation approach
+ EXP_WORKDIR="$(mktemp -d /tmp/orion-orig-edivisive.XXXXXX)"
+ pushd "$EXP_WORKDIR" >/dev/null
echo "Running experimental orion (original e-divisive)..."
- "$EXP_BINARY" --node-count ${IGNORE_JOB_ITERATIONS} --config ${ORION_CONFIG} ${EXTRA_FLAGS} --viz | tee "$EXP_DIR/${FILENAME}.txt" || true
+ "$EXP_BINARY" --node-count ${IGNORE_JOB_ITERATIONS} --config ${ORION_CONFIG} ${EXTRA_FLAGS} --viz | tee "$EXP_DIR/${FILENAME}.txt" || true
# Copy all results except .xml files into the experimental artifacts subdirectory
- cp *.csv *.json *.txt *.html "$EXP_DIR/" 2>/dev/null || true
+ cp ./*.csv ./*.json ./*.txt ./*.html "$EXP_DIR/" 2>/dev/null || true
+ popd >/dev/null
+ rm -rf "$EXP_WORKDIR"🧰 Tools
🪛 Shellcheck (0.11.0)
[info] 324-324: Double quote to prevent globbing and word splitting.
(SC2086)
[info] 324-324: Double quote to prevent globbing and word splitting.
(SC2086)
[info] 324-324: Double quote to prevent globbing and word splitting.
(SC2086)
[info] 327-327: Use ./glob or -- glob so names with dashes won't become options.
(SC2035)
[info] 327-327: Use ./glob or -- glob so names with dashes won't become options.
(SC2035)
[info] 327-327: Use ./glob or -- glob so names with dashes won't become options.
(SC2035)
[info] 327-327: Use ./glob or -- glob so names with dashes won't become options.
(SC2035)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@ci-operator/step-registry/openshift-qe/orion/openshift-qe-orion-commands.sh`
around lines 324 - 327, The experiment is run in the shared workspace and then
glob-copied, which can mix unrelated files into EXP_DIR; instead, create and use
an isolated run directory (e.g., a subdir under EXP_DIR) before invoking the
experiment binary (referencing EXP_BINARY, EXP_DIR, FILENAME, EXTRA_FLAGS), run
the command from that isolated directory (or direct its outputs there), and
change the cp step to copy only from that isolated run directory into the
experimental artifacts folder; ensure you clean up or keep the isolated
directory name deterministic per run to avoid collisions.
|
[REHEARSALNOTIFIER]
Prior to this PR being merged, you will need to either run and acknowledge or opt to skip these rehearsals. Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
/pj-rehearse periodic-ci-netobserv-netobserv-perf-tests-main-netobserv-aws-4.22-nightly-x86-node-density-heavy-25nodes |
|
@vishnuchalla: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
@vishnuchalla: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
1 participant
Description
Adding original edivisive for experimental purposes.
Testing
Will be verified through PR rehearsals.
Summary by CodeRabbit
Release Notes