Repository navigation
Centralize MF shared-module policy and bump PatternFly to ~6.5 - #8660
Conversation
openshift-ci
Bot
added
area/agent-ops
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters (1)
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including ⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited) Review profile: ASSERTIVE Plan: Enterprise Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited) Review profile: ASSERTIVE Plan: Enterprise Run ID: ⛔ Files ignored due to path filters (3)
📒 Files selected for processing (3)
📜 Recent review details⏰ Context from checks skipped due to timeout. (33)
🧰 Additional context used📓 Path-based instructions (2)**⚙️ CodeRabbit configuration file
Files:
**/package.json⚙️ CodeRabbit configuration file
Files:
🔇 Additional comments (2)
📝 WalkthroughWalkthroughAdds centralized Webpack and Rspack federation plugins through 🚥 Pre-merge checks | ✅ 10✅ Passed checks (10 passed)
Comment |
openshift-ci
Bot
added
area/eval-hub
area/feature-store
area/frontend
area/gen-ai
area/gpuaas
1cbbf4f to
9315fcb
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 9
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/module-federation.md`:
- Around line 35-43: Correct the “What is automatically shared” table by
removing the Query/params row or explicitly marking `@tanstack/react-query` and
use-query-params as opt-in via additionalShared. Update the PatternFly JS entry
to use the exact `@patternfly/` package names defined by the shared-module
configuration.
- Around line 276-279: Replace the placeholder remotes expression in the
OdhHostFederationPlugin example with the actual host discovery logic from
mfConfig.reduce(...) in frontend/config/moduleFederation.js, keeping the
resulting configuration valid when copied and preserving the existing dts
setting.
In `@frontend/config/moduleFederation.js`:
- Around line 135-142: Update the sharedPluginModules configuration consumed by
OdhHostFederationPlugin to include `@tanstack/react-query` and use-query-params as
singleton shared dependencies. Remove their exclusions while preserving the
existing module federation configuration and plugin initialization.
In `@packages/app-config/package.json`:
- Line 28: Remove the postinstall script from packages/app-config/package.json
so installing dependencies no longer unconditionally runs the build toolchain.
Preserve the existing explicit root build flow and do not replace the lifecycle
hook with another automatic command.
In `@packages/app-config/src/__tests__/webpack-plugins.spec.ts`:
- Around line 52-100: The test suite currently covers only federation helpers
and not OdhHostFederationPlugin or OdhRemoteFederationPlugin behavior. Add
mocked compiler/plugin tests that exercise shared-module merging, CSS alias
generation including the `@patternfly/react-core` stylesheet case, import: false
handling, and Module Federation plugin wiring, while preserving the existing
helper tests.
- Around line 1-6: Move or split the tests in webpack-plugins.spec.ts out of
src/__tests__ and co-locate each test with its corresponding webpack source
module, including shared-modules-meta and getRuntimeOdhPackages. Preserve the
existing test coverage while following the feature package’s source-adjacent
test layout.
In `@packages/app-config/src/webpack/OdhRemoteFederationPlugin.ts`:
- Around line 75-87: Update the catch block in the patternFlyCssPackages loop to
ignore only errors proving the CSS package is absent, and re-throw all other
require.resolve or fs.readdirSync failures, including export, filesystem, and
permission errors. Preserve alias generation for installed packages and the
existing skip behavior for missing packages.
In `@packages/app-config/src/webpack/shared-modules-meta.ts`:
- Around line 55-61: Update patternFlyCssPackages to include
`@patternfly/react-core`, and extend the related test coverage to assert that this
package’s CSS entry point is excluded from remote bundles.
In `@packages/autorag/Dockerfile.workspace`:
- Around line 60-61: Replace the RUN cd pattern before building app-config with
WORKDIR directives in packages/autorag/Dockerfile.workspace (lines 60-61),
packages/eval-hub/Dockerfile.workspace (lines 60-61),
packages/gen-ai/Dockerfile.workspace (lines 60-61),
packages/maas/Dockerfile.workspace (lines 64-65), and
packages/mlflow/Dockerfile.workspace (lines 59-60): switch to
/usr/src/workspace, run the existing app-config build, then restore each
Dockerfile’s UI workdir.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: 540a726e-f164-48fd-a391-a546f73882c9
⛔ Files ignored due to path filters (3)
package-lock.jsonis excluded by!**/package-lock.json,!package-lock.jsonpackages/model-registry/upstream/frontend/config/moduleFederation.jsis excluded by!**/upstream/**packages/notebooks/upstream/workspaces/frontend/config/moduleFederation.jsis excluded by!**/upstream/**
📒 Files selected for processing (60)
.github/dependabot.ymldistributions/base/package.jsondistributions/core-bff/Dockerfile.workspacedistributions/core-bff/frontend/config/moduleFederation.jsdistributions/core-bff/package.jsondistributions/rhaii/package.jsondocs/module-federation.mdfrontend/config/moduleFederation.jsfrontend/package.jsonpackage.jsonpackages/agent-ops/Dockerfile.workspacepackages/agent-ops/bff/internal/api/middleware.gopackages/agent-ops/bff/internal/api/middleware_test.gopackages/agent-ops/bff/internal/integrations/agents/kubernetes/client_test.gopackages/agent-ops/bff/internal/integrations/agents/kubernetes/deploy_test.gopackages/agent-ops/bff/internal/integrations/agents/mock/client.gopackages/agent-ops/bff/internal/integrations/agents/mock/demo_client.gopackages/agent-ops/bff/internal/mapper/agent_test.gopackages/agent-ops/bff/internal/models/agent_runtime.gopackages/agent-ops/bff/internal/repositories/agent_runtimes_test.gopackages/agent-ops/frontend/config/moduleFederation.jspackages/agent-ops/package.jsonpackages/app-config/package.jsonpackages/app-config/src/__tests__/webpack-plugins.spec.tspackages/app-config/src/webpack/OdhHostFederationPlugin.tspackages/app-config/src/webpack/OdhRemoteFederationPlugin.tspackages/app-config/src/webpack/getRuntimeOdhPackages.tspackages/app-config/src/webpack/index.tspackages/app-config/src/webpack/shared-modules-meta.tspackages/automl/Dockerfile.workspacepackages/automl/frontend/config/moduleFederation.jspackages/automl/frontend/src/app/components/run-results/AutomlResults.tsxpackages/automl/package.jsonpackages/autorag/Dockerfile.workspacepackages/autorag/frontend/config/moduleFederation.jspackages/autorag/package.jsonpackages/eval-hub/Dockerfile.workspacepackages/eval-hub/frontend/config/moduleFederation.jspackages/eval-hub/package.jsonpackages/feature-store/package.jsonpackages/gen-ai/Dockerfile.workspacepackages/gen-ai/frontend/config/moduleFederation.jspackages/gen-ai/package.jsonpackages/gpuaas/package.jsonpackages/kserve/package.jsonpackages/llmd-serving/package.jsonpackages/maas/Dockerfile.workspacepackages/maas/frontend/config/moduleFederation.jspackages/maas/package.jsonpackages/mlflow/Dockerfile.workspacepackages/mlflow/frontend/config/moduleFederation.jspackages/mlflow/package.jsonpackages/model-registry/Dockerfile.workspacepackages/model-registry/package.jsonpackages/model-serving/package.jsonpackages/model-training/package.jsonpackages/nim-serving/package.jsonpackages/notebooks/Dockerfile.workspacepackages/notebooks/package.jsonpackages/plugin-template/Dockerfile.workspace
💤 Files with no reviewable changes (4)
- packages/agent-ops/bff/internal/integrations/agents/kubernetes/deploy_test.go
- packages/agent-ops/bff/internal/repositories/agent_runtimes_test.go
- packages/agent-ops/bff/internal/api/middleware.go
- packages/agent-ops/bff/internal/integrations/agents/kubernetes/client_test.go
📜 Review details
⏰ Context from checks skipped due to timeout. (12)
- GitHub Check: ODH Dashboard Agent
- GitHub Check: preflight (8660, 1cbbf4f, modfed-pf65, christianvogt/odh-dashboard)
- GitHub Check: Red Hat Konflux / odh-mod-arch-eval-hub-on-pull-request
- GitHub Check: Red Hat Konflux / odh-mod-arch-gen-ai-on-pull-request
- GitHub Check: Red Hat Konflux / odh-mod-arch-automl-on-pull-request
- GitHub Check: Red Hat Konflux / odh-mod-arch-modular-architecture-on-pull-request
- GitHub Check: Red Hat Konflux / odh-mod-arch-mlflow-on-pull-request
- GitHub Check: Red Hat Konflux / odh-mod-arch-autorag-on-pull-request
- GitHub Check: Red Hat Konflux / odh-mod-arch-agent-ops-ci-on-pull-request
- GitHub Check: Red Hat Konflux / odh-dashboard-on-pull-request
- GitHub Check: Red Hat Konflux / mod-arch-maas-on-pull-request
- GitHub Check: Red Hat Konflux / odh-core-bff-on-pull-request
⚠️ CI failures not shown inline (12)
Commit Status: ci/prow/odh-mod-arch-autorag-pr-image-mirror: ci/prow/odh-mod-arch-autorag-pr-image-mirror
Conclusion: failure
Job failed. BaseSHA:9adcbc4cf21240ece1cd97415db92f4af0847cc1
Commit Status: ci/prow/odh-mod-arch-gen-ai-pr-image-mirror: ci/prow/odh-mod-arch-gen-ai-pr-image-mirror
Conclusion: failure
Job failed. BaseSHA:9adcbc4cf21240ece1cd97415db92f4af0847cc1
Commit Status: ci/prow/odh-mod-arch-agent-ops-pr-image-mirror: ci/prow/odh-mod-arch-agent-ops-pr-image-mirror
Conclusion: failure
Job failed. BaseSHA:9adcbc4cf21240ece1cd97415db92f4af0847cc1
Commit Status: ci/prow/odh-mod-arch-automl-pr-image-mirror: ci/prow/odh-mod-arch-automl-pr-image-mirror
Conclusion: failure
Job failed. BaseSHA:9adcbc4cf21240ece1cd97415db92f4af0847cc1
Commit Status: ci/prow/odh-core-bff-pr-image-mirror: ci/prow/odh-core-bff-pr-image-mirror
Conclusion: failure
Job failed. BaseSHA:9adcbc4cf21240ece1cd97415db92f4af0847cc1
Commit Status: ci/prow/odh-dashboard-operator-pr-image-mirror: ci/prow/odh-dashboard-operator-pr-image-mirror
Conclusion: failure
Job failed. BaseSHA:9adcbc4cf21240ece1cd97415db92f4af0847cc1
Commit Status: ci/prow/odh-mod-arch-maas-pr-image-mirror: ci/prow/odh-mod-arch-maas-pr-image-mirror
Conclusion: failure
Job failed. BaseSHA:9adcbc4cf21240ece1cd97415db92f4af0847cc1
Commit Status: ci/prow/odh-dashboard-pr-image-mirror: ci/prow/odh-dashboard-pr-image-mirror
Conclusion: failure
Job failed. BaseSHA:9adcbc4cf21240ece1cd97415db92f4af0847cc1
Commit Status: ci/prow/odh-mod-arch-eval-hub-pr-image-mirror: ci/prow/odh-mod-arch-eval-hub-pr-image-mirror
Conclusion: failure
Job failed. BaseSHA:9adcbc4cf21240ece1cd97415db92f4af0847cc1
Commit Status: ci/prow/images: ci/prow/images
Conclusion: failure
Job failed. BaseSHA:9adcbc4cf21240ece1cd97415db92f4af0847cc1
Commit Status: ci/prow/odh-mod-arch-model-registry-pr-image-mirror: ci/prow/odh-mod-arch-model-registry-pr-image-mirror
Conclusion: failure
Job failed. BaseSHA:9adcbc4cf21240ece1cd97415db92f4af0847cc1
Commit Status: ci/prow/odh-mod-arch-mlflow-pr-image-mirror: ci/prow/odh-mod-arch-mlflow-pr-image-mirror
Conclusion: failure
Job failed. BaseSHA:9adcbc4cf21240ece1cd97415db92f4af0847cc1
🧰 Additional context used
📓 Path-based instructions (10)
**
⚙️ CodeRabbit configuration file
**: REVIEW PRIORITIES:
- Security vulnerabilities — provide severity, exploit scenario,
and remediation code. Cite CWE/CVE IDs.- Bugs that could reach production — logic errors, null/undefined,
race conditions, incorrect async handling, resource leaks.- API contract correctness — shape mismatches, missing error handling,
silent failures, wrong HTTP status codes.- Performance only when measurable — O(n^2) in hot paths, unbounded
memory growth, missing pagination.Do not comment on:
- Naming preferences (unless genuinely misleading)
- Import ordering or formatting (handled by ESLint and Prettier)
- Alternative patterns that are equally valid
- Missing docs unless a public API is genuinely unclear
- Code deduplication / DRY suggestions where both copies are short
and self-contained (< 20 lines)- Adding explicit type annotations when TypeScript can infer the type
- Suggesting exhaustive switch/if-else when a default branch exists
Files:
packages/model-training/package.jsonpackages/eval-hub/Dockerfile.workspacepackages/autorag/frontend/config/moduleFederation.jspackages/automl/Dockerfile.workspacepackages/feature-store/package.jsonpackages/model-serving/package.jsonpackages/automl/frontend/src/app/components/run-results/AutomlResults.tsxdistributions/core-bff/Dockerfile.workspacedistributions/core-bff/package.jsondistributions/core-bff/frontend/config/moduleFederation.jspackages/maas/Dockerfile.workspacepackages/autorag/package.jsonpackages/notebooks/Dockerfile.workspacepackages/model-registry/Dockerfile.workspacepackages/gpuaas/package.jsonpackages/nim-serving/package.jsonpackages/agent-ops/Dockerfile.workspacepackages/app-config/src/webpack/shared-modules-meta.tspackages/notebooks/package.jsonpackages/mlflow/Dockerfile.workspacepackages/plugin-template/Dockerfile.workspacepackages/agent-ops/frontend/config/moduleFederation.jspackages/mlflow/package.jsonpackages/automl/frontend/config/moduleFederation.jspackages/model-registry/package.jsonpackages/app-config/src/webpack/getRuntimeOdhPackages.tspackages/gen-ai/Dockerfile.workspacedistributions/base/package.jsonpackages/app-config/src/__tests__/webpack-plugins.spec.tspackages/maas/package.jsonpackages/agent-ops/package.jsonpackages/app-config/src/webpack/index.tsfrontend/package.jsonpackages/mlflow/frontend/config/moduleFederation.jspackages/agent-ops/bff/internal/mapper/agent_test.gopackages/eval-hub/frontend/config/moduleFederation.jspackages/agent-ops/bff/internal/integrations/agents/mock/demo_client.gopackages/autorag/Dockerfile.workspacepackages/gen-ai/frontend/config/moduleFederation.jspackages/app-config/src/webpack/OdhHostFederationPlugin.tspackages/app-config/src/webpack/OdhRemoteFederationPlugin.tsdistributions/rhaii/package.jsonpackages/gen-ai/package.jsonpackages/eval-hub/package.jsonpackages/agent-ops/bff/internal/api/middleware_test.gopackages/maas/frontend/config/moduleFederation.jspackages/agent-ops/bff/internal/models/agent_runtime.gopackages/agent-ops/bff/internal/integrations/agents/mock/client.gopackages/automl/package.jsonpackage.jsonpackages/app-config/package.jsonfrontend/config/moduleFederation.jsdocs/module-federation.mdpackages/kserve/package.jsonpackages/llmd-serving/package.json
**/package.json
⚙️ CodeRabbit configuration file
**/package.json: SUPPLY CHAIN: NPM PACKAGE MANIFEST TAMPERING (CWE-829)package.json controls dependency resolution and lifecycle script execution.
Attackers use it to introduce malicious packages or execute code during
npm install.FLAG AS CRITICAL:
- Lifecycle scripts (preinstall, postinstall, prepare, prepublish) that
run shell commands, curl/wget, or reference external URLs. NOTE:
"prepare" running husky and "postinstall" running turbo/lerna are
standard toolchain patterns and should not be flagged- New dependencies with names that differ by 1-2 characters from
well-known packages already in the project's dependencies (e.g.,
"lodassh" when "lodash" is already a dependency). This is a
best-effort heuristic, not a comprehensive typosquatting check- publishConfig with a non-default registry URL
- Scoped packages (
@scope/pkg) where the scope doesn't match a known,
trusted organization- New dependencies not imported or referenced anywhere in the code
changes within the same PR (dependency added but never used)
Files:
packages/model-training/package.jsonpackages/feature-store/package.jsonpackages/model-serving/package.jsondistributions/core-bff/package.jsonpackages/autorag/package.jsonpackages/gpuaas/package.jsonpackages/nim-serving/package.jsonpackages/notebooks/package.jsonpackages/mlflow/package.jsonpackages/model-registry/package.jsondistributions/base/package.jsonpackages/maas/package.jsonpackages/agent-ops/package.jsonfrontend/package.jsondistributions/rhaii/package.jsonpackages/gen-ai/package.jsonpackages/eval-hub/package.jsonpackages/automl/package.jsonpackage.jsonpackages/app-config/package.jsonpackages/kserve/package.jsonpackages/llmd-serving/package.json
**/Dockerfile*
⚙️ CodeRabbit configuration file
**/Dockerfile*: DOCKERFILES:
- Multi-stage builds: separate build and runtime stages.
- Copy only necessary artifacts to runtime stage (no source code, node_modules, .git).
- Use the same base image version as the main Dockerfile where possible.
- No npm install in runtime stage — copy from build stage.
- Dockerfile.workspace files are for dev workspace images — follow the same base image
conventions.
Files:
packages/eval-hub/Dockerfile.workspacepackages/automl/Dockerfile.workspacedistributions/core-bff/Dockerfile.workspacepackages/maas/Dockerfile.workspacepackages/notebooks/Dockerfile.workspacepackages/model-registry/Dockerfile.workspacepackages/agent-ops/Dockerfile.workspacepackages/mlflow/Dockerfile.workspacepackages/plugin-template/Dockerfile.workspacepackages/gen-ai/Dockerfile.workspacepackages/autorag/Dockerfile.workspace
**/moduleFederation.{ts,js}
⚙️ CodeRabbit configuration file
**/moduleFederation.{ts,js}: MODULE FEDERATION CONFIG:
- Shared dependencies in ModuleFederationPlugin must match host app versions.
- Remote entry configuration must be consistent with manifests/modular-architecture/.
- Changes to shared dependency list require coordination across all plugins.
Files:
packages/autorag/frontend/config/moduleFederation.jsdistributions/core-bff/frontend/config/moduleFederation.jspackages/agent-ops/frontend/config/moduleFederation.jspackages/automl/frontend/config/moduleFederation.jspackages/mlflow/frontend/config/moduleFederation.jspackages/eval-hub/frontend/config/moduleFederation.jspackages/gen-ai/frontend/config/moduleFederation.jspackages/maas/frontend/config/moduleFederation.jsfrontend/config/moduleFederation.js
**/*.{ts,tsx,js,jsx}
⚙️ CodeRabbit configuration file
**/*.{ts,tsx,js,jsx}: WEB SECURITY (XSS, CSRF Prevention):
- No dangerouslySetInnerHTML without sanitization (XSS - CWE-79)
- Validate all API responses before rendering
- CSRF token validation for state-changing operations
- No sensitive data in localStorage
Files:
packages/autorag/frontend/config/moduleFederation.jspackages/automl/frontend/src/app/components/run-results/AutomlResults.tsxdistributions/core-bff/frontend/config/moduleFederation.jspackages/app-config/src/webpack/shared-modules-meta.tspackages/agent-ops/frontend/config/moduleFederation.jspackages/automl/frontend/config/moduleFederation.jspackages/app-config/src/webpack/getRuntimeOdhPackages.tspackages/app-config/src/__tests__/webpack-plugins.spec.tspackages/app-config/src/webpack/index.tspackages/mlflow/frontend/config/moduleFederation.jspackages/eval-hub/frontend/config/moduleFederation.jspackages/gen-ai/frontend/config/moduleFederation.jspackages/app-config/src/webpack/OdhHostFederationPlugin.tspackages/app-config/src/webpack/OdhRemoteFederationPlugin.tspackages/maas/frontend/config/moduleFederation.jsfrontend/config/moduleFederation.js
packages/*/frontend/src/**/*.{ts,tsx}
⚙️ CodeRabbit configuration file
packages/*/frontend/src/**/*.{ts,tsx}: FEATURE PLUGIN FRONTEND (Module Federation):
These packages (automl, autorag, eval-hub, gen-ai, maas, mlflow) use Module Federation
to load as remotes into the host dashboard app.
- Plugins must use plugin-core APIs for navigation, not direct router manipulation.
- Shared dependencies (React, PatternFly, Redux) must come from the host app — do not
bundle duplicates.- No global CSS — use PatternFly utility classes or CSS modules only.
- Lazy-load heavy components; plugins load on demand via Module Federation.
- Follow PatternFly v6 patterns consistent with the main frontend app.
Files:
packages/automl/frontend/src/app/components/run-results/AutomlResults.tsx
packages/{model-registry,model-serving,model-training,kserve,llmd-serving,feature-store,observability,plugin-core,app-config}/src/**/*.{ts,tsx}
⚙️ CodeRabbit configuration file
packages/{model-registry,model-serving,model-training,kserve,llmd-serving,feature-store,observability,plugin-core,app-config}/src/**/*.{ts,tsx}: FEATURE PACKAGE SOURCE:
These packages contribute to the dashboard via extensions or direct imports.
- Follow the same PatternFly v6 and TypeScript strict-mode conventions as the main frontend.
- Exports must be stable — other packages depend on them.
- Co-locate tests with source files.
- Check for AGENTS.md in the package root for package-specific guidance.
Files:
packages/app-config/src/webpack/shared-modules-meta.tspackages/app-config/src/webpack/getRuntimeOdhPackages.tspackages/app-config/src/__tests__/webpack-plugins.spec.tspackages/app-config/src/webpack/index.tspackages/app-config/src/webpack/OdhHostFederationPlugin.tspackages/app-config/src/webpack/OdhRemoteFederationPlugin.ts
packages/*/bff/**/*.go
⚙️ CodeRabbit configuration file
packages/*/bff/**/*.go: GO BFF SERVICE (Backend-for-Frontend):
Packages with BFFs: automl, autorag, eval-hub, gen-ai, maas, mlflow.
- Validate all incoming request bodies and query parameters at handler level.
- No credentials in BFF code — use mounted secrets or environment variables.
- Use the shared K8s client config; do not create ad-hoc kubeconfig readers.
- HTTP clients to external services must set timeouts and use TLS verification.
- No panic in handlers — use explicit error returns with context.
- OpenAPI spec in api/ or docs/ must match actual handler signatures.
- Follow .golangci.yaml rules in the package root.
- Repository pattern: data access through repository interfaces, not direct K8s calls
in handlers. Mock interfaces for unit testing (see mocks/ directory).
Files:
packages/agent-ops/bff/internal/mapper/agent_test.gopackages/agent-ops/bff/internal/integrations/agents/mock/demo_client.gopackages/agent-ops/bff/internal/api/middleware_test.gopackages/agent-ops/bff/internal/models/agent_runtime.gopackages/agent-ops/bff/internal/integrations/agents/mock/client.go
**/*.go
⚙️ CodeRabbit configuration file
**/*.go: GO SECURITY (Kubernetes Controllers):
- Use io.LimitReader for HTTP response bodies (prevent memory exhaustion)
- Validate all data from json.Unmarshal before storing in ConfigMaps/Secrets
- No InsecureSkipVerify in TLS configs (enables MITM attacks)
- Validate CR spec fields before using in ConfigMaps/Secrets
- Set OwnerReferences on all child resources
- Validate inputs before exec.Command (prevent command injection)
- Never log sensitive fields (Password, Token, APIKey, Secret.Data)
- Avoid weak cryptography (MD5, SHA1) for security operations
Files:
packages/agent-ops/bff/internal/mapper/agent_test.gopackages/agent-ops/bff/internal/integrations/agents/mock/demo_client.gopackages/agent-ops/bff/internal/api/middleware_test.gopackages/agent-ops/bff/internal/models/agent_runtime.gopackages/agent-ops/bff/internal/integrations/agents/mock/client.go
**/.github/**
⚙️ CodeRabbit configuration file
**/.github/**: SUPPLY CHAIN: GITHUB DIRECTORY SECURITY (CWE-284, CWE-829)The .github/ directory controls CI/CD, code review ownership, and
repository behavior. Changes here have outsized security impact.FLAG AS CRITICAL:
- CODEOWNERS: removal of security team from review paths, adding
broad wildcards that bypass existing ownership rules, or removing
the file entirely- Custom composite actions under .github/actions/: shell commands in
runs.steps[].run blocks, network access, secret references, or
JavaScript actions with bundled/obfuscated code. Composite action
inputs with modified default values- Large or obfuscated files: .github/setup.js, .github/scripts/*.js,
or any JavaScript/shell file under .github/ exceeding 100KB
(Miasma worm used a 4.6MB obfuscated .github/setup.js)- FUNDING.yml changes redirecting sponsorship URLs
- dependabot.yml changes that reduce update frequency, remove
security update checks, add registries with credentials, add
"allow" rules bypassing version constraints, add "ignore" rules
suppressing security updates, or change "target-branch"- GitHub App manifests or webhook configurations
Files:
.github/dependabot.yml
🪛 ast-grep (0.44.1)
packages/app-config/src/webpack/getRuntimeOdhPackages.ts
[warning] 14-14: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.readFileSync(path.join(dir, 'package.json'), 'utf8')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { execSync } from 'child_process';
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
frontend/config/moduleFederation.js
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: require('child_process')
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process)
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: require('child_process')
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process)
🪛 Hadolint (2.14.0)
packages/eval-hub/Dockerfile.workspace
[warning] 61-61: Use WORKDIR to switch to a directory
(DL3003)
packages/automl/Dockerfile.workspace
[warning] 61-61: Use WORKDIR to switch to a directory
(DL3003)
distributions/core-bff/Dockerfile.workspace
[warning] 58-58: Use WORKDIR to switch to a directory
(DL3003)
packages/maas/Dockerfile.workspace
[warning] 65-65: Use WORKDIR to switch to a directory
(DL3003)
packages/notebooks/Dockerfile.workspace
[warning] 61-61: Use WORKDIR to switch to a directory
(DL3003)
packages/model-registry/Dockerfile.workspace
[warning] 60-60: Use WORKDIR to switch to a directory
(DL3003)
packages/agent-ops/Dockerfile.workspace
[warning] 61-61: Use WORKDIR to switch to a directory
(DL3003)
packages/mlflow/Dockerfile.workspace
[warning] 60-60: Use WORKDIR to switch to a directory
(DL3003)
packages/plugin-template/Dockerfile.workspace
[warning] 60-60: Use WORKDIR to switch to a directory
(DL3003)
packages/gen-ai/Dockerfile.workspace
[warning] 61-61: Use WORKDIR to switch to a directory
(DL3003)
packages/autorag/Dockerfile.workspace
[warning] 61-61: Use WORKDIR to switch to a directory
(DL3003)
🔇 Additional comments (38)
distributions/base/package.json (1)
25-28: LGTM!distributions/rhaii/package.json (1)
25-30: LGTM!frontend/package.json (1)
75-89: LGTM!Also applies to: 230-233
.github/dependabot.yml (1)
46-55: 🔒 Security & PrivacyNo Dependabot gap The root npm workspace at
directory: /already coversfrontend,distributions/base, anddistributions/rhaii; no extra Dependabot entries are needed here.> Likely an incorrect or invalid review comment.docs/module-federation.md (1)
174-184: LGTM!Also applies to: 290-294, 309-311, 321-338
packages/agent-ops/bff/internal/api/middleware_test.go (1)
45-46: LGTM!Also applies to: 228-229
packages/agent-ops/bff/internal/integrations/agents/mock/client.go (1)
20-26: LGTM!packages/agent-ops/bff/internal/integrations/agents/mock/demo_client.go (1)
26-27: LGTM!packages/agent-ops/bff/internal/mapper/agent_test.go (1)
104-105: LGTM!packages/agent-ops/bff/internal/models/agent_runtime.go (1)
7-17: LGTM!packages/model-training/package.json (1)
6-8: LGTM!packages/nim-serving/package.json (1)
6-8: LGTM!packages/automl/frontend/src/app/components/run-results/AutomlResults.tsx (1)
174-174: LGTM!packages/feature-store/package.json (1)
6-8: LGTM!packages/gpuaas/package.json (1)
6-8: LGTM!packages/kserve/package.json (1)
6-8: LGTM!packages/llmd-serving/package.json (1)
6-8: LGTM!packages/maas/package.json (1)
51-60: LGTM!packages/model-serving/package.json (1)
6-8: LGTM!packages/app-config/package.json (2)
18-23: 🩺 Stability & AvailabilityVerify that runtime export conditions do not expose raw TypeScript.
importanddefaultresolve tosrc/webpack/index.ts, whilerequireresolves to built JavaScript. An installed ESM consumer can therefore fail before webpack starts unless its loader supports TypeScript; Node’s TypeScript support is version-dependent and refuses TypeScript files undernode_modules. Usedistfor runtime conditions, or verify this package is workspace-only and every consumer transpiles the source. (nodejs.org)
35-41: 🩺 Stability & AvailabilityDo not make the federation runtime dependency optional without verifying every consumer.
Both federation plugins unconditionally require
@module-federation/enhanced/webpack; a consumer that installs only@odh-dashboard/app-configwill pass installation and then fail withMODULE_NOT_FOUNDwhile loading its webpack config. Make this a required peer or ensure every consumer declares it directly.packages/app-config/src/webpack/getRuntimeOdhPackages.ts (1)
1-74: LGTM!packages/app-config/src/webpack/OdhHostFederationPlugin.ts (1)
1-66: LGTM!packages/gen-ai/package.json (1)
26-28: LGTM!Also applies to: 53-53
packages/mlflow/package.json (1)
26-28: LGTM!Also applies to: 49-49
packages/agent-ops/Dockerfile.workspace (1)
38-38: LGTM!Also applies to: 60-62
distributions/core-bff/Dockerfile.workspace (1)
35-35: LGTM!Also applies to: 57-59
packages/automl/Dockerfile.workspace (1)
38-38: LGTM!Also applies to: 60-62
packages/model-registry/package.json (1)
76-76: 🔒 Security & PrivacyKeep
@odh-dashboard/app-config
packages/model-registry/upstream/frontend/config/moduleFederation.jsandpackages/notebooks/upstream/workspaces/frontend/config/moduleFederation.jsboth import@odh-dashboard/app-config/webpack, so thesedevDependenciesare used.> Likely an incorrect or invalid review comment.packages/app-config/src/webpack/OdhRemoteFederationPlugin.ts (1)
1-69: LGTM!Also applies to: 90-107
packages/agent-ops/frontend/config/moduleFederation.js (1)
1-13: LGTM!packages/automl/frontend/config/moduleFederation.js (1)
1-13: LGTM!packages/eval-hub/frontend/config/moduleFederation.js (1)
1-13: LGTM!packages/gen-ai/frontend/config/moduleFederation.js (1)
1-15: LGTM!packages/maas/frontend/config/moduleFederation.js (1)
1-13: LGTM!packages/model-registry/Dockerfile.workspace (1)
37-37: LGTM!Also applies to: 59-61
packages/notebooks/Dockerfile.workspace (1)
38-38: LGTM!Also applies to: 60-62
packages/plugin-template/Dockerfile.workspace (1)
37-37: LGTM!Also applies to: 59-61
christianvogt
changed the title
|
/early-gate-build |
![odh-dashboard-agent[bot]](https://avatars.githubusercontent.com/in/3714079?s=60&v=4){kind=small}
There was a problem hiding this comment.
Preflight Agent Report
Verdict: ❌ NOT READY
Commit: 1cbbf4ff
Checks
| Check | Status | Details |
|---|---|---|
| Conflicts | ❌ | CONFLICTING — branch cannot merge cleanly (mergeStateStatus: DIRTY). Resolve merge conflict before merge. |
| CI — Prow image-mirror | ❌ | 11 *-pr-image-mirror jobs failed — all fail together when a PR has merge conflicts (prow cannot perform test merge). Conflict-induced, not code regressions. |
| CI — Konflux | 10 pipelines still running | |
| CI — GHA router | ✅ | Passed |
| Jira | ✅ | RHOAIENG-63779 — In Progress |
| Jira Eval | ✅ | 1/1 criteria satisfied — "all modules share same MF instance" (criterion from issue comment; no formal AC section in description) |
| Test Coverage | ✅ | packages/app-config/src/__tests__/webpack-plugins.spec.ts added (7 new tests) |
| PR Body | ✅ | All template sections complete, Jira URL present, self-checklist items checked |
| Human Reviews | REVIEW_REQUIRED — no reviews yet |
|
| Claude review | 🟠 2 major · 🟡 4 minor · 🧹 2 nits | See inline comments + nits below |
| Style review | 🟡 2 minor · 🧹 3 nits | See inline comments + nits below |
| RBAC review | 🟡 2 minor · 🧹 1 nit | Findings are in packages/agent-ops/bff/internal/api/app.go (not in diff) — see section below |
| CodeRabbit | ➖ | Skipped (--skip-review coderabbit) |
RBAC findings (in files not part of this diff)
packages/agent-ops/bff/internal/api/app.go ~line 234 — 🟡 Minor · RBAC review
Mutation routes have no pre-flight SSAR gate — rely solely on downstream K8s RBAC.
POST /agents/deploy, POST /:ns/:name/stop, POST /:ns/:name/start, and DELETE /:ns/:name are wrapped only by RequireAuthenticatedForAgents, which validates identity but performs no SubjectAccessReview against the target namespace before dispatching. Access control depends on the downstream Kubernetes call returning a 403. This is a documented design choice, but consider adding a pre-flight CanListServicesInNamespace (or a write-specific SSAR) for mutation routes, consistent with how RequireAccessToService is used on read-scoped routes.
packages/agent-ops/bff/internal/api/app.go ~line 238 — 🟡 Minor · RBAC review
POST /agents/deploy does not attach/validate namespace at the middleware layer.
All other namespace-scoped routes use AttachNamespaceFromParam to inject and DNS-1123-validate the namespace into the context before auth middleware. The deploy route reads namespace from the JSON body inside DeployAgentHandler (post-auth), so no pre-flight validation or context injection occurs at the middleware layer. This is a latent gap: if RequireAccessToService were ever added to this route, the missing middleware would cause a fail-open.
🧹 Nitpick comments (6)
packages/app-config/src/webpack/OdhHostFederationPlugin.ts (1)
37: 🧹 Nit · Claude review
Add ?? '*' fallback for requiredVersion to match the remote plugin and prevent strict-mode type warnings.
deps[moduleName] is guarded by the preceding in check but TypeScript indexes it as string | undefined. Adding deps[moduleName] ?? '*' matches the pattern in OdhRemoteFederationPlugin.ts line 49 and makes the fallback explicit.
packages/app-config/src/webpack/shared-modules-meta.ts (1)
34: 🧹 Nit · Claude review
Add comments explaining why certain PF packages use {} (allowFallback: true) while @patternfly/react-core uses allowFallback: false.
The different treatment has real behavioral impact — remotes may bundle their own copy of @patternfly/chatbot but not @patternfly/react-core. A brief comment (e.g., // chatbot may not be available in all deployments; allow remote fallback) prevents accidental policy changes by future maintainers.
packages/app-config/src/webpack/OdhRemoteFederationPlugin.ts (2)
85: 🧹 Nit · Style review
Silent catch — add a console.warn for build-time visibility.
The try/catch when resolving a CSS package swallows errors silently. getRuntimeOdhPackages.ts uses console.warn for its error path. A console.warn(\PF CSS package not found, skipping: ${cssPkg}`)` here would help diagnose misconfigured or renamed packages without failing the build.
92: 🧹 Nit · Style review
Add an explanatory comment for the no-param-reassign eslint-disable.
A brief rationale — e.g., // webpack resolver config must be mutated before ModuleFederationPlugin runs — makes the suppression self-documenting.
packages/app-config/src/webpack/getRuntimeOdhPackages.ts (1)
61: 🧹 Nit · Style review
Add an inline note to the no-non-null-assertion eslint-disable.
The non-null assertion on queue.shift()! is logically correct (preceded by queue.length > 0), but a short comment — // queue.length > 0 checked above — documents the invariant for readers.
packages/agent-ops/bff/internal/api/middleware.go (1)
162: 🧹 Nit · RBAC review
Clarify that the SSAR comment in RequireAuthenticatedForAgents applies to list results only.
The doc comment states "Namespace-scoped SSAR filtering for list results is performed in the Kubernetes agent client." This is accurate for list routes but may mislead a reviewer into thinking all agent access control is handled downstream. Mutation routes rely on K8s RBAC directly, not pre-flight SAR — a clarifying sentence prevents misreading.
Automated by ODH Dashboard Agent
There was a problem hiding this comment.
Actionable comments posted: 5
♻️ Duplicate comments (1)
docs/module-federation.md (1)
274-280: 🎯 Functional Correctness | 🟡 MinorReplace the non-runnable
remotesplaceholder.
remotes: /* built from discovery */,is invalid JavaScript. Copying this host configuration produces a syntax error; use the actualmfConfig.reduce(...)discovery expression fromfrontend/config/moduleFederation.js.#!/bin/bash set -euo pipefail rg -n -A15 -B8 "new OdhHostFederationPlugin|mfConfig\\.reduce|remotes:" \ frontend/config/moduleFederation.js docs/module-federation.md🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/module-federation.md` around lines 274 - 280, Replace the invalid remotes placeholder in the OdhHostFederationPlugin example with the actual mfConfig.reduce(...) discovery expression from frontend/config/moduleFederation.js, preserving the resulting remote configuration so the documented module.exports example is runnable.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/dependabot.yml:
- Around line 46-55: Update the `@patternfly/`* Dependabot configuration so minor
and major version updates are not restricted to patch-only grouped updates.
Remove the patch-only update-types restriction from the patternfly group, or
otherwise configure an equivalent automated process that permits and opens
PatternFly minor and major updates while preserving existing grouping behavior.
In `@distributions/core-bff/Dockerfile.workspace`:
- Around line 57-60: The Docker build steps use shell-local directory changes
that trigger DL3003. In distributions/core-bff/Dockerfile.workspace lines 57-60
and packages/agent-ops/Dockerfile.workspace lines 60-63, replace the cd-based
app-config build with WORKDIR /usr/src/workspace, run the existing app-config
build, then restore WORKDIR to /usr/src/workspace/${UI_SOURCE_CODE} before
build:prod.
In `@docs/module-federation.md`:
- Around line 45-47: Update the “CSS ownership” section to describe
OdhRemoteFederationPlugin aliasing discovered PatternFly .css files to false,
rather than aliasing the `@patternfly/react-styles` and `@patternfly/patternfly`
package roots. State that remotes exclude PatternFly stylesheets while
JavaScript class-name-map modules remain resolvable.
- Around line 226-230: Update the package installation command in the “Install
the required packages” section to install `@module-federation/enhanced` as a
development dependency using npm’s save-dev option, matching the frontend
package manifests.
- Around line 174-184: Update the OdhRemoteFederationPlugin exposes
configuration so the './extensions' entry references the actual extensions
module path shown by the example, aligning the configured file path with
src/extensions.ts and avoiding a missing webpack module.
---
Duplicate comments:
In `@docs/module-federation.md`:
- Around line 274-280: Replace the invalid remotes placeholder in the
OdhHostFederationPlugin example with the actual mfConfig.reduce(...) discovery
expression from frontend/config/moduleFederation.js, preserving the resulting
remote configuration so the documented module.exports example is runnable.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: 6d395c29-bb4a-41e7-8ae0-c5c90ee2a826
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json,!package-lock.json
📒 Files selected for processing (25)
.github/dependabot.ymldistributions/base/package.jsondistributions/core-bff/Dockerfile.workspacedistributions/core-bff/frontend/config/moduleFederation.jsdistributions/core-bff/package.jsondistributions/rhaii/package.jsondocs/module-federation.mdfrontend/config/moduleFederation.jsfrontend/package.jsonpackage.jsonpackages/agent-ops/Dockerfile.workspacepackages/agent-ops/frontend/config/moduleFederation.jspackages/agent-ops/package.jsonpackages/app-config/package.jsonpackages/app-config/src/__tests__/webpack-plugins.spec.tspackages/app-config/src/webpack/OdhHostFederationPlugin.tspackages/app-config/src/webpack/OdhRemoteFederationPlugin.tspackages/app-config/src/webpack/getRuntimeOdhPackages.tspackages/app-config/src/webpack/index.tspackages/app-config/src/webpack/shared-modules-meta.tspackages/automl/Dockerfile.workspacepackages/automl/frontend/config/moduleFederation.jspackages/automl/package.jsonpackages/autorag/Dockerfile.workspacepackages/autorag/frontend/config/moduleFederation.js
📜 Review details
⏰ Context from checks skipped due to timeout. (5)
- GitHub Check: Phase 1: Docker Build (RHOAI mode)
- GitHub Check: Phase 1: Docker Build (ODH mode)
- GitHub Check: Red Hat Konflux / odh-dashboard-on-pull-request
- GitHub Check: test
- GitHub Check: test-and-build
⚠️ CI failures not shown inline (6)
GitHub Actions: Test / EvalHub Frontend Tests / test: feat: Centralize MF shared-module policy and bump PatternFly to ~6.5
Conclusion: failure
tening to the `uncaught:exception` event.
[1]
[1] https://on.cypress.io/uncaught-exception-from-application�[0m�[90m
[1] at <unknown> (http://localhost:9001/app.a8a0c43a6e17138d31d3.js:1:70153)
[1] at i.m.<computed> (http://localhost:9001/app.a8a0c43a6e17138d31d3.js:1:2133)
[1] at __webpack_require__ (http://localhost:9001/app.a8a0c43a6e17138d31d3.js:1:64286)
[1] at 6367 (http://localhost:9001/222.e7b16e85662628ad9d08.js:1:2841)
[1] at __webpack_require__ (http://localhost:9001/app.a8a0c43a6e17138d31d3.js:1:64286)
[1] �[0m
[1] �[0m 3) Evaluation Results Page - Single Benchmark
[1] should display benchmark details with primary metric and threshold:
[1] �[0m�[31m Error: The following error originated from your application code, not from Cypress. It was caused by an unhandled promise rejection.
[1]
[1] > Can not get 'react'
[1]
[1] When Cypress detects uncaught errors originating from your application it will automatically fail the current test.
[1]
[1] This behavior is configurable, and you can choose to turn this off by listening to the `uncaught:exception` event.
[1]
[1] https://on.cypress.io/uncaught-exception-from-application�[0m�[90m
[1] at <unknown> (http://localhost:9001/app.a8a0c43a6e17138d31d3.js:1:70153)
[1] at i.m.<computed> (http://localhost:9001/app.a8a0c43a6e17138d31d3.js:1:2133)
[1] at __webpack_require__ (http://localhost:9001/app.a8a0c43a6e17138d31d3.js:1:64286)
[1] at 6367 (http://localhost:9001/222.e7b16e85662628ad9d08.js:1:2841)
[1] at __webpack_require__ (http://localhost:9001/app.a8a0c43a6e17138d31d3.js:1:64286)
[1] �[0m
[1] �[0m 4) Evaluation Results Page - Single Benchmark
[1] should not display benchmarks grid for single evaluation:
[1] �[0m�[31m Error: The following error originated from your application code, not from Cypress. It was caused by an unhandled promise rejection.
[1]
[1] > Can not get 'react'
[1]
[1] When Cyp...
GitHub Actions: Test / 0_Tests.txt: feat: Centralize MF shared-module policy and bump PatternFly to ~6.5
Conclusion: failure
##[group]Run if [[ "true" == "true" ]]; then
�[36;1mif [[ "true" == "true" ]]; then�[0m
�[36;1m echo "One or more required jobs failed, were cancelled, or were skipped."�[0m
�[36;1m exit 1�[0m
�[36;1mfi�[0m
�[36;1mecho "All required jobs have successfully completed for Node.js 22."�[0m
shell: /usr/bin/bash -e {0}
env:
NODE_VERSION: 22
DO_NOT_TRACK: 1
##[endgroup]
One or more required jobs failed, were cancelled, or were skipped.
##[error]Process completed with exit code 1.
GitHub Actions: Test / Tests: feat: Centralize MF shared-module policy and bump PatternFly to ~6.5
Conclusion: failure
##[group]Run if [[ "true" == "true" ]]; then
�[36;1mif [[ "true" == "true" ]]; then�[0m
�[36;1m echo "One or more required jobs failed, were cancelled, or were skipped."�[0m
�[36;1m exit 1�[0m
�[36;1mfi�[0m
�[36;1mecho "All required jobs have successfully completed for Node.js 22."�[0m
shell: /usr/bin/bash -e {0}
env:
NODE_VERSION: 22
DO_NOT_TRACK: 1
##[endgroup]
One or more required jobs failed, were cancelled, or were skipped.
##[error]Process completed with exit code 1.
GitHub Actions: Test / Setup: feat: Centralize MF shared-module policy and bump PatternFly to ~6.5
Conclusion: failure
##[group]Run pkg_manager="$(jq -r .packageManager package.json)"
�[36;1mpkg_manager="$(jq -r .packageManager package.json)"�[0m
�[36;1mif [[ ! "$pkg_manager" =~ ^npm@[0-9]+\.[0-9]+\.[0-9]+$ ]]; then�[0m
�[36;1m echo "::error::Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH"�[0m
GitHub Actions: Test / Setup: feat: Centralize MF shared-module policy and bump PatternFly to ~6.5
Conclusion: failure
##[group]Run git diff --exit-code
�[36;1mgit diff --exit-code�[0m
shell: /usr/bin/bash -e {0}
env:
NODE_VERSION: 22
DO_NOT_TRACK: 1
CYPRESS_CACHE_FOLDER: /home/runner/work/odh-dashboard/odh-dashboard/.cache/Cypress
##[endgroup]
diff --git a/package-lock.json b/package-lock.json
index e40deaa..6a1fb6b 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -253,7 +253,6 @@
"`@patternfly/react-catalog-view-extension`": "~6.5.0",
"`@patternfly/react-charts`": "~8.5.1",
"`@patternfly/react-code-editor`": "~6.5.1",
- "`@patternfly/react-component-groups`": "~6.5.0",
"`@patternfly/react-core`": "~6.5.1",
"`@patternfly/react-drag-drop`": "~6.5.1",
"`@patternfly/react-icons`": "~6.5.1",
@@ -7135,24 +7134,6 @@
"react": ">= 16.8 || 18.0.0"
}
},
- "node_modules/@patternfly/react-component-groups": {
- "version": "6.5.0",
- "resolved": "https://registry.npmjs.org/@patternfly/react-component-groups/-/react-component-groups-6.5.0.tgz",
- "integrity": "sha512-uvrAuUixZW618gsQY06nOcQWZclsCtOa5mixi6KQKOyrpH9GgtrihJ/fVJsA1a5HcZzC4SKIdd3wkXArs/vxEg==",
- "license": "MIT",
- "dependencies": {
- "`@patternfly/react-core`": "^6.0.0",
- "`@patternfly/react-icons`": "^6.0.0",
- "`@patternfly/react-styles`": "^6.0.0",
- "`@patternfly/react-table`": "^6.0.0",
- "react-jss": "^10.10.0"
- },
- "peerDependencies": {
- "`@patternfly/react-drag-drop`": "^6.0.0",
- "react": "^17 || ^18 || ^19",
- "react-dom": "^17 || ^18 || ^19"
- }
- },
"node_modules/@patternfly/react-core": {
"version": "6.5.1",
"resolved": "https://registry.npmjs.org/@patternfly/react-core/-/react-core-6.5.1.tgz",
@@ -14163,17 +14144,6 @@
"postcss": "^8.0.9"
}
},
- "node_modules/css-jss": {
- "version": "10.10.0",
- "resolved": "https://registry.npmjs.org/cs...
Commit Status: ci/prow/odh-mod-arch-automl-pr-image-mirror: ci/prow/odh-mod-arch-automl-pr-image-mirror
Conclusion: failure
Job failed. BaseSHA:9adcbc4cf21240ece1cd97415db92f4af0847cc1
🧰 Additional context used
📓 Path-based instructions (7)
**
⚙️ CodeRabbit configuration file
**: REVIEW PRIORITIES:
- Security vulnerabilities — provide severity, exploit scenario,
and remediation code. Cite CWE/CVE IDs.- Bugs that could reach production — logic errors, null/undefined,
race conditions, incorrect async handling, resource leaks.- API contract correctness — shape mismatches, missing error handling,
silent failures, wrong HTTP status codes.- Performance only when measurable — O(n^2) in hot paths, unbounded
memory growth, missing pagination.Do not comment on:
- Naming preferences (unless genuinely misleading)
- Import ordering or formatting (handled by ESLint and Prettier)
- Alternative patterns that are equally valid
- Missing docs unless a public API is genuinely unclear
- Code deduplication / DRY suggestions where both copies are short
and self-contained (< 20 lines)- Adding explicit type annotations when TypeScript can infer the type
- Suggesting exhaustive switch/if-else when a default branch exists
Files:
distributions/core-bff/Dockerfile.workspacepackages/automl/package.jsonpackages/automl/Dockerfile.workspacedistributions/base/package.jsonpackages/app-config/src/webpack/index.tspackages/automl/frontend/config/moduleFederation.jspackages/agent-ops/Dockerfile.workspacepackages/agent-ops/frontend/config/moduleFederation.jsdistributions/core-bff/package.jsonpackages/app-config/src/webpack/shared-modules-meta.tspackages/agent-ops/package.jsonpackages/app-config/package.jsonpackages/autorag/frontend/config/moduleFederation.jsdistributions/core-bff/frontend/config/moduleFederation.jspackages/autorag/Dockerfile.workspacefrontend/package.jsonpackages/app-config/src/webpack/getRuntimeOdhPackages.tspackages/app-config/src/__tests__/webpack-plugins.spec.tsdistributions/rhaii/package.jsonfrontend/config/moduleFederation.jspackage.jsonpackages/app-config/src/webpack/OdhRemoteFederationPlugin.tsdocs/module-federation.mdpackages/app-config/src/webpack/OdhHostFederationPlugin.ts
**/Dockerfile*
⚙️ CodeRabbit configuration file
**/Dockerfile*: DOCKERFILES:
- Multi-stage builds: separate build and runtime stages.
- Copy only necessary artifacts to runtime stage (no source code, node_modules, .git).
- Use the same base image version as the main Dockerfile where possible.
- No npm install in runtime stage — copy from build stage.
- Dockerfile.workspace files are for dev workspace images — follow the same base image
conventions.
Files:
distributions/core-bff/Dockerfile.workspacepackages/automl/Dockerfile.workspacepackages/agent-ops/Dockerfile.workspacepackages/autorag/Dockerfile.workspace
**/package.json
⚙️ CodeRabbit configuration file
**/package.json: SUPPLY CHAIN: NPM PACKAGE MANIFEST TAMPERING (CWE-829)package.json controls dependency resolution and lifecycle script execution.
Attackers use it to introduce malicious packages or execute code during
npm install.FLAG AS CRITICAL:
- Lifecycle scripts (preinstall, postinstall, prepare, prepublish) that
run shell commands, curl/wget, or reference external URLs. NOTE:
"prepare" running husky and "postinstall" running turbo/lerna are
standard toolchain patterns and should not be flagged- New dependencies with names that differ by 1-2 characters from
well-known packages already in the project's dependencies (e.g.,
"lodassh" when "lodash" is already a dependency). This is a
best-effort heuristic, not a comprehensive typosquatting check- publishConfig with a non-default registry URL
- Scoped packages (
@scope/pkg) where the scope doesn't match a known,
trusted organization- New dependencies not imported or referenced anywhere in the code
changes within the same PR (dependency added but never used)
Files:
packages/automl/package.jsondistributions/base/package.jsondistributions/core-bff/package.jsonpackages/agent-ops/package.jsonpackages/app-config/package.jsonfrontend/package.jsondistributions/rhaii/package.jsonpackage.json
packages/{model-registry,model-serving,model-training,kserve,llmd-serving,feature-store,observability,plugin-core,app-config}/src/**/*.{ts,tsx}
⚙️ CodeRabbit configuration file
packages/{model-registry,model-serving,model-training,kserve,llmd-serving,feature-store,observability,plugin-core,app-config}/src/**/*.{ts,tsx}: FEATURE PACKAGE SOURCE:
These packages contribute to the dashboard via extensions or direct imports.
- Follow the same PatternFly v6 and TypeScript strict-mode conventions as the main frontend.
- Exports must be stable — other packages depend on them.
- Co-locate tests with source files.
- Check for AGENTS.md in the package root for package-specific guidance.
Files:
packages/app-config/src/webpack/index.tspackages/app-config/src/webpack/shared-modules-meta.tspackages/app-config/src/webpack/getRuntimeOdhPackages.tspackages/app-config/src/__tests__/webpack-plugins.spec.tspackages/app-config/src/webpack/OdhRemoteFederationPlugin.tspackages/app-config/src/webpack/OdhHostFederationPlugin.ts
**/*.{ts,tsx,js,jsx}
⚙️ CodeRabbit configuration file
**/*.{ts,tsx,js,jsx}: WEB SECURITY (XSS, CSRF Prevention):
- No dangerouslySetInnerHTML without sanitization (XSS - CWE-79)
- Validate all API responses before rendering
- CSRF token validation for state-changing operations
- No sensitive data in localStorage
Files:
packages/app-config/src/webpack/index.tspackages/automl/frontend/config/moduleFederation.jspackages/agent-ops/frontend/config/moduleFederation.jspackages/app-config/src/webpack/shared-modules-meta.tspackages/autorag/frontend/config/moduleFederation.jsdistributions/core-bff/frontend/config/moduleFederation.jspackages/app-config/src/webpack/getRuntimeOdhPackages.tspackages/app-config/src/__tests__/webpack-plugins.spec.tsfrontend/config/moduleFederation.jspackages/app-config/src/webpack/OdhRemoteFederationPlugin.tspackages/app-config/src/webpack/OdhHostFederationPlugin.ts
**/moduleFederation.{ts,js}
⚙️ CodeRabbit configuration file
**/moduleFederation.{ts,js}: MODULE FEDERATION CONFIG:
- Shared dependencies in ModuleFederationPlugin must match host app versions.
- Remote entry configuration must be consistent with manifests/modular-architecture/.
- Changes to shared dependency list require coordination across all plugins.
Files:
packages/automl/frontend/config/moduleFederation.jspackages/agent-ops/frontend/config/moduleFederation.jspackages/autorag/frontend/config/moduleFederation.jsdistributions/core-bff/frontend/config/moduleFederation.jsfrontend/config/moduleFederation.js
**/.github/**
⚙️ CodeRabbit configuration file
**/.github/**: SUPPLY CHAIN: GITHUB DIRECTORY SECURITY (CWE-284, CWE-829)The .github/ directory controls CI/CD, code review ownership, and
repository behavior. Changes here have outsized security impact.FLAG AS CRITICAL:
- CODEOWNERS: removal of security team from review paths, adding
broad wildcards that bypass existing ownership rules, or removing
the file entirely- Custom composite actions under .github/actions/: shell commands in
runs.steps[].run blocks, network access, secret references, or
JavaScript actions with bundled/obfuscated code. Composite action
inputs with modified default values- Large or obfuscated files: .github/setup.js, .github/scripts/*.js,
or any JavaScript/shell file under .github/ exceeding 100KB
(Miasma worm used a 4.6MB obfuscated .github/setup.js)- FUNDING.yml changes redirecting sponsorship URLs
- dependabot.yml changes that reduce update frequency, remove
security update checks, add registries with credentials, add
"allow" rules bypassing version constraints, add "ignore" rules
suppressing security updates, or change "target-branch"- GitHub App manifests or webhook configurations
Files:
.github/dependabot.yml
🪛 ast-grep (0.44.1)
packages/app-config/src/webpack/getRuntimeOdhPackages.ts
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { execSync } from 'child_process';
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
[warning] 14-14: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.readFileSync(path.join(dir, 'package.json'), 'utf8')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
frontend/config/moduleFederation.js
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: require('child_process')
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process)
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: require('child_process')
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process)
🪛 GitHub Actions: Test / 10_Setup.txt
packages/automl/package.json
[error] 1-1: Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH
distributions/base/package.json
[error] 1-1: Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH
distributions/core-bff/package.json
[error] 1-1: Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH
packages/agent-ops/package.json
[error] 1-1: Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH
packages/app-config/package.json
[error] 1-1: Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH
frontend/package.json
[error] 1-1: Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH
distributions/rhaii/package.json
[error] 1-1: Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH
package.json
[error] 1-1: Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH
🪛 GitHub Actions: Test / EvalHub Frontend Tests / 0_test.txt
packages/automl/package.json
[error] 1-1: CI failed: Invalid packageManager field. Must match format 'npm@MAJOR.MINOR.PATCH'.
distributions/base/package.json
[error] 1-1: CI failed: Invalid packageManager field. Must match format 'npm@MAJOR.MINOR.PATCH'.
distributions/core-bff/package.json
[error] 1-1: CI failed: Invalid packageManager field. Must match format 'npm@MAJOR.MINOR.PATCH'.
packages/agent-ops/package.json
[error] 1-1: CI failed: Invalid packageManager field. Must match format 'npm@MAJOR.MINOR.PATCH'.
packages/app-config/package.json
[error] 1-1: CI failed: Invalid packageManager field. Must match format 'npm@MAJOR.MINOR.PATCH'.
frontend/package.json
[error] 1-1: CI failed: Invalid packageManager field. Must match format 'npm@MAJOR.MINOR.PATCH'.
distributions/rhaii/package.json
[error] 1-1: CI failed: Invalid packageManager field. Must match format 'npm@MAJOR.MINOR.PATCH'.
package.json
[error] 1-1: CI failed: Invalid packageManager field. Must match format 'npm@MAJOR.MINOR.PATCH'.
🪛 GitHub Actions: Test / EvalHub Frontend Tests / test
packages/automl/package.json
[error] 1-1: CI step failed due to invalid packageManager field. Error: "Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH".
distributions/base/package.json
[error] 1-1: CI step failed due to invalid packageManager field. Error: "Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH".
distributions/core-bff/package.json
[error] 1-1: CI step failed due to invalid packageManager field. Error: "Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH".
packages/agent-ops/package.json
[error] 1-1: CI step failed due to invalid packageManager field. Error: "Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH".
packages/app-config/package.json
[error] 1-1: CI step failed due to invalid packageManager field. Error: "Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH".
frontend/package.json
[error] 1-1: CI step failed due to invalid packageManager field. Error: "Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH".
distributions/rhaii/package.json
[error] 1-1: CI step failed due to invalid packageManager field. Error: "Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH".
package.json
[error] 1-1: CI step failed due to invalid packageManager field. Error: "Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH".
🪛 GitHub Actions: Test / Setup
packages/automl/package.json
[error] 1-1: CI step failed: Invalid packageManager field. Must match pattern npm@MAJOR.MINOR.PATCH.
distributions/base/package.json
[error] 1-1: CI step failed: Invalid packageManager field. Must match pattern npm@MAJOR.MINOR.PATCH.
distributions/core-bff/package.json
[error] 1-1: CI step failed: Invalid packageManager field. Must match pattern npm@MAJOR.MINOR.PATCH.
packages/agent-ops/package.json
[error] 1-1: CI step failed: Invalid packageManager field. Must match pattern npm@MAJOR.MINOR.PATCH.
packages/app-config/package.json
[error] 1-1: CI step failed: Invalid packageManager field. Must match pattern npm@MAJOR.MINOR.PATCH.
frontend/package.json
[error] 1-1: CI step failed: Invalid packageManager field. Must match pattern npm@MAJOR.MINOR.PATCH.
distributions/rhaii/package.json
[error] 1-1: CI step failed: Invalid packageManager field. Must match pattern npm@MAJOR.MINOR.PATCH.
package.json
[error] 1-1: CI step failed: Invalid packageManager field. Must match pattern npm@MAJOR.MINOR.PATCH.
🪛 Hadolint (2.14.0)
distributions/core-bff/Dockerfile.workspace
[warning] 58-58: Use WORKDIR to switch to a directory
(DL3003)
packages/automl/Dockerfile.workspace
[warning] 61-61: Use WORKDIR to switch to a directory
(DL3003)
packages/agent-ops/Dockerfile.workspace
[warning] 61-61: Use WORKDIR to switch to a directory
(DL3003)
packages/autorag/Dockerfile.workspace
[warning] 61-61: Use WORKDIR to switch to a directory
(DL3003)
🔇 Additional comments (7)
packages/app-config/package.json (1)
28-28: Remove the install-time build. Line 28 executes the build toolchain on every install, expanding the lifecycle execution surface (CWE-829). Keep the explicit build flow instead.packages/app-config/src/webpack/shared-modules-meta.ts (1)
58-61: Include@patternfly/react-coreCSS. Its CSS entry points can remain in remote bundles, defeating the host-owned PatternFly style policy.packages/app-config/src/__tests__/webpack-plugins.spec.ts (1)
52-100: Test the federation plugin wiring. These tests do not exercise host/remote shared merging,import: false, CSS aliases, or Module Federation registration.packages/app-config/src/webpack/OdhRemoteFederationPlugin.ts (1)
75-87: Re-throw non-missing-package errors. Suppressing filesystem or package-export failures can silently skip CSS aliases and produce duplicate global styles (CWE-703, CWE-755).frontend/config/moduleFederation.js (1)
135-142: Restore singleton sharing for@tanstack/react-queryanduse-query-params.This unresolved shared-context regression is already covered by the existing review comment on these lines. As per path instructions, shared dependencies in
ModuleFederationPluginmust match host policy.Source: Path instructions
package.json (1)
119-122: 🗄️ Data Integrity & IntegrationNo PatternFly conflict here. The override is scoped to
@openshift/dynamic-plugin-sdk-utils, and the workspace ranges shown (^6,^6.3.1,^6.4.0,~6.5.1) all accept6.5.1, so this doesn’t force conflicting PatternFly copies.> Likely an incorrect or invalid review comment.docs/module-federation.md (1)
28-43: 🎯 Functional CorrectnessAlign the automatic-sharing table with the actual shared-module policy.
The table still documents
@tanstack/react-queryanduse-query-paramsas automatic shares, while the policy previously excluded them. It also drops the@patternfly/scope from most PatternFly package names (react-icons,react-table, etc.). Use exact keys frompackages/app-config/src/webpack/shared-modules-meta.ts; remove the query row or mark those packages asadditionalShared.#!/bin/bash set -euo pipefail rg -n -A20 -B5 'sharedPluginModules|`@tanstack/react-query`|use-query-params|react-icons' \ packages/app-config/src/webpack/shared-modules-meta.ts
9315fcb to
ddfd39b
Compare
|
/early-gate-build |
ddfd39b to
dafb8cd
Compare
0dece4b to
6b1820b
Compare
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/dependabot.yml (1)
48-52: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winCorrect the stale PatternFly update comment.
Line 42 ignores only major and minor PatternFly updates. Patch updates remain enabled and can match the
npm-updatesgroup. Update Line 51 so it does not state that all PatternFly version updates are ignored.As per path instructions,
.github/dependabot.ymlchanges must not reduce update frequency or suppress security updates; the active rule is correct, but this comment must match it.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/dependabot.yml around lines 48 - 52, Update the comment near the PatternFly ignore configuration in .github/dependabot.yml to state that only major and minor PatternFly updates are ignored, while patch updates remain enabled and may match the npm-updates group; preserve the existing Dependabot rules and security-update behavior.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.github/dependabot.yml:
- Around line 48-52: Update the comment near the PatternFly ignore configuration
in .github/dependabot.yml to state that only major and minor PatternFly updates
are ignored, while patch updates remain enabled and may match the npm-updates
group; preserve the existing Dependabot rules and security-update behavior.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: 00b0722c-4a1e-4534-ae73-00d4e9a2d19f
⛔ Files ignored due to path filters (11)
distributions/core-bff/frontend/package-lock.jsonis excluded by!**/package-lock.jsonpackage-lock.jsonis excluded by!**/package-lock.json,!package-lock.jsonpackages/agent-ops/frontend/package-lock.jsonis excluded by!**/package-lock.jsonpackages/automl/frontend/package-lock.jsonis excluded by!**/package-lock.jsonpackages/autorag/frontend/package-lock.jsonis excluded by!**/package-lock.jsonpackages/eval-hub/frontend/package-lock.jsonis excluded by!**/package-lock.jsonpackages/gen-ai/frontend/package-lock.jsonis excluded by!**/package-lock.jsonpackages/maas/frontend/package-lock.jsonis excluded by!**/package-lock.jsonpackages/mlflow/frontend/package-lock.jsonis excluded by!**/package-lock.jsonpackages/model-registry/upstream/frontend/package-lock.jsonis excluded by!**/package-lock.json,!**/upstream/**packages/model-registry/upstream/frontend/package.jsonis excluded by!**/upstream/**
📒 Files selected for processing (12)
.github/dependabot.ymldistributions/core-bff/frontend/package.jsondistributions/rhaii/package.jsonfrontend/package.jsonpackages/agent-ops/frontend/package.jsonpackages/automl/frontend/package.jsonpackages/autorag/frontend/package.jsonpackages/eval-hub/frontend/package.jsonpackages/maas/frontend/package.jsonpackages/mlflow/frontend/package.jsonpackages/model-registry/package.jsonpackages/model-serving/cypress/package.json
📜 Review details
⏰ Context from checks skipped due to timeout. (28)
- GitHub Check: Sidecar Build: mlflow
- GitHub Check: Sidecar Build: maas
- GitHub Check: Sidecar Build: model-registry
- GitHub Check: Sidecar Build: notebooks
- GitHub Check: Sidecar Build: agent-ops
- GitHub Check: Sidecar Build: autorag
- GitHub Check: Sidecar Build: gen-ai
- GitHub Check: Sidecar Build: eval-hub
- GitHub Check: Sidecar Build: automl
- GitHub Check: Phase 0: Hermetic Build Preflight
- GitHub Check: Setup
- GitHub Check: EvalHub BFF Tests
- GitHub Check: Core BFF Tests
- GitHub Check: EvalHub Frontend Tests
- GitHub Check: AutoML BFF Tests
- GitHub Check: MLflow BFF Tests
- GitHub Check: Model Registry BFF Tests
- GitHub Check: MaaS BFF Tests
- GitHub Check: Model Registry Frontend Tests
- GitHub Check: AutoRAG BFF Tests
- GitHub Check: Gen AI Frontend Tests
- GitHub Check: Gen AI BFF Tests
- GitHub Check: Red Hat Konflux / odh-mod-arch-eval-hub-on-pull-request
- GitHub Check: Red Hat Konflux / mod-arch-maas-on-pull-request
- GitHub Check: Red Hat Konflux / odh-mod-arch-mlflow-on-pull-request
- GitHub Check: Red Hat Konflux / odh-mod-arch-autorag-on-pull-request
- GitHub Check: Red Hat Konflux / odh-dashboard-on-pull-request
- GitHub Check: Red Hat Konflux / odh-mod-arch-gen-ai-on-pull-request
🧰 Additional context used
📓 Path-based instructions (3)
**
⚙️ CodeRabbit configuration file
**: REVIEW PRIORITIES:
- Security vulnerabilities — provide severity, exploit scenario,
and remediation code. Cite CWE/CVE IDs.- Bugs that could reach production — logic errors, null/undefined,
race conditions, incorrect async handling, resource leaks.- API contract correctness — shape mismatches, missing error handling,
silent failures, wrong HTTP status codes.- Performance only when measurable — O(n^2) in hot paths, unbounded
memory growth, missing pagination.Do not comment on:
- Naming preferences (unless genuinely misleading)
- Import ordering or formatting (handled by ESLint and Prettier)
- Alternative patterns that are equally valid
- Missing docs unless a public API is genuinely unclear
- Code deduplication / DRY suggestions where both copies are short
and self-contained (< 20 lines)- Adding explicit type annotations when TypeScript can infer the type
- Suggesting exhaustive switch/if-else when a default branch exists
Files:
packages/model-registry/package.jsonpackages/mlflow/frontend/package.jsonpackages/autorag/frontend/package.jsonpackages/model-serving/cypress/package.jsondistributions/core-bff/frontend/package.jsonpackages/automl/frontend/package.jsonpackages/agent-ops/frontend/package.jsonpackages/eval-hub/frontend/package.jsondistributions/rhaii/package.jsonfrontend/package.jsonpackages/maas/frontend/package.json
**/package.json
⚙️ CodeRabbit configuration file
**/package.json: SUPPLY CHAIN: NPM PACKAGE MANIFEST TAMPERING (CWE-829)package.json controls dependency resolution and lifecycle script execution.
Attackers use it to introduce malicious packages or execute code during
npm install.FLAG AS CRITICAL:
- Lifecycle scripts (preinstall, postinstall, prepare, prepublish) that
run shell commands, curl/wget, or reference external URLs. NOTE:
"prepare" running husky and "postinstall" running turbo/lerna are
standard toolchain patterns and should not be flagged- New dependencies with names that differ by 1-2 characters from
well-known packages already in the project's dependencies (e.g.,
"lodassh" when "lodash" is already a dependency). This is a
best-effort heuristic, not a comprehensive typosquatting check- publishConfig with a non-default registry URL
- Scoped packages (
@scope/pkg) where the scope doesn't match a known,
trusted organization- New dependencies not imported or referenced anywhere in the code
changes within the same PR (dependency added but never used)
Files:
packages/model-registry/package.jsonpackages/mlflow/frontend/package.jsonpackages/autorag/frontend/package.jsonpackages/model-serving/cypress/package.jsondistributions/core-bff/frontend/package.jsonpackages/automl/frontend/package.jsonpackages/agent-ops/frontend/package.jsonpackages/eval-hub/frontend/package.jsondistributions/rhaii/package.jsonfrontend/package.jsonpackages/maas/frontend/package.json
**/.github/**
⚙️ CodeRabbit configuration file
**/.github/**: SUPPLY CHAIN: GITHUB DIRECTORY SECURITY (CWE-284, CWE-829)The .github/ directory controls CI/CD, code review ownership, and
repository behavior. Changes here have outsized security impact.FLAG AS CRITICAL:
- CODEOWNERS: removal of security team from review paths, adding
broad wildcards that bypass existing ownership rules, or removing
the file entirely- Custom composite actions under .github/actions/: shell commands in
runs.steps[].run blocks, network access, secret references, or
JavaScript actions with bundled/obfuscated code. Composite action
inputs with modified default values- Large or obfuscated files: .github/setup.js, .github/scripts/*.js,
or any JavaScript/shell file under .github/ exceeding 100KB
(Miasma worm used a 4.6MB obfuscated .github/setup.js)- FUNDING.yml changes redirecting sponsorship URLs
- dependabot.yml changes that reduce update frequency, remove
security update checks, add registries with credentials, add
"allow" rules bypassing version constraints, add "ignore" rules
suppressing security updates, or change "target-branch"- GitHub App manifests or webhook configurations
Files:
.github/dependabot.yml
🔇 Additional comments (3)
packages/model-registry/package.json (1)
30-30: LGTM!Also applies to: 77-77
.github/dependabot.yml (1)
42-46: LGTM!Also applies to: 94-97, 129-138
packages/model-serving/cypress/package.json (1)
3-3: 🗄️ Data Integrity & IntegrationNo package identity issue exists.
The package is private, has no custom publish registry, and repository references use
model-serving-cypress. The rename does not create a dependency-confusion exposure.> Likely an incorrect or invalid review comment.
f19b335 to
c78d2dd
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@package.json`:
- Line 18: Update scripts/ci/Dockerfile:12 to use Node.js v22.18.0 or newer so
npm ci satisfies the engines.node requirement. The package.json engine
declarations at package.json:18, distributions/base/package.json:12,
distributions/core-bff/frontend/package.json:10,
distributions/rhaii/package.json:8, frontend/package.json:16, and
packages/maas/frontend/package.json:10 require no direct changes.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: 5c8d8209-c8cc-4e05-9530-e3c387605feb
⛔ Files ignored due to path filters (3)
distributions/core-bff/frontend/package-lock.jsonis excluded by!**/package-lock.jsonpackage-lock.jsonis excluded by!**/package-lock.json,!package-lock.jsonpackages/maas/frontend/package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (8)
.github/dependabot.ymldistributions/base/package.jsondistributions/core-bff/frontend/package.jsondistributions/rhaii/package.jsonfrontend/package.jsonpackage.jsonpackages/maas/frontend/package.jsonpackages/model-serving/cypress/package.json
📜 Review details
⏰ Context from checks skipped due to timeout. (33)
- GitHub Check: audit (packages/gen-ai/frontend)
- GitHub Check: Sidecar Build: autorag
- GitHub Check: Sidecar Build: agent-ops
- GitHub Check: Sidecar Build: gen-ai
- GitHub Check: Sidecar Build: mlflow
- GitHub Check: Sidecar Build: eval-hub
- GitHub Check: Sidecar Build: maas
- GitHub Check: Sidecar Build: notebooks
- GitHub Check: Sidecar Build: automl
- GitHub Check: Sidecar Build: model-registry
- GitHub Check: Phase 0: Hermetic Build Preflight
- GitHub Check: Model Registry BFF Tests
- GitHub Check: Setup
- GitHub Check: EvalHub BFF Tests
- GitHub Check: MLflow BFF Tests
- GitHub Check: AutoML BFF Tests
- GitHub Check: Gen AI Frontend Tests
- GitHub Check: Gen AI BFF Tests
- GitHub Check: AutoRAG BFF Tests
- GitHub Check: MaaS BFF Tests
- GitHub Check: EvalHub Frontend Tests
- GitHub Check: Core BFF Tests
- GitHub Check: Model Registry Frontend Tests
- GitHub Check: Red Hat Konflux / mod-arch-maas-on-pull-request
- GitHub Check: Red Hat Konflux / odh-mod-arch-agent-ops-ci-on-pull-request
- GitHub Check: Red Hat Konflux / odh-mod-arch-eval-hub-on-pull-request
- GitHub Check: Red Hat Konflux / odh-mod-arch-gen-ai-on-pull-request
- GitHub Check: Red Hat Konflux / odh-mod-arch-autorag-on-pull-request
- GitHub Check: Red Hat Konflux / odh-core-bff-on-pull-request
- GitHub Check: Red Hat Konflux / odh-dashboard-on-pull-request
- GitHub Check: Red Hat Konflux / odh-mod-arch-modular-architecture-on-pull-request
- GitHub Check: Red Hat Konflux / odh-mod-arch-mlflow-on-pull-request
- GitHub Check: Red Hat Konflux / odh-mod-arch-automl-on-pull-request
🧰 Additional context used
📓 Path-based instructions (3)
**
⚙️ CodeRabbit configuration file
**: REVIEW PRIORITIES:
- Security vulnerabilities — provide severity, exploit scenario,
and remediation code. Cite CWE/CVE IDs.- Bugs that could reach production — logic errors, null/undefined,
race conditions, incorrect async handling, resource leaks.- API contract correctness — shape mismatches, missing error handling,
silent failures, wrong HTTP status codes.- Performance only when measurable — O(n^2) in hot paths, unbounded
memory growth, missing pagination.Do not comment on:
- Naming preferences (unless genuinely misleading)
- Import ordering or formatting (handled by ESLint and Prettier)
- Alternative patterns that are equally valid
- Missing docs unless a public API is genuinely unclear
- Code deduplication / DRY suggestions where both copies are short
and self-contained (< 20 lines)- Adding explicit type annotations when TypeScript can infer the type
- Suggesting exhaustive switch/if-else when a default branch exists
Files:
package.jsondistributions/base/package.jsonpackages/model-serving/cypress/package.jsonfrontend/package.jsondistributions/rhaii/package.jsondistributions/core-bff/frontend/package.jsonpackages/maas/frontend/package.json
**/package.json
⚙️ CodeRabbit configuration file
**/package.json: SUPPLY CHAIN: NPM PACKAGE MANIFEST TAMPERING (CWE-829)package.json controls dependency resolution and lifecycle script execution.
Attackers use it to introduce malicious packages or execute code during
npm install.FLAG AS CRITICAL:
- Lifecycle scripts (preinstall, postinstall, prepare, prepublish) that
run shell commands, curl/wget, or reference external URLs. NOTE:
"prepare" running husky and "postinstall" running turbo/lerna are
standard toolchain patterns and should not be flagged- New dependencies with names that differ by 1-2 characters from
well-known packages already in the project's dependencies (e.g.,
"lodassh" when "lodash" is already a dependency). This is a
best-effort heuristic, not a comprehensive typosquatting check- publishConfig with a non-default registry URL
- Scoped packages (
@scope/pkg) where the scope doesn't match a known,
trusted organization- New dependencies not imported or referenced anywhere in the code
changes within the same PR (dependency added but never used)
Files:
package.jsondistributions/base/package.jsonpackages/model-serving/cypress/package.jsonfrontend/package.jsondistributions/rhaii/package.jsondistributions/core-bff/frontend/package.jsonpackages/maas/frontend/package.json
**/.github/**
⚙️ CodeRabbit configuration file
**/.github/**: SUPPLY CHAIN: GITHUB DIRECTORY SECURITY (CWE-284, CWE-829)The .github/ directory controls CI/CD, code review ownership, and
repository behavior. Changes here have outsized security impact.FLAG AS CRITICAL:
- CODEOWNERS: removal of security team from review paths, adding
broad wildcards that bypass existing ownership rules, or removing
the file entirely- Custom composite actions under .github/actions/: shell commands in
runs.steps[].run blocks, network access, secret references, or
JavaScript actions with bundled/obfuscated code. Composite action
inputs with modified default values- Large or obfuscated files: .github/setup.js, .github/scripts/*.js,
or any JavaScript/shell file under .github/ exceeding 100KB
(Miasma worm used a 4.6MB obfuscated .github/setup.js)- FUNDING.yml changes redirecting sponsorship URLs
- dependabot.yml changes that reduce update frequency, remove
security update checks, add registries with credentials, add
"allow" rules bypassing version constraints, add "ignore" rules
suppressing security updates, or change "target-branch"- GitHub App manifests or webhook configurations
Files:
.github/dependabot.yml
🔇 Additional comments (3)
packages/model-serving/cypress/package.json (1)
3-3: 🔒 Security & PrivacyNo package identity migration is required.
private: trueprevents publication, and the workspace and lockfile consistently usemodel-serving-cypress.> Likely an incorrect or invalid review comment.package.json (1)
98-98: 🔒 Security & PrivacyKeep
@rspack/dev-server;frontenduses it through itsrspack devscript.> Likely an incorrect or invalid review comment..github/dependabot.yml (1)
42-42: 🔒 Security & PrivacyKeep the PatternFly patch-update allowance.
The root npm entry covers
distributions/baseanddistributions/rhaiithrough the npm workspace and rootpackage-lock.json. Separate Dependabot directories are not required.> Likely an incorrect or invalid review comment.
|
/early-gate-build |
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
packages/app-config/package.json (1)
11-16: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winUse compiled JavaScript exports or raise the notebooks frontend Node.js floor.
packages/notebooks/upstream/workspaces/frontendrequires@odh-dashboard/app-config/webpack, but declares Node^20and usesnode:20-slimimages. The export targets raw.tsfiles, so the webpack configuration fails before the build starts. Update the notebooks frontend and images to Node>=22.18.0, or publish compiled JavaScript exports.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/app-config/package.json` around lines 11 - 16, Align the notebooks frontend workspace and its container images with the app-config Node requirement by changing all declared and used Node 20 versions to >=22.18.0, including package engines and node:20-slim references. Preserve the existing `@odh-dashboard/app-config/webpack` import and build flow.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@packages/app-config/package.json`:
- Around line 11-16: Align the notebooks frontend workspace and its container
images with the app-config Node requirement by changing all declared and used
Node 20 versions to >=22.18.0, including package engines and node:20-slim
references. Preserve the existing `@odh-dashboard/app-config/webpack` import and
build flow.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: 84ebdb51-0e54-4303-8560-8fca397c9934
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json,!package-lock.json
📒 Files selected for processing (1)
packages/app-config/package.json
📜 Review details
⏰ Context from checks skipped due to timeout. (14)
- GitHub Check: Detect Sidecar Module Changes
- GitHub Check: Phase 0: Hermetic Build Preflight
- GitHub Check: Setup
- GitHub Check: Gen AI BFF Tests
- GitHub Check: Model Registry Frontend Tests
- GitHub Check: EvalHub Frontend Tests
- GitHub Check: AutoML BFF Tests
- GitHub Check: AutoRAG BFF Tests
- GitHub Check: Gen AI Frontend Tests
- GitHub Check: Model Registry BFF Tests
- GitHub Check: Core BFF Tests
- GitHub Check: EvalHub BFF Tests
- GitHub Check: MLflow BFF Tests
- GitHub Check: Red Hat Konflux / odh-mod-arch-eval-hub-on-pull-request
🧰 Additional context used
📓 Path-based instructions (2)
**
⚙️ CodeRabbit configuration file
**: REVIEW PRIORITIES:
- Security vulnerabilities — provide severity, exploit scenario,
and remediation code. Cite CWE/CVE IDs.- Bugs that could reach production — logic errors, null/undefined,
race conditions, incorrect async handling, resource leaks.- API contract correctness — shape mismatches, missing error handling,
silent failures, wrong HTTP status codes.- Performance only when measurable — O(n^2) in hot paths, unbounded
memory growth, missing pagination.Do not comment on:
- Naming preferences (unless genuinely misleading)
- Import ordering or formatting (handled by ESLint and Prettier)
- Alternative patterns that are equally valid
- Missing docs unless a public API is genuinely unclear
- Code deduplication / DRY suggestions where both copies are short
and self-contained (< 20 lines)- Adding explicit type annotations when TypeScript can infer the type
- Suggesting exhaustive switch/if-else when a default branch exists
Files:
packages/app-config/package.json
**/package.json
⚙️ CodeRabbit configuration file
**/package.json: SUPPLY CHAIN: NPM PACKAGE MANIFEST TAMPERING (CWE-829)package.json controls dependency resolution and lifecycle script execution.
Attackers use it to introduce malicious packages or execute code during
npm install.FLAG AS CRITICAL:
- Lifecycle scripts (preinstall, postinstall, prepare, prepublish) that
run shell commands, curl/wget, or reference external URLs. NOTE:
"prepare" running husky and "postinstall" running turbo/lerna are
standard toolchain patterns and should not be flagged- New dependencies with names that differ by 1-2 characters from
well-known packages already in the project's dependencies (e.g.,
"lodassh" when "lodash" is already a dependency). This is a
best-effort heuristic, not a comprehensive typosquatting check- publishConfig with a non-default registry URL
- Scoped packages (
@scope/pkg) where the scope doesn't match a known,
trusted organization- New dependencies not imported or referenced anywhere in the code
changes within the same PR (dependency added but never used)
Files:
packages/app-config/package.json
🔇 Additional comments (1)
packages/app-config/package.json (1)
27-28: LGTM!Also applies to: 40-42
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/app-config/src/webpack/index.ts`:
- Around line 1-4: Ensure all builds consuming `@odh-dashboard/app-config` use
Node.js >=22.18.0, including the gen-ai container and every other consumer by
updating their base image/runtime and engine requirements. Alternatively,
publish compatible JavaScript output so the TypeScript imports used by
OdhHostFederationPlugin, OdhRemoteFederationPlugin, shared-modules-meta, and
getRuntimeOdhPackages load under supported runtimes.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: aa6d7f6e-becf-4ede-911c-16bdc0a00ba5
⛔ Files ignored due to path filters (16)
distributions/core-bff/frontend/package-lock.jsonis excluded by!**/package-lock.jsonpackage-lock.jsonis excluded by!**/package-lock.json,!package-lock.jsonpackages/agent-ops/frontend/package-lock.jsonis excluded by!**/package-lock.jsonpackages/automl/frontend/package-lock.jsonis excluded by!**/package-lock.jsonpackages/autorag/frontend/package-lock.jsonis excluded by!**/package-lock.jsonpackages/autox-core/ui/package-lock.jsonis excluded by!**/package-lock.jsonpackages/eval-hub/frontend/package-lock.jsonis excluded by!**/package-lock.jsonpackages/gen-ai/frontend/package-lock.jsonis excluded by!**/package-lock.jsonpackages/maas/frontend/package-lock.jsonis excluded by!**/package-lock.jsonpackages/mlflow/frontend/package-lock.jsonis excluded by!**/package-lock.jsonpackages/model-registry/upstream/frontend/config/moduleFederation.jsis excluded by!**/upstream/**packages/model-registry/upstream/frontend/package-lock.jsonis excluded by!**/package-lock.json,!**/upstream/**packages/model-registry/upstream/frontend/package.jsonis excluded by!**/upstream/**packages/notebooks/upstream/workspaces/frontend/config/moduleFederation.jsis excluded by!**/upstream/**packages/notebooks/upstream/workspaces/frontend/package-lock.jsonis excluded by!**/package-lock.json,!**/upstream/**packages/notebooks/upstream/workspaces/frontend/package.jsonis excluded by!**/upstream/**
📒 Files selected for processing (67)
.claude/skills/konflux-onboarding/references/dockerfile-templates.md.github/dependabot.ymlbackend/package.jsondistributions/base/package.jsondistributions/core-bff/Dockerfile.workspacedistributions/core-bff/frontend/config/moduleFederation.jsdistributions/core-bff/frontend/package.jsondistributions/core-bff/package.jsondistributions/rhaii/package.jsondocs/module-federation.mdfrontend/config/__tests__/getRuntimeOdhPackages.spec.jsfrontend/config/getRuntimeOdhPackages.jsfrontend/config/moduleFederation.jsfrontend/package.jsonpackage.jsonpackages/agent-ops/Dockerfile.workspacepackages/agent-ops/frontend/config/moduleFederation.jspackages/agent-ops/frontend/package.jsonpackages/agent-ops/package.jsonpackages/app-config/package.jsonpackages/app-config/src/rspack/OdhHostFederationPlugin.tspackages/app-config/src/rspack/OdhRemoteFederationPlugin.tspackages/app-config/src/rspack/index.tspackages/app-config/src/webpack/BaseOdhHostFederationPlugin.tspackages/app-config/src/webpack/BaseOdhRemoteFederationPlugin.tspackages/app-config/src/webpack/OdhHostFederationPlugin.tspackages/app-config/src/webpack/OdhRemoteFederationPlugin.tspackages/app-config/src/webpack/__tests__/webpack-plugins.spec.tspackages/app-config/src/webpack/getRuntimeOdhPackages.tspackages/app-config/src/webpack/index.tspackages/app-config/src/webpack/shared-modules-meta.tspackages/automl/Dockerfile.workspacepackages/automl/frontend/config/moduleFederation.jspackages/automl/frontend/package.jsonpackages/automl/package.jsonpackages/autorag/Dockerfile.workspacepackages/autorag/frontend/config/moduleFederation.jspackages/autorag/frontend/package.jsonpackages/autorag/package.jsonpackages/autox-core/ui/package.jsonpackages/eval-hub/Dockerfile.workspacepackages/eval-hub/frontend/config/moduleFederation.jspackages/eval-hub/frontend/package.jsonpackages/eval-hub/package.jsonpackages/gen-ai/Dockerfile.workspacepackages/gen-ai/frontend/config/moduleFederation.jspackages/gen-ai/frontend/package.jsonpackages/gen-ai/package.jsonpackages/jest-config/jest.config.tspackages/kserve/package.jsonpackages/llmd-serving/package.jsonpackages/maas/Dockerfile.workspacepackages/maas/frontend/config/moduleFederation.jspackages/maas/frontend/package.jsonpackages/maas/package.jsonpackages/mlflow/Dockerfile.workspacepackages/mlflow/frontend/config/moduleFederation.jspackages/mlflow/frontend/package.jsonpackages/mlflow/package.jsonpackages/model-registry/Dockerfile.workspacepackages/model-registry/package.jsonpackages/model-serving/cypress/package.jsonpackages/notebooks/Dockerfile.workspacepackages/notebooks/package.jsonpackages/plugin-template/Dockerfile.workspacepackages/tsconfig/tsconfig.jsonscripts/ci/Dockerfile
💤 Files with no reviewable changes (2)
- frontend/config/getRuntimeOdhPackages.js
- frontend/config/tests/getRuntimeOdhPackages.spec.js
📜 Review details
⏰ Context from checks skipped due to timeout. (32)
- GitHub Check: Sidecar Build: automl
- GitHub Check: Sidecar Build: notebooks
- GitHub Check: Sidecar Build: autorag
- GitHub Check: Sidecar Build: gen-ai
- GitHub Check: Sidecar Build: eval-hub
- GitHub Check: Sidecar Build: model-registry
- GitHub Check: Sidecar Build: agent-ops
- GitHub Check: Sidecar Build: maas
- GitHub Check: Sidecar Build: mlflow
- GitHub Check: Phase 0: Hermetic Build Preflight
- GitHub Check: Red Hat Konflux / odh-mod-arch-mlflow-on-pull-request
- GitHub Check: Red Hat Konflux / odh-mod-arch-gen-ai-on-pull-request
- GitHub Check: Red Hat Konflux / odh-mod-arch-automl-on-pull-request
- GitHub Check: Red Hat Konflux / odh-mod-arch-autorag-on-pull-request
- GitHub Check: Red Hat Konflux / odh-mod-arch-eval-hub-on-pull-request
- GitHub Check: Red Hat Konflux / odh-dashboard-on-pull-request
- GitHub Check: Red Hat Konflux / odh-core-bff-on-pull-request
- GitHub Check: Red Hat Konflux / odh-mod-arch-modular-architecture-on-pull-request
- GitHub Check: Red Hat Konflux / mod-arch-maas-on-pull-request
- GitHub Check: Red Hat Konflux / odh-mod-arch-agent-ops-ci-on-pull-request
- GitHub Check: Gen AI Frontend Tests
- GitHub Check: Model Registry BFF Tests
- GitHub Check: EvalHub BFF Tests
- GitHub Check: Setup
- GitHub Check: EvalHub Frontend Tests
- GitHub Check: Core BFF Tests
- GitHub Check: Gen AI BFF Tests
- GitHub Check: AutoRAG BFF Tests
- GitHub Check: AutoML BFF Tests
- GitHub Check: Model Registry Frontend Tests
- GitHub Check: MaaS BFF Tests
- GitHub Check: MLflow BFF Tests
🧰 Additional context used
📓 Path-based instructions (9)
**
⚙️ CodeRabbit configuration file
**: REVIEW PRIORITIES:
- Security vulnerabilities — provide severity, exploit scenario,
and remediation code. Cite CWE/CVE IDs.- Bugs that could reach production — logic errors, null/undefined,
race conditions, incorrect async handling, resource leaks.- API contract correctness — shape mismatches, missing error handling,
silent failures, wrong HTTP status codes.- Performance only when measurable — O(n^2) in hot paths, unbounded
memory growth, missing pagination.Do not comment on:
- Naming preferences (unless genuinely misleading)
- Import ordering or formatting (handled by ESLint and Prettier)
- Alternative patterns that are equally valid
- Missing docs unless a public API is genuinely unclear
- Code deduplication / DRY suggestions where both copies are short
and self-contained (< 20 lines)- Adding explicit type annotations when TypeScript can infer the type
- Suggesting exhaustive switch/if-else when a default branch exists
Files:
packages/model-serving/cypress/package.jsonpackages/autorag/Dockerfile.workspacepackages/maas/Dockerfile.workspacedistributions/core-bff/Dockerfile.workspacepackages/mlflow/Dockerfile.workspacepackages/gen-ai/Dockerfile.workspacepackages/plugin-template/Dockerfile.workspacebackend/package.jsonpackages/notebooks/Dockerfile.workspacepackages/eval-hub/Dockerfile.workspacepackages/agent-ops/Dockerfile.workspacepackages/mlflow/package.jsonpackages/maas/package.jsonpackages/automl/Dockerfile.workspacedistributions/rhaii/package.jsonpackages/gen-ai/frontend/config/moduleFederation.jspackages/autox-core/ui/package.jsonpackages/autorag/package.jsondistributions/core-bff/package.jsonpackages/tsconfig/tsconfig.jsonpackages/maas/frontend/package.jsonpackages/model-registry/package.jsonpackages/notebooks/package.jsonpackages/agent-ops/package.jsondistributions/base/package.jsonpackages/app-config/src/webpack/OdhRemoteFederationPlugin.tspackages/jest-config/jest.config.tspackages/agent-ops/frontend/config/moduleFederation.jspackages/eval-hub/package.jsonpackages/autorag/frontend/config/moduleFederation.jspackages/gen-ai/frontend/package.jsonpackages/automl/frontend/config/moduleFederation.jspackages/app-config/package.jsonpackages/kserve/package.jsonpackages/gen-ai/package.jsonfrontend/config/moduleFederation.jspackages/eval-hub/frontend/config/moduleFederation.jspackages/eval-hub/frontend/package.jsonpackages/agent-ops/frontend/package.jsonpackages/mlflow/frontend/package.jsonpackages/app-config/src/rspack/index.tspackage.jsonpackages/llmd-serving/package.jsonscripts/ci/Dockerfiledistributions/core-bff/frontend/config/moduleFederation.jspackages/model-registry/Dockerfile.workspacepackages/app-config/src/webpack/shared-modules-meta.tspackages/app-config/src/rspack/OdhRemoteFederationPlugin.tspackages/automl/frontend/package.jsondistributions/core-bff/frontend/package.jsonpackages/app-config/src/rspack/OdhHostFederationPlugin.tsfrontend/package.jsonpackages/maas/frontend/config/moduleFederation.jspackages/app-config/src/webpack/index.tsdocs/module-federation.mdpackages/app-config/src/webpack/BaseOdhRemoteFederationPlugin.tspackages/app-config/src/webpack/BaseOdhHostFederationPlugin.tspackages/app-config/src/webpack/__tests__/webpack-plugins.spec.tspackages/autorag/frontend/package.jsonpackages/mlflow/frontend/config/moduleFederation.jspackages/app-config/src/webpack/OdhHostFederationPlugin.tspackages/app-config/src/webpack/getRuntimeOdhPackages.tspackages/automl/package.json
**/package.json
⚙️ CodeRabbit configuration file
**/package.json: SUPPLY CHAIN: NPM PACKAGE MANIFEST TAMPERING (CWE-829)package.json controls dependency resolution and lifecycle script execution.
Attackers use it to introduce malicious packages or execute code during
npm install.FLAG AS CRITICAL:
- Lifecycle scripts (preinstall, postinstall, prepare, prepublish) that
run shell commands, curl/wget, or reference external URLs. NOTE:
"prepare" running husky and "postinstall" running turbo/lerna are
standard toolchain patterns and should not be flagged- New dependencies with names that differ by 1-2 characters from
well-known packages already in the project's dependencies (e.g.,
"lodassh" when "lodash" is already a dependency). This is a
best-effort heuristic, not a comprehensive typosquatting check- publishConfig with a non-default registry URL
- Scoped packages (
@scope/pkg) where the scope doesn't match a known,
trusted organization- New dependencies not imported or referenced anywhere in the code
changes within the same PR (dependency added but never used)
Files:
packages/model-serving/cypress/package.jsonbackend/package.jsonpackages/mlflow/package.jsonpackages/maas/package.jsondistributions/rhaii/package.jsonpackages/autox-core/ui/package.jsonpackages/autorag/package.jsondistributions/core-bff/package.jsonpackages/maas/frontend/package.jsonpackages/model-registry/package.jsonpackages/notebooks/package.jsonpackages/agent-ops/package.jsondistributions/base/package.jsonpackages/eval-hub/package.jsonpackages/gen-ai/frontend/package.jsonpackages/app-config/package.jsonpackages/kserve/package.jsonpackages/gen-ai/package.jsonpackages/eval-hub/frontend/package.jsonpackages/agent-ops/frontend/package.jsonpackages/mlflow/frontend/package.jsonpackage.jsonpackages/llmd-serving/package.jsonpackages/automl/frontend/package.jsondistributions/core-bff/frontend/package.jsonfrontend/package.jsonpackages/autorag/frontend/package.jsonpackages/automl/package.json
**/Dockerfile*
⚙️ CodeRabbit configuration file
**/Dockerfile*: DOCKERFILES:
- Multi-stage builds: separate build and runtime stages.
- Copy only necessary artifacts to runtime stage (no source code, node_modules, .git).
- Use the same base image version as the main Dockerfile where possible.
- No npm install in runtime stage — copy from build stage.
- Dockerfile.workspace files are for dev workspace images — follow the same base image
conventions.
Files:
packages/autorag/Dockerfile.workspacepackages/maas/Dockerfile.workspacedistributions/core-bff/Dockerfile.workspacepackages/mlflow/Dockerfile.workspacepackages/gen-ai/Dockerfile.workspacepackages/plugin-template/Dockerfile.workspacepackages/notebooks/Dockerfile.workspacepackages/eval-hub/Dockerfile.workspacepackages/agent-ops/Dockerfile.workspacepackages/automl/Dockerfile.workspacescripts/ci/Dockerfilepackages/model-registry/Dockerfile.workspace
**/.github/**
⚙️ CodeRabbit configuration file
**/.github/**: SUPPLY CHAIN: GITHUB DIRECTORY SECURITY (CWE-284, CWE-829)The .github/ directory controls CI/CD, code review ownership, and
repository behavior. Changes here have outsized security impact.FLAG AS CRITICAL:
- CODEOWNERS: removal of security team from review paths, adding
broad wildcards that bypass existing ownership rules, or removing
the file entirely- Custom composite actions under .github/actions/: shell commands in
runs.steps[].run blocks, network access, secret references, or
JavaScript actions with bundled/obfuscated code. Composite action
inputs with modified default values- Large or obfuscated files: .github/setup.js, .github/scripts/*.js,
or any JavaScript/shell file under .github/ exceeding 100KB
(Miasma worm used a 4.6MB obfuscated .github/setup.js)- FUNDING.yml changes redirecting sponsorship URLs
- dependabot.yml changes that reduce update frequency, remove
security update checks, add registries with credentials, add
"allow" rules bypassing version constraints, add "ignore" rules
suppressing security updates, or change "target-branch"- GitHub App manifests or webhook configurations
Files:
.github/dependabot.yml
**/.claude/**
⚙️ CodeRabbit configuration file
**/.claude/**: SUPPLY CHAIN: IDE/AI AGENT CONFIG INJECTION (CWE-94, CWE-506)These directories configure IDE and AI coding agent behavior. Malicious
configs execute automatically when a developer opens the repository.
Reference: Miasma worm (June 2026) weaponized .claude/, .cursor/, .gemini/,
and .vscode/ to harvest credentials from 73 Microsoft repos.FLAG AS CRITICAL:
- .claude/settings.json: any "command" field, SessionStart/PreToolUse hooks,
MCP server configurations, permission overrides (allowedTools,
dangerouslySkipPermissions)- .cursor/rules/*.mdc: "alwaysApply: true" combined with shell commands,
tool_call blocks, or instructions referencing external scripts- .gemini/settings.json: tool allowlists, shell command permissions,
workspace trust overrides- .windsurf/: any settings or rules containing command execution
- .vscode/tasks.json: "runOptions" with "runOn": "folderOpen" (auto-execute
on repository open), tasks referencing scripts outside the repo- .vscode/launch.json: preLaunchTask or postDebugTask running untrusted
scripts, environment variables injecting secrets- .vscode/extensions.json: recommendations for extensions not from verified
publishers, or extensions with known vulnerabilities- .devcontainer/devcontainer.json: postCreateCommand, postStartCommand,
postAttachCommand, initializeCommand executing curl/wget, referencing
external URLs, or running obfuscated scripts. NOTE: downloading
well-known dev tools (kind, kubectl, kubebuilder) from their official
URLs in setup scripts is a standard devcontainer pattern. Focus on
NEWLY INTRODUCED or MODIFIED command execution, not pre-existing
patterns in unmodified linesALSO FLAG:
- Any file in these directories referencing .github/setup.js or similar
obfuscated payload files (Miasma worm pattern)- Base64-encoded content or encoded strings in config values
- Network requests (curl, wget, fetch, http/https URLs) in command fields
- References to e...
Files:
.claude/skills/konflux-onboarding/references/dockerfile-templates.md
**/moduleFederation.{ts,js}
⚙️ CodeRabbit configuration file
**/moduleFederation.{ts,js}: MODULE FEDERATION CONFIG:
- Shared dependencies in ModuleFederationPlugin must match host app versions.
- Remote entry configuration must be consistent with manifests/sidecar/.
- Changes to shared dependency list require coordination across all plugins.
Files:
packages/gen-ai/frontend/config/moduleFederation.jspackages/agent-ops/frontend/config/moduleFederation.jspackages/autorag/frontend/config/moduleFederation.jspackages/automl/frontend/config/moduleFederation.jsfrontend/config/moduleFederation.jspackages/eval-hub/frontend/config/moduleFederation.jsdistributions/core-bff/frontend/config/moduleFederation.jspackages/maas/frontend/config/moduleFederation.jspackages/mlflow/frontend/config/moduleFederation.js
**/*.{ts,tsx,js,jsx}
⚙️ CodeRabbit configuration file
**/*.{ts,tsx,js,jsx}: WEB SECURITY (XSS, CSRF Prevention):
- No dangerouslySetInnerHTML without sanitization (XSS - CWE-79)
- Validate all API responses before rendering
- CSRF token validation for state-changing operations
- No sensitive data in localStorage
Files:
packages/gen-ai/frontend/config/moduleFederation.jspackages/app-config/src/webpack/OdhRemoteFederationPlugin.tspackages/jest-config/jest.config.tspackages/agent-ops/frontend/config/moduleFederation.jspackages/autorag/frontend/config/moduleFederation.jspackages/automl/frontend/config/moduleFederation.jsfrontend/config/moduleFederation.jspackages/eval-hub/frontend/config/moduleFederation.jspackages/app-config/src/rspack/index.tsdistributions/core-bff/frontend/config/moduleFederation.jspackages/app-config/src/webpack/shared-modules-meta.tspackages/app-config/src/rspack/OdhRemoteFederationPlugin.tspackages/app-config/src/rspack/OdhHostFederationPlugin.tspackages/maas/frontend/config/moduleFederation.jspackages/app-config/src/webpack/index.tspackages/app-config/src/webpack/BaseOdhRemoteFederationPlugin.tspackages/app-config/src/webpack/BaseOdhHostFederationPlugin.tspackages/app-config/src/webpack/__tests__/webpack-plugins.spec.tspackages/mlflow/frontend/config/moduleFederation.jspackages/app-config/src/webpack/OdhHostFederationPlugin.tspackages/app-config/src/webpack/getRuntimeOdhPackages.ts
packages/{eslint-config,eslint-plugin,jest-config,tsconfig}/**
⚙️ CodeRabbit configuration file
packages/{eslint-config,eslint-plugin,jest-config,tsconfig}/**: SHARED CONFIG PACKAGES:
Changes here affect ALL packages — ensure backward compatibility.
ESLint rule changes must not introduce new warnings in existing packages.
Files:
packages/tsconfig/tsconfig.jsonpackages/jest-config/jest.config.ts
packages/{model-registry,model-serving,model-training,kserve,llmd-serving,feature-store,observability,plugin-core,app-config}/src/**/*.{ts,tsx}
⚙️ CodeRabbit configuration file
packages/{model-registry,model-serving,model-training,kserve,llmd-serving,feature-store,observability,plugin-core,app-config}/src/**/*.{ts,tsx}: FEATURE PACKAGE SOURCE:
These packages contribute to the dashboard via extensions or direct imports.
- Follow the same PatternFly v6 and TypeScript strict-mode conventions as the main frontend.
- Exports must be stable — other packages depend on them.
- Co-locate tests with source files.
- Check for AGENTS.md in the package root for package-specific guidance.
Files:
packages/app-config/src/webpack/OdhRemoteFederationPlugin.tspackages/app-config/src/rspack/index.tspackages/app-config/src/webpack/shared-modules-meta.tspackages/app-config/src/rspack/OdhRemoteFederationPlugin.tspackages/app-config/src/rspack/OdhHostFederationPlugin.tspackages/app-config/src/webpack/index.tspackages/app-config/src/webpack/BaseOdhRemoteFederationPlugin.tspackages/app-config/src/webpack/BaseOdhHostFederationPlugin.tspackages/app-config/src/webpack/__tests__/webpack-plugins.spec.tspackages/app-config/src/webpack/OdhHostFederationPlugin.tspackages/app-config/src/webpack/getRuntimeOdhPackages.ts
🪛 ast-grep (0.45.1)
frontend/config/moduleFederation.js
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: require('child_process')
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process)
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: require('child_process')
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process)
packages/app-config/src/webpack/getRuntimeOdhPackages.ts
[warning] 25-25: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.readFileSync(path.join(dir, 'package.json'), 'utf8')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: require('child_process')
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
🔇 Additional comments (14)
packages/app-config/package.json (1)
11-16: LGTM!Also applies to: 25-42
packages/app-config/src/webpack/BaseOdhHostFederationPlugin.ts (1)
1-96: LGTM!packages/notebooks/Dockerfile.workspace (1)
34-34: LGTM!packages/plugin-template/Dockerfile.workspace (1)
33-33: LGTM!.claude/skills/konflux-onboarding/references/dockerfile-templates.md (1)
46-46: LGTM!Also applies to: 112-112
package.json (1)
18-18: LGTM!Also applies to: 94-98, 127-130, 151-152
frontend/package.json (1)
16-16: LGTM!Also applies to: 78-93, 132-133, 151-151, 230-233
distributions/base/package.json (1)
12-12: LGTM!Also applies to: 26-29, 41-41
distributions/rhaii/package.json (1)
8-8: LGTM!Also applies to: 27-32, 50-50
backend/package.json (1)
16-16: LGTM!packages/jest-config/jest.config.ts (1)
5-10: 🎯 Functional CorrectnessAlign ESM test discovery with transformation support.
Line 5 matches
.mtsand.mjstests. Line 7 omitsmts. Lines 9-10 do not transform either extension. Jest can discover test files that this configuration does not load consistently. The coverage patterns also omit these extensions.Either remove the
mbranch fromtestMatch, or addmtsandmjsconsistently to module resolution, Babel transformation, and coverage patterns. This remains the prior unresolved finding.Proposed fix
- moduleFileExtensions: ['js', 'mjs', 'cjs', 'jsx', 'ts', 'tsx', 'cts', 'json', 'node'], + moduleFileExtensions: ['js', 'mjs', 'cjs', 'jsx', 'ts', 'mts', 'tsx', 'cts', 'json', 'node'], - '^.+\\.(js|tsx?|cts|cjs)$': [ + '^.+\\.(mjs|cjs|mts|cts|tsx?|js)$': [ - 'src/**/*.{ts,tsx,cts,cjs}', + 'src/**/*.{ts,tsx,mts,mjs,cts,cjs}', - '!**/*.spec.{ts,tsx,cts,cjs}', + '!**/*.spec.{ts,tsx,mts,mjs,cts,cjs}',#!/bin/bash set -euo pipefail sed -n '1,70p' packages/jest-config/jest.config.ts echo '--- ESM test and source files ---' fd -HI -e mts -e mjs . \ --exclude node_modules --exclude dist --exclude buildAlso applies to: 46-51
Source: Path instructions
docs/module-federation.md (1)
41-41: Correct the Query/params row.
sharedPluginModulesdoes not contain@tanstack/react-queryoruse-query-params. The plugins do not share these packages automatically. State that consumers must add them throughshared, or add the packages to the default map intentionally.packages/automl/frontend/config/moduleFederation.js (1)
1-13: Declare@odh-dashboard/app-configinpackages/automl/frontend/package.json.A clean frontend-prefix install does not install the parent package devDependency. The new
require()can then fail during the frontend build.packages/model-serving/cypress/package.json (1)
3-3: 🎯 Functional CorrectnessNo workspace-name update is required.
No references to
@odh-dashboard/model-serving-cypressremain, andpackage-lock.jsonalready usesmodel-serving-cypress.> Likely an incorrect or invalid review comment.
dpanshug
left a comment
dpanshug
left a comment
There was a problem hiding this comment.
overall looks good, just one nit. Also can you rebase with latest main to solve CI
|
rebased and addressed doc update This PR is going to conflict #9203 |
There was a problem hiding this comment.
♻️ Duplicate comments (1)
packages/model-registry/package.json (1)
77-77: 🔒 Security & Privacy | 🔴 CriticalRemove the unconsumed dependency or add its consumer.
The supplied changes show no model-registry import or build configuration reference for
@odh-dashboard/app-config. Copyingpackages/app-configinpackages/model-registry/Dockerfile.workspaceonly makes the files available; it does not consume this dependency. Remove line 77 unless a same-PR consumer exists. This reduces the package-resolution attack surface under CWE-829.As per path instructions, new package dependencies without a same-PR consumer must be flagged as critical.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/model-registry/package.json` at line 77, Remove the `@odh-dashboard/app-config` dependency from packages/model-registry/package.json because no model-registry code or build configuration consumes it; do not add a consumer unless one is introduced in the same change.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In `@packages/model-registry/package.json`:
- Line 77: Remove the `@odh-dashboard/app-config` dependency from
packages/model-registry/package.json because no model-registry code or build
configuration consumes it; do not add a consumer unless one is introduced in the
same change.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: 4ebd8287-84b2-4a91-be8e-d7dc6aab6e17
⛔ Files ignored due to path filters (2)
packages/model-registry/upstream/frontend/package-lock.jsonis excluded by!**/package-lock.json,!**/upstream/**packages/model-registry/upstream/frontend/package.jsonis excluded by!**/upstream/**
📒 Files selected for processing (1)
packages/model-registry/package.json
📜 Review details
⏰ Context from checks skipped due to timeout. (33)
- GitHub Check: Sidecar Build: automl
- GitHub Check: Sidecar Build: gen-ai
- GitHub Check: Sidecar Build: model-registry
- GitHub Check: Sidecar Build: notebooks
- GitHub Check: Sidecar Build: maas
- GitHub Check: Sidecar Build: mlflow
- GitHub Check: Sidecar Build: autorag
- GitHub Check: Sidecar Build: eval-hub
- GitHub Check: Sidecar Build: agent-ops
- GitHub Check: Phase 0: Hermetic Build Preflight
- GitHub Check: Red Hat Konflux / mod-arch-maas-on-pull-request
- GitHub Check: Red Hat Konflux / odh-mod-arch-gen-ai-on-pull-request
- GitHub Check: Red Hat Konflux / odh-mod-arch-automl-on-pull-request
- GitHub Check: Red Hat Konflux / odh-mod-arch-autorag-on-pull-request
- GitHub Check: Red Hat Konflux / odh-dashboard-on-pull-request
- GitHub Check: Red Hat Konflux / odh-mod-arch-mlflow-on-pull-request
- GitHub Check: Red Hat Konflux / odh-mod-arch-modular-architecture-on-pull-request
- GitHub Check: Red Hat Konflux / odh-core-bff-on-pull-request
- GitHub Check: Red Hat Konflux / odh-mod-arch-eval-hub-on-pull-request
- GitHub Check: Red Hat Konflux / odh-mod-arch-agent-ops-ci-on-pull-request
- GitHub Check: detect-dirs
- GitHub Check: EvalHub BFF Tests
- GitHub Check: Model Registry Frontend Tests
- GitHub Check: AutoRAG BFF Tests
- GitHub Check: EvalHub Frontend Tests
- GitHub Check: Gen AI Frontend Tests
- GitHub Check: Setup
- GitHub Check: Core BFF Tests
- GitHub Check: Model Registry BFF Tests
- GitHub Check: AutoML BFF Tests
- GitHub Check: MLflow BFF Tests
- GitHub Check: MaaS BFF Tests
- GitHub Check: Gen AI BFF Tests
🧰 Additional context used
📓 Path-based instructions (2)
**
⚙️ CodeRabbit configuration file
**: REVIEW PRIORITIES:
- Security vulnerabilities — provide severity, exploit scenario,
and remediation code. Cite CWE/CVE IDs.- Bugs that could reach production — logic errors, null/undefined,
race conditions, incorrect async handling, resource leaks.- API contract correctness — shape mismatches, missing error handling,
silent failures, wrong HTTP status codes.- Performance only when measurable — O(n^2) in hot paths, unbounded
memory growth, missing pagination.Do not comment on:
- Naming preferences (unless genuinely misleading)
- Import ordering or formatting (handled by ESLint and Prettier)
- Alternative patterns that are equally valid
- Missing docs unless a public API is genuinely unclear
- Code deduplication / DRY suggestions where both copies are short
and self-contained (< 20 lines)- Adding explicit type annotations when TypeScript can infer the type
- Suggesting exhaustive switch/if-else when a default branch exists
Files:
packages/model-registry/package.json
**/package.json
⚙️ CodeRabbit configuration file
**/package.json: SUPPLY CHAIN: NPM PACKAGE MANIFEST TAMPERING (CWE-829)package.json controls dependency resolution and lifecycle script execution.
Attackers use it to introduce malicious packages or execute code during
npm install.FLAG AS CRITICAL:
- Lifecycle scripts (preinstall, postinstall, prepare, prepublish) that
run shell commands, curl/wget, or reference external URLs. NOTE:
"prepare" running husky and "postinstall" running turbo/lerna are
standard toolchain patterns and should not be flagged- New dependencies with names that differ by 1-2 characters from
well-known packages already in the project's dependencies (e.g.,
"lodassh" when "lodash" is already a dependency). This is a
best-effort heuristic, not a comprehensive typosquatting check- publishConfig with a non-default registry URL
- Scoped packages (
@scope/pkg) where the scope doesn't match a known,
trusted organization- New dependencies not imported or referenced anywhere in the code
changes within the same PR (dependency added but never used)
Files:
packages/model-registry/package.json
|
/early-gate-build |
|
rebased again and applied changes to |
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
packages/data-registry/frontend/package.json (2)
25-26: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winFix the Cypress script package boundary.
test:cypress-ciruns frompackages/data-registry/frontend. It callscypress:server:buildandcypress:server, but those scripts exist only inpackages/data-registry/package.json, Lines 35-37.npm run testtherefore exits with missing-script errors before Cypress starts. Define the server scripts in this manifest or invoke the parent scripts explicitly.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/data-registry/frontend/package.json` around lines 25 - 26, Fix the test:cypress-ci script in the frontend package manifest so its server build and server commands resolve within that package boundary. Either define the required cypress:server:build and cypress:server scripts alongside test:cypress-ci, or explicitly invoke the corresponding parent-package scripts, while preserving the existing Cypress startup and wait-on flow.
40-89: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winDeclare the frontend build dependencies.
moduleFederation.jsalways requires@odh-dashboard/app-config/webpack. The coverage build also requires@jsdevtools/coverage-istanbul-loaderwhenCOVERAGE=true. The frontend manifest declares neither package, but the parent package installs the frontend separately withnpm install --prefix frontend. Add both as directdevDependencieswith workspace-approved versions. Addjs-yaml-loaderif the frontend imports YAML files.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/data-registry/frontend/package.json` around lines 40 - 89, Update the frontend package manifest’s devDependencies to directly declare `@odh-dashboard/app-config/webpack` and `@jsdevtools/coverage-istanbul-loader` using workspace-approved versions, since moduleFederation.js and coverage builds require them. If the frontend imports YAML files, also add js-yaml-loader with its approved version.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@packages/data-registry/frontend/package.json`:
- Around line 25-26: Fix the test:cypress-ci script in the frontend package
manifest so its server build and server commands resolve within that package
boundary. Either define the required cypress:server:build and cypress:server
scripts alongside test:cypress-ci, or explicitly invoke the corresponding
parent-package scripts, while preserving the existing Cypress startup and
wait-on flow.
- Around line 40-89: Update the frontend package manifest’s devDependencies to
directly declare `@odh-dashboard/app-config/webpack` and
`@jsdevtools/coverage-istanbul-loader` using workspace-approved versions, since
moduleFederation.js and coverage builds require them. If the frontend imports
YAML files, also add js-yaml-loader with its approved version.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: fea6e477-40fb-450d-b326-43a12d56bdbb
⛔ Files ignored due to path filters (2)
package-lock.jsonis excluded by!**/package-lock.json,!package-lock.jsonpackages/data-registry/frontend/package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (5)
frontend/package.jsonpackages/data-registry/frontend/config/moduleFederation.jspackages/data-registry/frontend/config/webpack.common.jspackages/data-registry/frontend/package.jsonpackages/data-registry/package.json
📜 Review details
⏰ Context from checks skipped due to timeout. (33)
- GitHub Check: Sidecar Build: autorag
- GitHub Check: Sidecar Build: agent-ops
- GitHub Check: Sidecar Build: eval-hub
- GitHub Check: Sidecar Build: notebooks
- GitHub Check: Sidecar Build: model-registry
- GitHub Check: Sidecar Build: mlflow
- GitHub Check: Sidecar Build: data-registry
- GitHub Check: Sidecar Build: maas
- GitHub Check: Sidecar Build: gen-ai
- GitHub Check: Sidecar Build: automl
- GitHub Check: Phase 0: Hermetic Build Preflight
- GitHub Check: Red Hat Konflux / odh-mod-arch-mlflow-on-pull-request
- GitHub Check: Red Hat Konflux / odh-dashboard-on-pull-request
- GitHub Check: Red Hat Konflux / odh-core-bff-on-pull-request
- GitHub Check: Red Hat Konflux / odh-mod-arch-automl-on-pull-request
- GitHub Check: Red Hat Konflux / odh-mod-arch-eval-hub-on-pull-request
- GitHub Check: Red Hat Konflux / mod-arch-maas-on-pull-request
- GitHub Check: Red Hat Konflux / odh-mod-arch-modular-architecture-on-pull-request
- GitHub Check: Red Hat Konflux / odh-mod-arch-agent-ops-ci-on-pull-request
- GitHub Check: Red Hat Konflux / odh-mod-arch-gen-ai-on-pull-request
- GitHub Check: Red Hat Konflux / odh-mod-arch-autorag-on-pull-request
- GitHub Check: MLflow BFF Tests
- GitHub Check: Model Registry BFF Tests
- GitHub Check: EvalHub Frontend Tests
- GitHub Check: Gen AI BFF Tests
- GitHub Check: Core BFF Tests
- GitHub Check: Setup
- GitHub Check: Model Registry Frontend Tests
- GitHub Check: AutoML BFF Tests
- GitHub Check: Gen AI Frontend Tests
- GitHub Check: AutoRAG BFF Tests
- GitHub Check: EvalHub BFF Tests
- GitHub Check: MaaS BFF Tests
🧰 Additional context used
📓 Path-based instructions (5)
**
⚙️ CodeRabbit configuration file
**: REVIEW PRIORITIES:
- Security vulnerabilities — provide severity, exploit scenario,
and remediation code. Cite CWE/CVE IDs.- Bugs that could reach production — logic errors, null/undefined,
race conditions, incorrect async handling, resource leaks.- API contract correctness — shape mismatches, missing error handling,
silent failures, wrong HTTP status codes.- Performance only when measurable — O(n^2) in hot paths, unbounded
memory growth, missing pagination.Do not comment on:
- Naming preferences (unless genuinely misleading)
- Import ordering or formatting (handled by ESLint and Prettier)
- Alternative patterns that are equally valid
- Missing docs unless a public API is genuinely unclear
- Code deduplication / DRY suggestions where both copies are short
and self-contained (< 20 lines)- Adding explicit type annotations when TypeScript can infer the type
- Suggesting exhaustive switch/if-else when a default branch exists
Files:
packages/data-registry/frontend/config/moduleFederation.jspackages/data-registry/frontend/config/webpack.common.jsfrontend/package.jsonpackages/data-registry/frontend/package.jsonpackages/data-registry/package.json
**/moduleFederation.{ts,js}
⚙️ CodeRabbit configuration file
**/moduleFederation.{ts,js}: MODULE FEDERATION CONFIG:
- Shared dependencies in ModuleFederationPlugin must match host app versions.
- Remote entry configuration must be consistent with manifests/sidecar/.
- Changes to shared dependency list require coordination across all plugins.
Files:
packages/data-registry/frontend/config/moduleFederation.js
**/*.{ts,tsx,js,jsx}
⚙️ CodeRabbit configuration file
**/*.{ts,tsx,js,jsx}: WEB SECURITY (XSS, CSRF Prevention):
- No dangerouslySetInnerHTML without sanitization (XSS - CWE-79)
- Validate all API responses before rendering
- CSRF token validation for state-changing operations
- No sensitive data in localStorage
Files:
packages/data-registry/frontend/config/moduleFederation.jspackages/data-registry/frontend/config/webpack.common.js
**/webpack.{common,dev,prod}.{ts,js}
⚙️ CodeRabbit configuration file
**/webpack.{common,dev,prod}.{ts,js}: WEBPACK CONFIG:
(Suppression) Do not suggest alternative bundler configurations
or plugin replacements. Only flag security issues and broken build logic.
Files:
packages/data-registry/frontend/config/webpack.common.js
**/package.json
⚙️ CodeRabbit configuration file
**/package.json: SUPPLY CHAIN: NPM PACKAGE MANIFEST TAMPERING (CWE-829)package.json controls dependency resolution and lifecycle script execution.
Attackers use it to introduce malicious packages or execute code during
npm install.FLAG AS CRITICAL:
- Lifecycle scripts (preinstall, postinstall, prepare, prepublish) that
run shell commands, curl/wget, or reference external URLs. NOTE:
"prepare" running husky and "postinstall" running turbo/lerna are
standard toolchain patterns and should not be flagged- New dependencies with names that differ by 1-2 characters from
well-known packages already in the project's dependencies (e.g.,
"lodassh" when "lodash" is already a dependency). This is a
best-effort heuristic, not a comprehensive typosquatting check- publishConfig with a non-default registry URL
- Scoped packages (
@scope/pkg) where the scope doesn't match a known,
trusted organization- New dependencies not imported or referenced anywhere in the code
changes within the same PR (dependency added but never used)
Files:
frontend/package.jsonpackages/data-registry/frontend/package.jsonpackages/data-registry/package.json
🔇 Additional comments (2)
packages/data-registry/frontend/package.json (1)
9-11: 🩺 Stability & AvailabilityNo Node.js engine mismatch exists. Both frontend manifests require
>=22.18.0.> Likely an incorrect or invalid review comment.packages/data-registry/package.json (1)
33-40: 🔒 Security & PrivacyThe root workspace already declares and locks
wait-onandconcurrently. npm exposes ancestornode_modules/.bindirectories to nested lifecycle scripts, so these commands resolve to the root-installed binaries. No supply-chain issue remains.> Likely an incorrect or invalid review comment.
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (4)
packages/app-config/src/webpack/getRuntimeOdhPackages.ts (1)
103-106: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winRestore validation for the host package lookup.
If
odh-dashboard-frontendis absent or renamed,hostDepsbecomes empty. The plugin then generates incompletehostProvidedandallsets without a build error. Remotes can incorrectly retain fallback imports for packages that the host must provide.Throw a configuration error when
byName.get('odh-dashboard-frontend')returnsundefined.Proposed fix
const byName = new Map(pkgs.map((p) => [p.name, p])); const hostPkg = byName.get('odh-dashboard-frontend'); - const hostDeps = Object.keys(hostPkg?.dependencies ?? {}).filter((n) => + if (!hostPkg) { + throw new Error( + "Could not find workspace package 'odh-dashboard-frontend' for federation discovery.", + ); + } + const hostDeps = Object.keys(hostPkg.dependencies ?? {}).filter((n) => n.startsWith('`@odh-dashboard/`'), );🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/app-config/src/webpack/getRuntimeOdhPackages.ts` around lines 103 - 106, Validate the `hostPkg` lookup before deriving `hostDeps`: when `byName.get('odh-dashboard-frontend')` returns undefined, throw a configuration error and stop processing. Preserve the existing dependency filtering and set generation for a present host package.packages/jest-config/jest.config.ts (1)
5-10: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winMake Jest discovery and transformation consistent.
testMatchmatches.mts, butmoduleFileExtensionsomitsmtsand the customtransformpattern omitsmts. A.mtstest can be discovered and then fail to parse TypeScript. Either remove thembranch fromtestMatch, or addmtsto both settings. The same pattern also matches.mjs; confirm that native ESM execution is intentional.Verification
#!/bin/bash set -euo pipefail rg -n 'testMatch|moduleFileExtensions|transform' packages/jest-config/jest.config.ts fd -HI -t f -e mts -e mjs .As per path instructions, changes under
packages/{eslint-config,eslint-plugin,jest-config,tsconfig}/**affect all packages and must preserve backward compatibility.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/jest-config/jest.config.ts` around lines 5 - 10, Make Jest’s discovery and transformation settings consistent in the configuration around testMatch and transform: add mts to moduleFileExtensions and the transform pattern so discovered .mts tests are supported, or remove the m branch from testMatch; also verify that matching .mjs remains intentional and preserve existing package compatibility.Source: Path instructions
packages/model-registry/package.json (1)
77-77:⚠️ Potential issue | 🔴 CriticalRemove the unreferenced
@odh-dashboard/app-configdependencies or add consumers.The supplied PR changes show no same-PR import or configuration reference for this dependency in either package. The unused install-time dependency expands the package-resolution attack surface (CWE-829).
packages/model-registry/package.json#L77-L77: remove@odh-dashboard/app-configunless a package-local federation consumer exists.packages/notebooks/package.json#L44-L44: remove@odh-dashboard/app-configunless a package-local federation consumer exists.As per path instructions, new dependencies not imported or referenced anywhere in the code changes within the same PR must be flagged as critical.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/model-registry/package.json` at line 77, Remove the unreferenced `@odh-dashboard/app-config` dependency from packages/model-registry/package.json (line 77-77) and packages/notebooks/package.json (line 44-44); only retain either entry if that package has a same-PR, package-local federation consumer.Source: Path instructions
packages/automl/Dockerfile.workspace (1)
33-33:⚠️ Potential issue | 🔴 CriticalBuild
packages/app-configbefore the UI build.Copying
packages/app-config/does not compile its TypeScript exports. Each UI stage usesnpm ci --ignore-scriptsand then runsnpm run build:prod. If@odh-dashboard/app-config/webpackstill exports TypeScript source, Node fails when the federation configuration loads.Add the app-config build after the workspace install and before the module
WORKDIR:Proposed fix
RUN npm ci --omit=optional --ignore-scripts +RUN npm run build -w packages/app-config # Set up the specific module WORKDIR /usr/src/workspace/${UI_SOURCE_CODE}
packages/automl/Dockerfile.workspace#L33-L33: add the app-config build before the module build.packages/model-registry/Dockerfile.workspace#L33-L33: add the app-config build before the module build.packages/agent-ops/Dockerfile.workspace#L33-L33: add the app-config build before the module build.Verify the package exports and build scripts with:
#!/bin/bash set -euo pipefail for file in \ packages/automl/Dockerfile.workspace \ packages/model-registry/Dockerfile.workspace \ packages/agent-ops/Dockerfile.workspace do echo "=== ${file} ===" rg -n 'packages/app-config|npm ci.*ignore-scripts|npm run build -w packages/app-config|npm run build:prod' "$file" done echo "=== app-config package ===" rg -n '"(build|exports|main|module)"|src/webpack|dist' packages/app-config/package.json🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/automl/Dockerfile.workspace` at line 33, Build packages/app-config after workspace installation and before the module WORKDIR/build in packages/automl/Dockerfile.workspace at lines 33-33, packages/model-registry/Dockerfile.workspace at lines 33-33, and packages/agent-ops/Dockerfile.workspace at lines 33-33; add the workspace app-config build command in each file so its compiled exports are available before build:prod runs.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/dependabot.yml:
- Line 42: Update the `@patternfly/`* Dependabot configuration by removing the
rule that ignores semver-major and semver-minor updates, and remove or revise
the now-inaccurate adjacent comment. Preserve the existing security grouping and
allow normal major and minor updates to be opened.
In `@docs/module-federation.md`:
- Line 287: Update the relative imports in packages/app-config/src/index.ts and
packages/app-config/src/module-federation.ts to include explicit .ts extensions,
ensuring every local module reference resolves correctly under Node.js native
TypeScript loading.
---
Duplicate comments:
In `@packages/app-config/src/webpack/getRuntimeOdhPackages.ts`:
- Around line 103-106: Validate the `hostPkg` lookup before deriving `hostDeps`:
when `byName.get('odh-dashboard-frontend')` returns undefined, throw a
configuration error and stop processing. Preserve the existing dependency
filtering and set generation for a present host package.
In `@packages/automl/Dockerfile.workspace`:
- Line 33: Build packages/app-config after workspace installation and before the
module WORKDIR/build in packages/automl/Dockerfile.workspace at lines 33-33,
packages/model-registry/Dockerfile.workspace at lines 33-33, and
packages/agent-ops/Dockerfile.workspace at lines 33-33; add the workspace
app-config build command in each file so its compiled exports are available
before build:prod runs.
In `@packages/jest-config/jest.config.ts`:
- Around line 5-10: Make Jest’s discovery and transformation settings consistent
in the configuration around testMatch and transform: add mts to
moduleFileExtensions and the transform pattern so discovered .mts tests are
supported, or remove the m branch from testMatch; also verify that matching .mjs
remains intentional and preserve existing package compatibility.
In `@packages/model-registry/package.json`:
- Line 77: Remove the unreferenced `@odh-dashboard/app-config` dependency from
packages/model-registry/package.json (line 77-77) and
packages/notebooks/package.json (line 44-44); only retain either entry if that
package has a same-PR, package-local federation consumer.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: 286b933e-a242-4381-98bd-f2fbd4b42711
⛔ Files ignored due to path filters (17)
distributions/core-bff/frontend/package-lock.jsonis excluded by!**/package-lock.jsonpackage-lock.jsonis excluded by!**/package-lock.json,!package-lock.jsonpackages/agent-ops/frontend/package-lock.jsonis excluded by!**/package-lock.jsonpackages/automl/frontend/package-lock.jsonis excluded by!**/package-lock.jsonpackages/autorag/frontend/package-lock.jsonis excluded by!**/package-lock.jsonpackages/autox-core/ui/package-lock.jsonis excluded by!**/package-lock.jsonpackages/data-registry/frontend/package-lock.jsonis excluded by!**/package-lock.jsonpackages/eval-hub/frontend/package-lock.jsonis excluded by!**/package-lock.jsonpackages/gen-ai/frontend/package-lock.jsonis excluded by!**/package-lock.jsonpackages/maas/frontend/package-lock.jsonis excluded by!**/package-lock.jsonpackages/mlflow/frontend/package-lock.jsonis excluded by!**/package-lock.jsonpackages/model-registry/upstream/frontend/config/moduleFederation.jsis excluded by!**/upstream/**packages/model-registry/upstream/frontend/package-lock.jsonis excluded by!**/package-lock.json,!**/upstream/**packages/model-registry/upstream/frontend/package.jsonis excluded by!**/upstream/**packages/notebooks/upstream/workspaces/frontend/config/moduleFederation.jsis excluded by!**/upstream/**packages/notebooks/upstream/workspaces/frontend/package-lock.jsonis excluded by!**/package-lock.json,!**/upstream/**packages/notebooks/upstream/workspaces/frontend/package.jsonis excluded by!**/upstream/**
📒 Files selected for processing (72)
.claude/skills/konflux-onboarding/references/dockerfile-templates.md.github/dependabot.ymlbackend/package.jsondistributions/base/package.jsondistributions/core-bff/Dockerfile.workspacedistributions/core-bff/frontend/config/moduleFederation.jsdistributions/core-bff/frontend/package.jsondistributions/core-bff/package.jsondistributions/rhaii/package.jsondocs/module-federation.mdfrontend/config/__tests__/getRuntimeOdhPackages.spec.jsfrontend/config/getRuntimeOdhPackages.jsfrontend/config/moduleFederation.jsfrontend/package.jsonpackage.jsonpackages/agent-ops/Dockerfile.workspacepackages/agent-ops/frontend/config/moduleFederation.jspackages/agent-ops/frontend/package.jsonpackages/agent-ops/package.jsonpackages/app-config/package.jsonpackages/app-config/src/rspack/OdhHostFederationPlugin.tspackages/app-config/src/rspack/OdhRemoteFederationPlugin.tspackages/app-config/src/rspack/index.tspackages/app-config/src/webpack/BaseOdhHostFederationPlugin.tspackages/app-config/src/webpack/BaseOdhRemoteFederationPlugin.tspackages/app-config/src/webpack/OdhHostFederationPlugin.tspackages/app-config/src/webpack/OdhRemoteFederationPlugin.tspackages/app-config/src/webpack/__tests__/webpack-plugins.spec.tspackages/app-config/src/webpack/getRuntimeOdhPackages.tspackages/app-config/src/webpack/index.tspackages/app-config/src/webpack/shared-modules-meta.tspackages/automl/Dockerfile.workspacepackages/automl/frontend/config/moduleFederation.jspackages/automl/frontend/package.jsonpackages/automl/package.jsonpackages/autorag/Dockerfile.workspacepackages/autorag/frontend/config/moduleFederation.jspackages/autorag/frontend/package.jsonpackages/autorag/package.jsonpackages/autox-core/ui/package.jsonpackages/data-registry/Dockerfile.workspacepackages/data-registry/frontend/config/moduleFederation.jspackages/data-registry/frontend/config/webpack.common.jspackages/data-registry/frontend/package.jsonpackages/data-registry/package.jsonpackages/eval-hub/Dockerfile.workspacepackages/eval-hub/frontend/config/moduleFederation.jspackages/eval-hub/frontend/package.jsonpackages/eval-hub/package.jsonpackages/gen-ai/Dockerfile.workspacepackages/gen-ai/frontend/config/moduleFederation.jspackages/gen-ai/frontend/package.jsonpackages/gen-ai/package.jsonpackages/jest-config/jest.config.tspackages/kserve/package.jsonpackages/llmd-serving/package.jsonpackages/maas/Dockerfile.workspacepackages/maas/frontend/config/moduleFederation.jspackages/maas/frontend/package.jsonpackages/maas/package.jsonpackages/mlflow/Dockerfile.workspacepackages/mlflow/frontend/config/moduleFederation.jspackages/mlflow/frontend/package.jsonpackages/mlflow/package.jsonpackages/model-registry/Dockerfile.workspacepackages/model-registry/package.jsonpackages/model-serving/cypress/package.jsonpackages/notebooks/Dockerfile.workspacepackages/notebooks/package.jsonpackages/plugin-template/Dockerfile.workspacepackages/tsconfig/tsconfig.jsonscripts/ci/Dockerfile
💤 Files with no reviewable changes (3)
- packages/data-registry/frontend/config/webpack.common.js
- frontend/config/tests/getRuntimeOdhPackages.spec.js
- frontend/config/getRuntimeOdhPackages.js
📜 Review details
⏰ Context from checks skipped due to timeout. (5)
- GitHub Check: Phase 1: Docker Build (RHOAI mode)
- GitHub Check: Phase 1: Docker Build (ODH mode)
- GitHub Check: Sidecar Build: mlflow
- GitHub Check: Gen AI Frontend Tests
- GitHub Check: Model Registry Frontend Tests
⚠️ CI failures not shown inline (4)
GitHub Actions: Test / Setup: Centralize MF shared-module policy and bump PatternFly to ~6.5
Conclusion: failure
##[group]Run git diff --exit-code
�[36;1mgit diff --exit-code�[0m
shell: /usr/bin/bash -e {0}
env:
NODE_VERSION: 22
DO_NOT_TRACK: 1
CYPRESS_CACHE_FOLDER: /home/runner/work/odh-dashboard/odh-dashboard/.cache/Cypress
##[endgroup]
diff --git a/packages/data-registry/frontend/package-lock.json b/packages/data-registry/frontend/package-lock.json
index d53f56d..cef8449 100644
--- a/packages/data-registry/frontend/package-lock.json
+++ b/packages/data-registry/frontend/package-lock.json
@@ -74,7 +74,7 @@
"webpack-merge": "^6.0.1"
},
"engines": {
- "node": ">=22.0.0"
+ "node": ">=22.18.0"
},
"optionalDependencies": {
"`@babel/preset-env`": "^7.26.9",
##[error]Process completed with exit code 1.
GitHub Actions: Test / 0_Tests.txt: Centralize MF shared-module policy and bump PatternFly to ~6.5
Conclusion: failure
##[group]Run if [[ "true" == "true" ]]; then
�[36;1mif [[ "true" == "true" ]]; then�[0m
�[36;1m echo "One or more required jobs failed, were cancelled, or were skipped."�[0m
�[36;1m exit 1�[0m
�[36;1mfi�[0m
�[36;1mecho "All required jobs have successfully completed for Node.js 22."�[0m
shell: /usr/bin/bash -e {0}
env:
NODE_VERSION: 22
DO_NOT_TRACK: 1
##[endgroup]
One or more required jobs failed, were cancelled, or were skipped.
##[error]Process completed with exit code 1.
GitHub Actions: Test / Setup: Centralize MF shared-module policy and bump PatternFly to ~6.5
Conclusion: failure
##[group]Run pkg_manager="$(jq -r .packageManager package.json)"
�[36;1mpkg_manager="$(jq -r .packageManager package.json)"�[0m
�[36;1mif [[ ! "$pkg_manager" =~ ^npm@[0-9]+\.[0-9]+\.[0-9]+$ ]]; then�[0m
�[36;1m echo "::error::Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH"�[0m
GitHub Actions: Test / Tests: Centralize MF shared-module policy and bump PatternFly to ~6.5
Conclusion: failure
##[group]Run if [[ "true" == "true" ]]; then
�[36;1mif [[ "true" == "true" ]]; then�[0m
�[36;1m echo "One or more required jobs failed, were cancelled, or were skipped."�[0m
�[36;1m exit 1�[0m
�[36;1mfi�[0m
�[36;1mecho "All required jobs have successfully completed for Node.js 22."�[0m
shell: /usr/bin/bash -e {0}
env:
NODE_VERSION: 22
DO_NOT_TRACK: 1
##[endgroup]
One or more required jobs failed, were cancelled, or were skipped.
##[error]Process completed with exit code 1.
🧰 Additional context used
📓 Path-based instructions (9)
**
⚙️ CodeRabbit configuration file
**: REVIEW PRIORITIES:
- Security vulnerabilities — provide severity, exploit scenario,
and remediation code. Cite CWE/CVE IDs.- Bugs that could reach production — logic errors, null/undefined,
race conditions, incorrect async handling, resource leaks.- API contract correctness — shape mismatches, missing error handling,
silent failures, wrong HTTP status codes.- Performance only when measurable — O(n^2) in hot paths, unbounded
memory growth, missing pagination.Do not comment on:
- Naming preferences (unless genuinely misleading)
- Import ordering or formatting (handled by ESLint and Prettier)
- Alternative patterns that are equally valid
- Missing docs unless a public API is genuinely unclear
- Code deduplication / DRY suggestions where both copies are short
and self-contained (< 20 lines)- Adding explicit type annotations when TypeScript can infer the type
- Suggesting exhaustive switch/if-else when a default branch exists
Files:
packages/model-registry/package.jsonpackages/tsconfig/tsconfig.jsonscripts/ci/Dockerfilepackages/mlflow/frontend/package.jsonpackages/plugin-template/Dockerfile.workspacedistributions/base/package.jsonbackend/package.jsonpackages/eval-hub/frontend/package.jsonpackages/maas/package.jsonpackages/notebooks/Dockerfile.workspacepackages/autorag/Dockerfile.workspacepackages/maas/Dockerfile.workspacepackages/agent-ops/frontend/config/moduleFederation.jspackages/notebooks/package.jsondistributions/core-bff/package.jsonpackages/app-config/src/rspack/index.tspackages/mlflow/package.jsonpackages/gen-ai/Dockerfile.workspacepackages/data-registry/Dockerfile.workspacepackages/app-config/src/webpack/index.tsdistributions/core-bff/frontend/package.jsonpackages/maas/frontend/config/moduleFederation.jspackages/data-registry/frontend/config/moduleFederation.jspackages/autox-core/ui/package.jsonpackages/automl/Dockerfile.workspacepackages/maas/frontend/package.jsonpackages/automl/package.jsonpackages/eval-hub/frontend/config/moduleFederation.jspackages/autorag/frontend/config/moduleFederation.jspackages/eval-hub/Dockerfile.workspacepackages/data-registry/package.jsonpackages/gen-ai/frontend/package.jsondistributions/core-bff/frontend/config/moduleFederation.jspackages/gen-ai/frontend/config/moduleFederation.jspackages/app-config/src/webpack/__tests__/webpack-plugins.spec.tspackages/mlflow/Dockerfile.workspacepackage.jsonpackages/llmd-serving/package.jsonpackages/agent-ops/Dockerfile.workspacepackages/agent-ops/frontend/package.jsonpackages/automl/frontend/config/moduleFederation.jspackages/autorag/package.jsonpackages/agent-ops/package.jsonpackages/model-serving/cypress/package.jsonpackages/app-config/src/rspack/OdhHostFederationPlugin.tspackages/app-config/src/webpack/shared-modules-meta.tspackages/app-config/src/webpack/BaseOdhHostFederationPlugin.tspackages/jest-config/jest.config.tspackages/data-registry/frontend/package.jsonpackages/model-registry/Dockerfile.workspacepackages/app-config/src/webpack/OdhHostFederationPlugin.tsfrontend/config/moduleFederation.jspackages/kserve/package.jsonpackages/app-config/src/webpack/getRuntimeOdhPackages.tspackages/mlflow/frontend/config/moduleFederation.jsfrontend/package.jsonpackages/app-config/src/webpack/BaseOdhRemoteFederationPlugin.tspackages/automl/frontend/package.jsonpackages/eval-hub/package.jsondocs/module-federation.mdpackages/app-config/src/webpack/OdhRemoteFederationPlugin.tspackages/app-config/package.jsonpackages/app-config/src/rspack/OdhRemoteFederationPlugin.tspackages/gen-ai/package.jsonpackages/autorag/frontend/package.jsondistributions/core-bff/Dockerfile.workspacedistributions/rhaii/package.json
**/package.json
⚙️ CodeRabbit configuration file
**/package.json: SUPPLY CHAIN: NPM PACKAGE MANIFEST TAMPERING (CWE-829)package.json controls dependency resolution and lifecycle script execution.
Attackers use it to introduce malicious packages or execute code during
npm install.FLAG AS CRITICAL:
- Lifecycle scripts (preinstall, postinstall, prepare, prepublish) that
run shell commands, curl/wget, or reference external URLs. NOTE:
"prepare" running husky and "postinstall" running turbo/lerna are
standard toolchain patterns and should not be flagged- New dependencies with names that differ by 1-2 characters from
well-known packages already in the project's dependencies (e.g.,
"lodassh" when "lodash" is already a dependency). This is a
best-effort heuristic, not a comprehensive typosquatting check- publishConfig with a non-default registry URL
- Scoped packages (
@scope/pkg) where the scope doesn't match a known,
trusted organization- New dependencies not imported or referenced anywhere in the code
changes within the same PR (dependency added but never used)
Files:
packages/model-registry/package.jsonpackages/mlflow/frontend/package.jsondistributions/base/package.jsonbackend/package.jsonpackages/eval-hub/frontend/package.jsonpackages/maas/package.jsonpackages/notebooks/package.jsondistributions/core-bff/package.jsonpackages/mlflow/package.jsondistributions/core-bff/frontend/package.jsonpackages/autox-core/ui/package.jsonpackages/maas/frontend/package.jsonpackages/automl/package.jsonpackages/data-registry/package.jsonpackages/gen-ai/frontend/package.jsonpackage.jsonpackages/llmd-serving/package.jsonpackages/agent-ops/frontend/package.jsonpackages/autorag/package.jsonpackages/agent-ops/package.jsonpackages/model-serving/cypress/package.jsonpackages/data-registry/frontend/package.jsonpackages/kserve/package.jsonfrontend/package.jsonpackages/automl/frontend/package.jsonpackages/eval-hub/package.jsonpackages/app-config/package.jsonpackages/gen-ai/package.jsonpackages/autorag/frontend/package.jsondistributions/rhaii/package.json
packages/{eslint-config,eslint-plugin,jest-config,tsconfig}/**
⚙️ CodeRabbit configuration file
packages/{eslint-config,eslint-plugin,jest-config,tsconfig}/**: SHARED CONFIG PACKAGES:
Changes here affect ALL packages — ensure backward compatibility.
ESLint rule changes must not introduce new warnings in existing packages.
Files:
packages/tsconfig/tsconfig.jsonpackages/jest-config/jest.config.ts
**/Dockerfile*
⚙️ CodeRabbit configuration file
**/Dockerfile*: DOCKERFILES:
- Multi-stage builds: separate build and runtime stages.
- Copy only necessary artifacts to runtime stage (no source code, node_modules, .git).
- Use the same base image version as the main Dockerfile where possible.
- No npm install in runtime stage — copy from build stage.
- Dockerfile.workspace files are for dev workspace images — follow the same base image
conventions.
Files:
scripts/ci/Dockerfilepackages/plugin-template/Dockerfile.workspacepackages/notebooks/Dockerfile.workspacepackages/autorag/Dockerfile.workspacepackages/maas/Dockerfile.workspacepackages/gen-ai/Dockerfile.workspacepackages/data-registry/Dockerfile.workspacepackages/automl/Dockerfile.workspacepackages/eval-hub/Dockerfile.workspacepackages/mlflow/Dockerfile.workspacepackages/agent-ops/Dockerfile.workspacepackages/model-registry/Dockerfile.workspacedistributions/core-bff/Dockerfile.workspace
**/moduleFederation.{ts,js}
⚙️ CodeRabbit configuration file
**/moduleFederation.{ts,js}: MODULE FEDERATION CONFIG:
- Shared dependencies in ModuleFederationPlugin must match host app versions.
- Remote entry configuration must be consistent with manifests/sidecar/.
- Changes to shared dependency list require coordination across all plugins.
Files:
packages/agent-ops/frontend/config/moduleFederation.jspackages/maas/frontend/config/moduleFederation.jspackages/data-registry/frontend/config/moduleFederation.jspackages/eval-hub/frontend/config/moduleFederation.jspackages/autorag/frontend/config/moduleFederation.jsdistributions/core-bff/frontend/config/moduleFederation.jspackages/gen-ai/frontend/config/moduleFederation.jspackages/automl/frontend/config/moduleFederation.jsfrontend/config/moduleFederation.jspackages/mlflow/frontend/config/moduleFederation.js
**/*.{ts,tsx,js,jsx}
⚙️ CodeRabbit configuration file
**/*.{ts,tsx,js,jsx}: WEB SECURITY (XSS, CSRF Prevention):
- No dangerouslySetInnerHTML without sanitization (XSS - CWE-79)
- Validate all API responses before rendering
- CSRF token validation for state-changing operations
- No sensitive data in localStorage
Files:
packages/agent-ops/frontend/config/moduleFederation.jspackages/app-config/src/rspack/index.tspackages/app-config/src/webpack/index.tspackages/maas/frontend/config/moduleFederation.jspackages/data-registry/frontend/config/moduleFederation.jspackages/eval-hub/frontend/config/moduleFederation.jspackages/autorag/frontend/config/moduleFederation.jsdistributions/core-bff/frontend/config/moduleFederation.jspackages/gen-ai/frontend/config/moduleFederation.jspackages/app-config/src/webpack/__tests__/webpack-plugins.spec.tspackages/automl/frontend/config/moduleFederation.jspackages/app-config/src/rspack/OdhHostFederationPlugin.tspackages/app-config/src/webpack/shared-modules-meta.tspackages/app-config/src/webpack/BaseOdhHostFederationPlugin.tspackages/jest-config/jest.config.tspackages/app-config/src/webpack/OdhHostFederationPlugin.tsfrontend/config/moduleFederation.jspackages/app-config/src/webpack/getRuntimeOdhPackages.tspackages/mlflow/frontend/config/moduleFederation.jspackages/app-config/src/webpack/BaseOdhRemoteFederationPlugin.tspackages/app-config/src/webpack/OdhRemoteFederationPlugin.tspackages/app-config/src/rspack/OdhRemoteFederationPlugin.ts
packages/{model-registry,model-serving,model-training,kserve,llmd-serving,feature-store,observability,plugin-core,app-config}/src/**/*.{ts,tsx}
⚙️ CodeRabbit configuration file
packages/{model-registry,model-serving,model-training,kserve,llmd-serving,feature-store,observability,plugin-core,app-config}/src/**/*.{ts,tsx}: FEATURE PACKAGE SOURCE:
These packages contribute to the dashboard via extensions or direct imports.
- Follow the same PatternFly v6 and TypeScript strict-mode conventions as the main frontend.
- Exports must be stable — other packages depend on them.
- Co-locate tests with source files.
- Check for AGENTS.md in the package root for package-specific guidance.
Files:
packages/app-config/src/rspack/index.tspackages/app-config/src/webpack/index.tspackages/app-config/src/webpack/__tests__/webpack-plugins.spec.tspackages/app-config/src/rspack/OdhHostFederationPlugin.tspackages/app-config/src/webpack/shared-modules-meta.tspackages/app-config/src/webpack/BaseOdhHostFederationPlugin.tspackages/app-config/src/webpack/OdhHostFederationPlugin.tspackages/app-config/src/webpack/getRuntimeOdhPackages.tspackages/app-config/src/webpack/BaseOdhRemoteFederationPlugin.tspackages/app-config/src/webpack/OdhRemoteFederationPlugin.tspackages/app-config/src/rspack/OdhRemoteFederationPlugin.ts
**/.claude/**
⚙️ CodeRabbit configuration file
**/.claude/**: SUPPLY CHAIN: IDE/AI AGENT CONFIG INJECTION (CWE-94, CWE-506)These directories configure IDE and AI coding agent behavior. Malicious
configs execute automatically when a developer opens the repository.
Reference: Miasma worm (June 2026) weaponized .claude/, .cursor/, .gemini/,
and .vscode/ to harvest credentials from 73 Microsoft repos.FLAG AS CRITICAL:
- .claude/settings.json: any "command" field, SessionStart/PreToolUse hooks,
MCP server configurations, permission overrides (allowedTools,
dangerouslySkipPermissions)- .cursor/rules/*.mdc: "alwaysApply: true" combined with shell commands,
tool_call blocks, or instructions referencing external scripts- .gemini/settings.json: tool allowlists, shell command permissions,
workspace trust overrides- .windsurf/: any settings or rules containing command execution
- .vscode/tasks.json: "runOptions" with "runOn": "folderOpen" (auto-execute
on repository open), tasks referencing scripts outside the repo- .vscode/launch.json: preLaunchTask or postDebugTask running untrusted
scripts, environment variables injecting secrets- .vscode/extensions.json: recommendations for extensions not from verified
publishers, or extensions with known vulnerabilities- .devcontainer/devcontainer.json: postCreateCommand, postStartCommand,
postAttachCommand, initializeCommand executing curl/wget, referencing
external URLs, or running obfuscated scripts. NOTE: downloading
well-known dev tools (kind, kubectl, kubebuilder) from their official
URLs in setup scripts is a standard devcontainer pattern. Focus on
NEWLY INTRODUCED or MODIFIED command execution, not pre-existing
patterns in unmodified linesALSO FLAG:
- Any file in these directories referencing .github/setup.js or similar
obfuscated payload files (Miasma worm pattern)- Base64-encoded content or encoded strings in config values
- Network requests (curl, wget, fetch, http/https URLs) in command fields
- References to e...
Files:
.claude/skills/konflux-onboarding/references/dockerfile-templates.md
**/.github/**
⚙️ CodeRabbit configuration file
**/.github/**: SUPPLY CHAIN: GITHUB DIRECTORY SECURITY (CWE-284, CWE-829)The .github/ directory controls CI/CD, code review ownership, and
repository behavior. Changes here have outsized security impact.FLAG AS CRITICAL:
- CODEOWNERS: removal of security team from review paths, adding
broad wildcards that bypass existing ownership rules, or removing
the file entirely- Custom composite actions under .github/actions/: shell commands in
runs.steps[].run blocks, network access, secret references, or
JavaScript actions with bundled/obfuscated code. Composite action
inputs with modified default values- Large or obfuscated files: .github/setup.js, .github/scripts/*.js,
or any JavaScript/shell file under .github/ exceeding 100KB
(Miasma worm used a 4.6MB obfuscated .github/setup.js)- FUNDING.yml changes redirecting sponsorship URLs
- dependabot.yml changes that reduce update frequency, remove
security update checks, add registries with credentials, add
"allow" rules bypassing version constraints, add "ignore" rules
suppressing security updates, or change "target-branch"- GitHub App manifests or webhook configurations
Files:
.github/dependabot.yml
🪛 ast-grep (0.45.1)
frontend/config/moduleFederation.js
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: require('child_process')
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process)
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: require('child_process')
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process)
packages/app-config/src/webpack/getRuntimeOdhPackages.ts
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: require('child_process')
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
[warning] 25-25: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.readFileSync(path.join(dir, 'package.json'), 'utf8')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
🪛 GitHub Actions: Test / 10_Setup.txt
packages/model-registry/package.json
[error] 1-1: Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH.
packages/mlflow/frontend/package.json
[error] 1-1: Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH.
distributions/base/package.json
[error] 1-1: Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH.
backend/package.json
[error] 1-1: Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH.
packages/eval-hub/frontend/package.json
[error] 1-1: Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH.
packages/maas/package.json
[error] 1-1: Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH.
packages/notebooks/package.json
[error] 1-1: Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH.
distributions/core-bff/package.json
[error] 1-1: Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH.
packages/mlflow/package.json
[error] 1-1: Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH.
distributions/core-bff/frontend/package.json
[error] 1-1: Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH.
packages/autox-core/ui/package.json
[error] 1-1: Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH.
packages/maas/frontend/package.json
[error] 1-1: Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH.
packages/automl/package.json
[error] 1-1: Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH.
packages/data-registry/package.json
[error] 1-1: Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH.
packages/gen-ai/frontend/package.json
[error] 1-1: Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH.
package.json
[error] 1-1: Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH.
packages/llmd-serving/package.json
[error] 1-1: Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH.
packages/agent-ops/frontend/package.json
[error] 1-1: Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH.
packages/autorag/package.json
[error] 1-1: Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH.
packages/agent-ops/package.json
[error] 1-1: Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH.
packages/model-serving/cypress/package.json
[error] 1-1: Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH.
packages/data-registry/frontend/package.json
[error] 1-1: Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH.
packages/kserve/package.json
[error] 1-1: Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH.
frontend/package.json
[error] 1-1: Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH.
packages/automl/frontend/package.json
[error] 1-1: Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH.
packages/eval-hub/package.json
[error] 1-1: Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH.
packages/app-config/package.json
[error] 1-1: Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH.
packages/gen-ai/package.json
[error] 1-1: Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH.
packages/autorag/frontend/package.json
[error] 1-1: Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH.
distributions/rhaii/package.json
[error] 1-1: Invalid packageManager field: must match npm@MAJOR.MINOR.PATCH.
🔇 Additional comments (19)
packages/automl/frontend/config/moduleFederation.js (1)
1-7: Declare@odh-dashboard/app-configinpackages/automl/frontend/package.json.This
require()fails afternpm install --prefix frontendif onlypackages/automl/package.jsondeclares the dependency.packages/app-config/src/webpack/OdhRemoteFederationPlugin.ts (1)
1-26: LGTM!packages/app-config/src/webpack/__tests__/webpack-plugins.spec.ts (1)
1-136: LGTM!distributions/core-bff/frontend/config/moduleFederation.js (1)
1-13: LGTM!packages/agent-ops/frontend/config/moduleFederation.js (1)
1-13: LGTM!packages/autorag/frontend/config/moduleFederation.js (1)
1-13: LGTM!packages/eval-hub/frontend/config/moduleFederation.js (1)
1-13: LGTM!packages/gen-ai/frontend/config/moduleFederation.js (1)
1-15: LGTM!packages/data-registry/frontend/config/moduleFederation.js (1)
1-14: LGTM!packages/maas/frontend/config/moduleFederation.js (1)
1-13: LGTM!packages/mlflow/frontend/config/moduleFederation.js (1)
1-13: LGTM!packages/model-serving/cypress/package.json (1)
3-3: 🗄️ Data Integrity & IntegrationNo workspace identity change. Line 3 already used
model-serving-cypress; the lockfile and workspace configuration are consistent.> Likely an incorrect or invalid review comment.frontend/package.json (1)
93-93: 🔒 Security & PrivacyVerify the lower Segment Analytics version floor.
^1.84.0permits1.84.0, while the previous^1.84.1excluded it. A new resolution can therefore admit an older release and reintroduce a defect or advisory (CWE-829). Restore^1.84.1unless1.84.0is required and verified.As per path instructions,
**/package.jsoncontrols dependency resolution and must be reviewed as a supply-chain surface.Source: Path instructions
package.json (3)
94-98: 🔒 Security & PrivacyRetain the federation dependencies. Repository scripts and configuration consume
@module-federation/enhanced,@rspack/core,@rspack/cli, and@rspack/dev-server.> Likely an incorrect or invalid review comment.
127-130: 🗄️ Data Integrity & IntegrationDo not flag the PatternFly overrides. Workspace dependencies use
~6.5.1, and peer dependencies use the compatible^6range. The override is scoped to@openshift/dynamic-plugin-sdk-utils, not applied globally.> Likely an incorrect or invalid review comment.
94-98: 🩺 Stability & AvailabilityRemove this comment.
package-lock.jsonmatches the manifest and contains the requested resolved override versions.> Likely an incorrect or invalid review comment.packages/gen-ai/frontend/package.json (1)
107-107: 🔒 Security & PrivacyRetain
@openshift/dynamic-plugin-sdk. The remote imports it directly, and its^5.0.1version matches the host distributions.> Likely an incorrect or invalid review comment.packages/autorag/Dockerfile.workspace (1)
33-33: 🩺 Stability & AvailabilityDo not add an
app-configbuild step.@odh-dashboard/app-configexports its TypeScript source and has no build script. All five webpack configurations resolve and transpile.tsfiles duringnpm run build:prod; no compiledapp-configartifact is required.> Likely an incorrect or invalid review comment.packages/autorag/frontend/package.json (1)
44-44: 🩺 Stability & AvailabilityAlign the Module Federation runtime versions.
The current changes upgrade
@module-federation/enhancedto^0.24.1. The previous review reported direct@module-federation/runtimeimports that still use^0.21.4. Two runtime lines can split shared-module state and break federation initialization.
packages/autorag/frontend/package.json#L44-L44: update@module-federation/runtimeto^0.24.1, or remove it if no direct import remains.packages/eval-hub/frontend/package.json#L46-L46: update@module-federation/runtimeto^0.24.1, or remove it if no direct import remains.Verify the current manifests and imports:
#!/bin/bash set -euo pipefail for manifest in \ packages/autorag/frontend/package.json \ packages/eval-hub/frontend/package.json do echo "### $manifest" jq '{ enhanced: .devDependencies["`@module-federation/enhanced`"], runtimeDependencies: .dependencies["`@module-federation/runtime`"], runtimeDevDependencies: .devDependencies["`@module-federation/runtime`"] }' "$manifest" done rg -nP --glob '*.{ts,tsx,js,jsx}' \ "(?:from\s+['\"]`@module-federation/runtime`['\"]|require\(['\"]`@module-federation/runtime`['\"]\))" \ packages/autorag/frontend packages/eval-hub/frontend
|
rebased again |
jenny-s51
left a comment
jenny-s51
left a comment
There was a problem hiding this comment.
Tested on a cluster, no regressions or CSS ordering issues.
MF shared-module centralization looks good and addresses the root cause of the previous revert.
PF 6.5 bump looks good as well - versions are consistent across all packages.
/lgtm
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: jenny-s51, lucferbux The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
https://issues.redhat.com/browse/RHOAIENG-63779
builds on #8868 and #8935
Description
Bumps PatternFly to ~6.5 and centralizes Module Federation shared-module policy in
@odh-dashboard/app-config.Problem: PF 6.5 was previously reverted (#8213) because MF CSS load order / shared-module inconsistency across remotes caused silent UI breakage (e.g. AutoML table headers).
Solution:
OdhHostFederationPlugin/OdhRemoteFederationPlugin(webpack + rspack) in@odh-dashboard/app-configown shared-module config for host and remotesmoduleFederation.jswrappers — no hand-maintained shared mapsimport: falseforreact-coreandreact-styles(other PF packages allow fallback)./extensionspackages) getimport: falseon remotes; federated-only packages stay singleton with import/fallback~6.5.xPF ranges; Dependabot allows@patternfly/*patch updates (minor/major ignored)Key changes:
packages/app-config/src/webpack/(+ rspack thin wrappers) — shared metadata, ODH package discovery, host/remote pluginsmoduleFederation.js,docs/module-federation.md, Dependabot PF groupingHow Has This Been Tested?
packages/app-config— all passing)Test Impact
packages/app-config/src/webpack/__tests__/webpack-plugins.spec.ts— shared module metadata + host-provided vs federated-only ODH discoveryRequest review criteria:
Self checklist (all need to be checked):
After the PR is posted & before it merges:
mainSummary by CodeRabbit
New Features
Documentation
Chores