Skip to content

Update Konflux base images to 3.5.6 and improve RPM lockfile generation - #3139

Merged
jrobertboos merged 1 commit into
lightspeed-core:release/0.6from
jrobertboos:fix-cves-15
Nov 3, 2026
Merged

jrobertboos merged 1 commit into
lightspeed-core:release/0.6from
jrobertboos:fix-cves-15

Conversation

@jrobertboos

Copy link
Copy Markdown
Contributor

Description

Type of change

  • Refactor
  • New feature
  • Bug fix
  • CVE fix
  • Optimization
  • Documentation Update
  • Configuration Update
  • Bump-up service version
  • Bump-up dependent library [pyproject.toml + uv.lock]
  • Bump-up dependent library [requirements.*.txt for Konflux]
  • Bump-up library or tool used for development (does not change the final image)
  • CI configuration change
  • Konflux configuration change
  • Unit tests improvement
  • Integration tests improvement
  • End to end tests improvement
  • Benchmarks improvement

Tools used to create PR

Identify any AI code assistants used in this PR (for transparency and review context)

  • Assisted-by: (e.g., Claude, CodeRabbit, Ollama, etc., N/A if not used)
  • Generated by: (e.g., tool name and version; N/A if not used)

Related Tickets & Documents

  • Related Issue #
  • Closes #

Checklist before requesting a review

  • I have performed a self-review of my code.
  • PR has passed all pre-merge test jobs.
  • If it is a core feature, I have added thorough tests.

Testing

  • Please provide detailed steps to perform tests related to this code change.
  • How were the fix/results from this change verified? Please provide relevant screenshots or results.

@coderabbitai

coderabbitai Bot commented Nov 3, 2026 •

Copy link
Copy Markdown
Contributor

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

CodeRabbit Verify

  • Run CodeRabbit Verify to test the changes in this pull request.

@fullsend-ai-review

fullsend-ai-review Bot commented Nov 3, 2026 •

Copy link
Copy Markdown

🤖 Review · ⚠️ Cancelled · Started 3:23 PM UTC · Ended 3:24 PM UTC

Commit: 865a0da · View workflow run →

This review was superseded by a newer commit. Check the current pull request HEAD's review status before merging.

@fullsend-ai-review

fullsend-ai-review Bot commented Nov 3, 2026 •

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 3:26 PM UTC · Completed 3:36 PM UTC

Commit: 113dc8b · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.82

@fullsend-ai-review fullsend-ai-review Bot added the risk/low PR risk: low label Nov 3, 2026
@fullsend-ai-review

Copy link
Copy Markdown

<!-- fullsend:risk-assessment -->
Risk Assessment: low (1/5)

Details

Small config-only change (3 files, 35 lines) to Konflux build configuration files (.konflux/). No protected paths, no security-sensitive files, no CI workflow or dependency file changes. Tier 1 avg 1.13, Tier 2 avg 1.43 (slight elevation from 3 distinct authors in 90d on these files). Weighted composite 0.621.13 + 0.381.43 = 1.24, rounds to 1. Low risk.

@fullsend-ai-review

Copy link
Copy Markdown

Looks good to me


Labels: Base image version bump and RPM lockfile update targeting only .konflux/ files.

@fullsend-ai-review fullsend-ai-review Bot added ready-for-merge All reviewers approved — ready to merge dependencies Pull requests that update a dependency file konflux Review effort 1/5 labels Nov 3, 2026
@jrobertboos
jrobertboos merged commit dba9dbe into lightspeed-core:release/0.6 Nov 3, 2026
81 of 92 checks passed
@fullsend-ai-retro

fullsend-ai-retro Bot commented Nov 3, 2026 •

Copy link
Copy Markdown

🤖 Finished Retro · ✅ Success · Started 3:56 PM UTC · Completed 4:05 PM UTC

Commit: 113dc8b · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $3.27

@fullsend-ai-retro

Copy link
Copy Markdown

Retro: PR #3139 — Update Konflux base images to 3.5.6

Workflow went well overall. This was a human-authored, 3-file config-only PR (+32/−3 lines) bumping Konflux base images and updating RPM lockfiles for CVE remediation. The review agent correctly assessed it as low-risk (1/5), approved with no findings, and the PR was merged ~32 minutes after creation.

What worked

  • Supersession logic functioned correctly — the first review run (on commit 865a0da) was cancelled when commit 113dc8b arrived, avoiding wasted work.
  • Risk assessment was accurate — config-only changes to .konflux/ files correctly labeled as low effort/risk.
  • Review outcome was appropriate — approving a straightforward base image bump with no code changes.

Evidence for existing issues (no new proposals)

  • Add pre-flight scope heuristic to adjust review effort/model for trivially-scoped PRs fullsend-ai/fullsend#6891 (pre-flight scope heuristic to adjust review effort): This PR provides fresh evidence. A 3-file, 32-line config-only change was reviewed at "high" effort using claude-opus-4-6, costing $2.82 with 54 tool calls. A "low" effort pass would have reached the same correct conclusion at a fraction of the cost. The model also attempted claude-opus-5-5 first (not served) before falling back to claude-opus-4-6, adding latency to an already over-resourced review.

  • Filter bot-triggered label events to reduce duplicate workflow runs fullsend-ai/fullsend#1362 (filter bot-triggered label events): Five additional fullsend.yaml runs (IDs 41665589197, 41665629507, 41665629937, 41665633374, 41665639476) were triggered at ~15:36 UTC when the review bot applied labels (dependencies, konflux, Review effort 1/5) and submitted its APPROVE review. All five routed correctly and skipped substantive work, but they consumed CI runner startup time unnecessarily.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file konflux ready-for-merge All reviewers approved — ready to merge Review effort 1/5 risk/low PR risk: low

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant