Skip to content

ROX-30627: Testing and adapting for cloud JIRA (#213)#19438

Merged
tommartensen merged 3 commits intomasterfrom
tm/jira-uat
Mar 16, 2026
Merged

ROX-30627: Testing and adapting for cloud JIRA (#213)#19438
tommartensen merged 3 commits intomasterfrom
tm/jira-uat

Conversation

@tommartensen
Copy link
Contributor

Description

Backport for https://github.com/stackrox/test-gh-actions/pull/213, which is required after Jira Cloud migration.

User-facing documentation

Testing and quality

  • the change is production ready: the change is GA, or otherwise the functionality is gated by a feature flag
  • CI results are inspected

Automated testing

  • added unit tests
  • added e2e tests
  • added regression tests
  • added compatibility tests
  • modified existing tests

How I validated my change

See validation in https://github.com/stackrox/test-gh-actions/pull/213

* adapt workflows and scripts to the Cloud Jira instance (UAT) testing
* simplify configuration by re-using Action variables
* self-review: correct retries for get x from JIRA commands
@openshift-ci
Copy link

openshift-ci bot commented Mar 16, 2026

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

sourcery-ai[bot]

This comment was marked as resolved.

@stackrox stackrox deleted a comment from sourcery-ai bot Mar 16, 2026
@stackrox stackrox deleted a comment from sourcery-ai bot Mar 16, 2026
@stackrox stackrox deleted a comment from sourcery-ai bot Mar 16, 2026
@stackrox stackrox deleted a comment from sourcery-ai bot Mar 16, 2026
@stackrox stackrox deleted a comment from sourcery-ai bot Mar 16, 2026
@tommartensen tommartensen marked this pull request as ready for review March 16, 2026 14:40
@tommartensen tommartensen requested a review from a team as a code owner March 16, 2026 14:40
@tommartensen tommartensen enabled auto-merge (squash) March 16, 2026 14:42
Copy link
Contributor

@sourcery-ai sourcery-ai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey - I've found 2 issues, and left some high level feedback:

  • The Jira helper functions build JSON payloads via heredocs with unescaped interpolated values (e.g., JQL in get_issues, COMMENT in comment_on_issue), which will break if those contain quotes or newlines; consider constructing the JSON with jq -n --arg or otherwise escaping these fields properly.
  • get_issues/comment_on_issue write to a fixed /tmp/request.json path, which can cause races or interference if multiple scripts or steps call these in parallel; using mktemp to create a unique temporary file per call would make this more robust.
  • In get_issues, PAGE_SIZE and next_page_token are implicitly global; making them local would reduce the risk of side effects if the script grows or additional functions reuse these names.
Prompt for AI Agents
Please address the comments from this code review:

## Overall Comments
- The Jira helper functions build JSON payloads via heredocs with unescaped interpolated values (e.g., JQL in `get_issues`, `COMMENT` in `comment_on_issue`), which will break if those contain quotes or newlines; consider constructing the JSON with `jq -n --arg` or otherwise escaping these fields properly.
- `get_issues`/`comment_on_issue` write to a fixed `/tmp/request.json` path, which can cause races or interference if multiple scripts or steps call these in parallel; using `mktemp` to create a unique temporary file per call would make this more robust.
- In `get_issues`, `PAGE_SIZE` and `next_page_token` are implicitly global; making them `local` would reduce the risk of side effects if the script grows or additional functions reuse these names.

## Individual Comments

### Comment 1
<location path=".github/workflows/scripts/common.sh" line_range="111" />
<code_context>
+    while true; do
+        cat <<EOF > /tmp/request.json
+{
+    "jql": "$JQL",
+    "maxResults": "${PAGE_SIZE}",
+    "nextPageToken": "${next_page_token}",
</code_context>
<issue_to_address>
**issue (bug_risk):** JQL is interpolated into JSON without escaping, which can break the request for certain characters.

If `JQL` ever includes double quotes, backslashes, or newlines (e.g., from future changes or dynamic input), this here-doc will produce invalid JSON and the Jira request will fail in a hard-to-diagnose way. Consider instead:
- building the payload with `jq` (e.g., `jq -n --arg jql "$JQL" '{jql: $jql, ...}'`), or
- JSON-escaping `JQL` first (e.g., `JQL_ESCAPED=$(printf '%s' "$JQL" | jq -Rs .)` and embedding that).
This makes the helper resilient to JQL contents and future changes.
</issue_to_address>

### Comment 2
<location path=".github/workflows/scripts/common.sh" line_range="189" />
<code_context>
+                "content": [
+                    {
+                    "type": "text",
+                    "text": "${COMMENT}"
+                    }
+                ]
</code_context>
<issue_to_address>
**issue (bug_risk):** COMMENT is inserted into JSON without escaping, which can break the payload or cause malformed comments.

Since COMMENT may contain quotes, backslashes, or newlines (e.g., multi-line instructions), interpolating it directly into the JSON can produce invalid JSON or change the structure. Escape COMMENT as JSON before embedding, for example:

```bash
COMMENT_JSON=$(printf '%s' "$COMMENT" | jq -Rs .)
cat <<EOF > /tmp/request.json
{
  "body": {
    "version": 1,
    "type": "doc",
    "content": [
      {
        "type": "paragraph",
        "content": [
          {
            "type": "text",
            "text": $COMMENT_JSON
          }
        ]
      }
    ]
  }
}
EOF
```

This ensures the JSON remains valid regardless of COMMENT’s contents.
</issue_to_address>

Sourcery is free for open source - if you like our reviews please consider sharing them ✨
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.

@rhacs-bot
Copy link
Contributor

rhacs-bot commented Mar 16, 2026

Images are ready for the commit at c168e4f.

To use with deploy scripts, first export MAIN_IMAGE_TAG=4.11.x-334-gc168e4f373.

@codecov
Copy link

codecov bot commented Mar 16, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 49.73%. Comparing base (7ed9df6) to head (c168e4f).
⚠️ Report is 4 commits behind head on master.

Additional details and impacted files
@@            Coverage Diff             @@
##           master   #19438      +/-   ##
==========================================
- Coverage   49.73%   49.73%   -0.01%     
==========================================
  Files        2703     2703              
  Lines      204040   204040              
==========================================
- Hits       101485   101477       -8     
- Misses      94978    94986       +8     
  Partials     7577     7577              
Flag Coverage Δ
go-unit-tests 49.73% <ø> (-0.01%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@tommartensen tommartensen merged commit 5ca3d10 into master Mar 16, 2026
91 of 93 checks passed
@tommartensen tommartensen deleted the tm/jira-uat branch March 16, 2026 17:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants