Skip to content

NO-JIRA: Resolving govulncheck failures - #629

Open
thiagoalessio wants to merge 11 commits into
openshift:mainfrom
thiagoalessio:govulncheck-slack
Open

NO-JIRA: Resolving govulncheck failures#629
thiagoalessio wants to merge 11 commits into
openshift:mainfrom
thiagoalessio:govulncheck-slack

Conversation

@thiagoalessio

@thiagoalessio thiagoalessio commented Jul 15, 2026

Copy link
Copy Markdown
Member

UPDATE: Also removed all JIRA-related functionality after our conversation on the scrum call;

Slack dependency bump has breaking changes, need to run my local copy continuousreleaseteam Slack and test it before unholding this PR.

well, it seems fine to me. @bradmwilliams and/or @hoxhaeris , would you guys like to test something specific before we merge this?

screenshot-2026-07-30_18-04-17

Summary by CodeRabbit

Removed Features

  • Removed Slack workflow-step ticket submission and Jira issue creation flows.
  • Removed Jira-related modal views and configuration options.

Bug Fixes

  • Updated Slack file uploads for kubeconfigs, service-account keys, and installation logs.
  • Improved modal rendering compatibility for rich-text content and emoji settings.

Chores

  • Updated Slack integration dependencies for improved compatibility.
  • Deprecated Jira configuration flags remain available for compatibility but no longer affect startup.

@openshift-ci-robot

Copy link
Copy Markdown

@thiagoalessio: No Jira issue with key GO-2026 exists in the tracker at https://redhat.atlassian.net.
Once a valid jira issue is referenced in the title of this pull request, request a refresh with /jira refresh.

Details

In response to this:

Resolves vulnerability GO-2026-5410 by upgrading github.com/slack-go/slack to v0.23.1. Adapts to breaking API changes:

  • UploadFileV2Parameters renamed to UploadFileParameters
  • RichTextPreformatted struct flattened (no longer embeds RichTextSection)
  • TextBlockObject.Emoji changed from bool to *bool
  • WorkflowStep types removed (deprecated Steps from Apps feature): defines local types and HTTP client for workflows.updateStep, workflows.stepCompleted, and workflows.stepFailed API calls
  • InteractionCallback.WorkflowStep field removed: extracts workflow_step_edit_id from raw JSON in handleInteraction

/hold

I didn't test locally yet, just want to see if govulncheck will pass with the changes first.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci openshift-ci Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 15, 2026
@coderabbitai

coderabbitai Bot commented Jul 15, 2026

Copy link
Copy Markdown

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 79800631-15a6-4ae4-ab11-7ae643417cf0

📥 Commits

Reviewing files that changed from the base of the PR and between e8fa088 and 9791040.

📒 Files selected for processing (1)
  • cmd/ci-chat-bot/main.go

📝 Walkthrough

Walkthrough

The change removes Jira issue filing and Slack workflow-step handling. It migrates file uploads to UploadFile, updates Slack dependencies, and changes modal payload serialization for emoji and rich-text fields.

Changes

Slack behavior updates

Layer / File(s) Summary
Remove Jira and workflow handling
cmd/ci-chat-bot/*, pkg/jira/*, pkg/slack/events/*, pkg/slack/interactions/*, pkg/slack/modals/handlers.go, pkg/slack/events/workflowSubmissionEvents/*, pkg/slack/modals/stepsFromApp/*
Startup no longer configures Jira. Event and interaction routers no longer process Jira-backed workflow submissions or workflow-step modals. Related Jira types, handlers, constants, and modal builders are removed.
Update Slack file uploads
pkg/slack/parser/types.go, pkg/slack/slack.go, pkg/slack/actions_request_test.go, go.mod
Slack file uploads use UploadFile and slack.UploadFileParameters. The mock client and request test use the updated API. Slack and indirect dependency versions are updated.
Adjust modal payload serialization
pkg/slack/modals/common/*, pkg/slack/modals/launch/views.go, pkg/slack/modals/list/views.go, pkg/slack/modals/mce/create/views.go, pkg/slack/modals/common/simple_modals_test.go
Modal text blocks use pointer-valued Emoji fields. Kubeconfig rich-text blocks assign Type and Elements directly. JSON tests verify the resulting payloads.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Suggested labels: approved

Suggested reviewers: alexnpavel

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 21.88% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately identifies the main changes: resolving govulncheck failures and removing Jira functionality.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@openshift-ci-robot

Copy link
Copy Markdown

@thiagoalessio: No Jira issue with key GO-2026 exists in the tracker at https://redhat.atlassian.net.
Once a valid jira issue is referenced in the title of this pull request, request a refresh with /jira refresh.

Details

In response to this:

Resolves vulnerability GO-2026-5410 by upgrading github.com/slack-go/slack to v0.23.1. Adapts to breaking API changes:

  • UploadFileV2Parameters renamed to UploadFileParameters
  • RichTextPreformatted struct flattened (no longer embeds RichTextSection)
  • TextBlockObject.Emoji changed from bool to *bool
  • WorkflowStep types removed (deprecated Steps from Apps feature): defines local types and HTTP client for workflows.updateStep, workflows.stepCompleted, and workflows.stepFailed API calls
  • InteractionCallback.WorkflowStep field removed: extracts workflow_step_edit_id from raw JSON in handleInteraction

/hold

I didn't test locally yet, just want to see if govulncheck will pass with the changes first.

Summary by CodeRabbit

  • Bug Fixes
  • Improved Slack workflow-step handling, including support for deprecated “Steps from Apps” interactions.
  • Workflow steps can now be completed, failed, and reconfigured reliably.
  • Updated Slack file uploads for kubeconfigs, service account keys, and installation logs.
  • Compatibility
  • Updated Slack integration support for current API behavior.
  • Improved rendering of Slack modal views and workflow configuration screens.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3

🧹 Nitpick comments (4)
pkg/slack/events/workflowSubmissionEvents/workflow_handler.go (1)

111-115: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Simplify the return statement.

The error check and explicit returns can be collapsed into a single return statement.

♻️ Proposed refactor
-	err = client.WorkflowStepCompleted(event.WorkflowStep.WorkflowStepExecuteID, outgoingOutputs)
-	if err != nil {
-		return err
-	}
-	return nil
+	return client.WorkflowStepCompleted(event.WorkflowStep.WorkflowStepExecuteID, outgoingOutputs)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/slack/events/workflowSubmissionEvents/workflow_handler.go` around lines
111 - 115, In the workflow submission handler, simplify the final
client.WorkflowStepCompleted call by returning its result directly instead of
assigning to err, checking it, and explicitly returning nil.
pkg/slack/events/workflowSubmissionEvents/types.go (1)

139-139: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Check HTTP status code before decoding JSON.

If the Slack API returns a non-2xx status (e.g., 502 Bad Gateway) with an HTML body, the JSON decoder will fail with a cryptic syntax error. Checking the status code first provides a clearer error message for debugging.

🛠️ Proposed fix
+	if resp.StatusCode >= 300 {
+		return fmt.Errorf("slack API %s returned HTTP %d", method, resp.StatusCode)
+	}
+
 	var sr slackResponse
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/slack/events/workflowSubmissionEvents/types.go` at line 139, In the
response-handling flow around the slackResponse variable, validate the HTTP
response status before attempting JSON decoding. For non-2xx responses, return a
clear error containing the status information and skip decoding the body; retain
the existing JSON decoding path for successful responses.
cmd/ci-chat-bot/slack.go (1)

64-66: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Add ReadTimeout to the HTTP server.

While ReadHeaderTimeout mitigates basic Slowloris attacks targeting headers, a malicious client could still slowly trickle the request body and exhaust connections. Adding a ReadTimeout bounds the total time allowed to read the full request (including the body).

🛡️ Proposed configuration
 	mux.Handle("/slack/interactive-endpoint", handler(handleInteraction(bot.BotSigningSecret, interactionrouter.ForModals(slackclient, jobManager, httpclient, bot.BotToken))))
-	server := &http.Server{Addr: ":" + strconv.Itoa(bot.Port), Handler: mux, ReadHeaderTimeout: 10 * time.Second}
+	server := &http.Server{
+		Addr:              ":" + strconv.Itoa(bot.Port),
+		Handler:           mux,
+		ReadHeaderTimeout: 10 * time.Second,
+		ReadTimeout:       30 * time.Second,
+	}
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@cmd/ci-chat-bot/slack.go` around lines 64 - 66, Update the http.Server
configuration in the server initialization to include a ReadTimeout that bounds
the total request-read duration, including the body, while preserving the
existing ReadHeaderTimeout setting.

Source: Linters/SAST tools

pkg/slack/modals/common/version_views.go (1)

107-112: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Prefer the SDK constructor over manual struct initialization.

While using new(bool) functionally provides the pointer required by the upgraded slack-go/slack SDK, manually instantiating TextBlockObject literals leaves your code vulnerable to future upstream struct alterations. It is highly recommended to use the SDK's native constructor (slackClient.NewTextBlockObject), which safely handles pointer extraction for you and shrinks visual boilerplate (a pattern that is already appropriately used in pkg/slack/modals/common/simple_modals.go).

  • pkg/slack/modals/common/version_views.go#L107-L112: Replace the struct literal with Text: slackClient.NewTextBlockObject(slackClient.PlainTextType, "Version Specifications", false, false),
  • pkg/slack/modals/common/version_views.go#L163-L168: Replace the struct literal with slackClient.NewTextBlockObject(slackClient.PlainTextType, config.ContextMetadata, false, false),
  • pkg/slack/modals/common/version_views.go#L241-L246: Replace the struct literal with Text: slackClient.NewTextBlockObject(slackClient.PlainTextType, "Select a Version", false, false),
  • pkg/slack/modals/common/version_views.go#L270-L275: Replace the struct literal with slackClient.NewTextBlockObject(slackClient.PlainTextType, config.ContextMetadata, false, false),
  • pkg/slack/modals/common/version_views.go#L344-L349: Replace the struct literal with Text: slackClient.NewTextBlockObject(slackClient.PlainTextType, "There are too many results from the selected Stream. Select a Major.Minor as well", false, false),
  • pkg/slack/modals/common/version_views.go#L373-L378: Replace the struct literal with slackClient.NewTextBlockObject(slackClient.PlainTextType, config.ContextMetadata, false, false),
  • pkg/slack/modals/common/version_views.go#L404-L409: Replace the struct literal with Text: slackClient.NewTextBlockObject(slackClient.PlainTextType, "Enter A PR", false, false),
  • pkg/slack/modals/common/version_views.go#L428-L433: Replace the struct literal with slackClient.NewTextBlockObject(slackClient.PlainTextType, config.ContextMetadata, false, false),
  • pkg/slack/modals/common/version_views.go#L496-L501: Replace the struct literal with Text: slackClient.NewTextBlockObject(slackClient.PlainTextType, "Do you want to launch from a PR?", false, false),
  • pkg/slack/modals/common/version_views.go#L522-L527: Replace the struct literal with slackClient.NewTextBlockObject(slackClient.PlainTextType, config.ContextMetadata, false, false),
  • pkg/slack/modals/launch/views.go#L46-L51: Replace the struct literal with Text: slackClient.NewTextBlockObject(slackClient.PlainTextType, "Select the Launch Platform and Architecture", false, false),
  • pkg/slack/modals/launch/views.go#L139-L144: Replace the struct literal with slackClient.NewTextBlockObject(slackClient.PlainTextType, context, false, false),
  • pkg/slack/modals/list/views.go#L20-L25: Replace the struct literal with Text: slackClient.NewTextBlockObject(slackClient.PlainTextType, "See who is hogging all the clusters", false, false),
  • pkg/slack/modals/mce/create/views.go#L51-L56: Replace the struct literal with Text: slackClient.NewTextBlockObject(slackClient.PlainTextType, "Select the Launch Platform and Duration", false, false),
  • pkg/slack/modals/mce/create/views.go#L117-L122: Replace the struct literal with slackClient.NewTextBlockObject(slackClient.PlainTextType, context, false, false),
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/slack/modals/common/version_views.go` around lines 107 - 112, Replace
each manual slackClient.TextBlockObject literal with
slackClient.NewTextBlockObject, preserving the existing PlainTextType, text
value, and false/false arguments. Apply this in
pkg/slack/modals/common/version_views.go at lines 107-112, 163-168, 241-246,
270-275, 344-349, 373-378, 404-409, 428-433, 496-501, and 522-527;
pkg/slack/modals/launch/views.go at lines 46-51 and 139-144;
pkg/slack/modals/list/views.go at lines 20-25; and
pkg/slack/modals/mce/create/views.go at lines 51-56 and 117-122.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/slack/events/workflowSubmissionEvents/types.go`:
- Around line 36-43: Remove redundant pointers from WorkflowStepInputs and
WorkflowStepOutput throughout eventWorkflowStep, workflowUpdateStepRequest, and
SaveWorkflowStepConfiguration, using non-pointer map and slice types so nil
values remain safely rangeable. In
pkg/slack/events/workflowSubmissionEvents/workflow_handler.go, remove
dereferences of Inputs and Outputs. In pkg/slack/interactions/router/router.go,
pass input and output values directly and update the slackClient interface
signature to match; apply these changes at types.go lines 36-43, 73-77, and
112-120, workflow_handler.go lines 58-74, 76-116, and 118-144, and router.go
lines 96-101 and 124-127.
- Line 137: Update the defer around resp.Body.Close() to explicitly discard or
handle its returned error, preserving the existing response-body cleanup while
satisfying golangci-lint.
- Line 126: Update the request construction in the client method containing
http.NewRequestWithContext to derive the context with context.WithTimeout
instead of context.Background(), using the appropriate existing or defined
duration and ensuring the cancel function is released. Pass the timed context to
the POST request so unresponsive Slack API calls terminate within the bound.

---

Nitpick comments:
In `@cmd/ci-chat-bot/slack.go`:
- Around line 64-66: Update the http.Server configuration in the server
initialization to include a ReadTimeout that bounds the total request-read
duration, including the body, while preserving the existing ReadHeaderTimeout
setting.

In `@pkg/slack/events/workflowSubmissionEvents/types.go`:
- Line 139: In the response-handling flow around the slackResponse variable,
validate the HTTP response status before attempting JSON decoding. For non-2xx
responses, return a clear error containing the status information and skip
decoding the body; retain the existing JSON decoding path for successful
responses.

In `@pkg/slack/events/workflowSubmissionEvents/workflow_handler.go`:
- Around line 111-115: In the workflow submission handler, simplify the final
client.WorkflowStepCompleted call by returning its result directly instead of
assigning to err, checking it, and explicitly returning nil.

In `@pkg/slack/modals/common/version_views.go`:
- Around line 107-112: Replace each manual slackClient.TextBlockObject literal
with slackClient.NewTextBlockObject, preserving the existing PlainTextType, text
value, and false/false arguments. Apply this in
pkg/slack/modals/common/version_views.go at lines 107-112, 163-168, 241-246,
270-275, 344-349, 373-378, 404-409, 428-433, 496-501, and 522-527;
pkg/slack/modals/launch/views.go at lines 46-51 and 139-144;
pkg/slack/modals/list/views.go at lines 20-25; and
pkg/slack/modals/mce/create/views.go at lines 51-56 and 117-122.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 476b0573-8459-468f-9de0-37e8ba69449c

📥 Commits

Reviewing files that changed from the base of the PR and between 6752288 and 50ae70a.

⛔ Files ignored due to path filters (89)
  • go.sum is excluded by !**/*.sum
  • vendor/github.com/slack-go/slack/.gitignore is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/.golangci.yml is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/CHANGELOG.md is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/CONTRIBUTING.md is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/Makefile is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/README.md is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/TODO.txt is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/admin.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/admin_conversations.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/admin_conversations_ekm.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/admin_conversations_restrictAccess.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/admin_roles.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/admin_teams.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/apps.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/assistant.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/attachments.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/audit.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/auth.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_action.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_alert.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_call.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_card.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_carousel.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_context.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_context_actions.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_conv.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_divider.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_element.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_file.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_header.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_image.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_input.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_json.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_markdown.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_object.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_plan.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_rich_text.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_section.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_table.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_task_card.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_unknown.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_video.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/channels.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/chat.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/chat_stream_chunks.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/conversation.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/dialog.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/dnd.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/entity.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/files.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/function_execute.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/huddle.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/im.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/info.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/interactions.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/manifests.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/messages.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/metadata.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/migration.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/misc.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/mise.toml is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/oauth.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/reactions.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/remotefiles.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/retry.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/rtm.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/search.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/security.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/slack.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/slackevents/action_events.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/slackevents/inner_events.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/slackevents/parsers.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/socket_mode.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/stars.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/team.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/usergroups.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/users.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/views.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/webhooks.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/websocket_groups.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/websocket_managed_conn.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/websocket_misc.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/workflow_step.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/workflow_step_execute.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/workflows_featured.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/workflows_triggers.go is excluded by !vendor/**
  • vendor/modules.txt is excluded by !vendor/**
📒 Files selected for processing (16)
  • cmd/ci-chat-bot/slack.go
  • go.mod
  • pkg/slack/actions_request_test.go
  • pkg/slack/events/router/router.go
  • pkg/slack/events/workflowSubmissionEvents/types.go
  • pkg/slack/events/workflowSubmissionEvents/workflow_handler.go
  • pkg/slack/interactions/router/router.go
  • pkg/slack/modals/common/simple_modals.go
  • pkg/slack/modals/common/version_views.go
  • pkg/slack/modals/launch/views.go
  • pkg/slack/modals/list/views.go
  • pkg/slack/modals/mce/create/views.go
  • pkg/slack/modals/stepsFromApp/jira_step.go
  • pkg/slack/modals/stepsFromApp/workflow_submit.go
  • pkg/slack/parser/types.go
  • pkg/slack/slack.go

Comment thread pkg/slack/events/workflowSubmissionEvents/types.go Outdated
Comment thread pkg/slack/events/workflowSubmissionEvents/types.go Outdated
Comment thread pkg/slack/events/workflowSubmissionEvents/types.go Outdated
thiagoalessio and others added 3 commits July 30, 2026 14:05
Resolves vulnerability GO-2026-5410 by upgrading github.com/slack-go/slack
to v0.23.1. Adapts to breaking API changes:

- UploadFileV2Parameters renamed to UploadFileParameters
- RichTextPreformatted struct flattened (no longer embeds RichTextSection)
- TextBlockObject.Emoji changed from bool to *bool
- WorkflowStep types removed (deprecated Steps from Apps feature):
  defines local types and HTTP client for workflows.updateStep,
  workflows.stepCompleted, and workflows.stepFailed API calls
- InteractionCallback.WorkflowStep field removed: extracts
  workflow_step_edit_id from raw JSON in handleInteraction

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@thiagoalessio thiagoalessio changed the title Fix GO-2026-5410: upgrade slack-go/slack v0.15.0 → v0.23.1 NO-JIRA: Resolving govulncheck failures Jul 30, 2026
@openshift-ci-robot

Copy link
Copy Markdown

@thiagoalessio: This pull request explicitly references no jira issue.

Details

In response to this:

Resolves vulnerability GO-2026-5410 by upgrading github.com/slack-go/slack to v0.23.1. Adapts to breaking API changes:

  • UploadFileV2Parameters renamed to UploadFileParameters
  • RichTextPreformatted struct flattened (no longer embeds RichTextSection)
  • TextBlockObject.Emoji changed from bool to *bool
  • WorkflowStep types removed (deprecated Steps from Apps feature): defines local types and HTTP client for workflows.updateStep, workflows.stepCompleted, and workflows.stepFailed API calls
  • InteractionCallback.WorkflowStep field removed: extracts workflow_step_edit_id from raw JSON in handleInteraction

/hold

I didn't test locally yet, just want to see if govulncheck will pass with the changes first.

Summary by CodeRabbit

  • Bug Fixes
  • Improved Slack workflow-step handling, including support for deprecated “Steps from Apps” interactions.
  • Workflow steps can now be completed, failed, and reconfigured reliably.
  • Updated Slack file uploads for kubeconfigs, service account keys, and installation logs.
  • Compatibility
  • Updated Slack integration support for current API behavior.
  • Improved rendering of Slack modal views and workflow configuration screens.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jul 30, 2026

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (2)
pkg/slack/actions_request_test.go (1)

306-318: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Assert the complete upload payload.

The callback currently checks only Filename; it would still pass if Content, FileSize, Channel, or InitialComment were dropped or changed during the migration.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/slack/actions_request_test.go` around lines 306 - 318, Strengthen the
upload callback assertion in the test setup around uploadFileFunc to validate
the complete slack.UploadFileParameters payload, including Content, FileSize,
Channel, and InitialComment, in addition to the existing conditional Filename
check. Derive expected values from the current test case and report mismatches
through the test assertion mechanism.
go.mod (1)

54-58: 🎯 Functional Correctness | 🔵 Trivial

Confirm the Go toolchain and run the required verification.

The Slack SDK v0.23.1 declares go 1.25 and toolchain go1.25.9; confirm the repository directive and CI images meet that minimum before merging. (raw.githubusercontent.com)

Run make verify lint test all; this must include the gcs build tag and race-enabled tests. As per coding guidelines: “Always run make verify lint test all before committing code changes,” use -tags gcs, and run tests with -race.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` around lines 54 - 58, Confirm the repository’s Go directive and CI
toolchain images meet Slack SDK v0.23.1’s minimum Go 1.25/toolchain go1.25.9
requirement, updating them if necessary. Then run the complete verification
command `make verify lint test all`, ensuring verification includes the gcs
build tag and race-enabled tests.

Sources: Coding guidelines, MCP tools

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@go.mod`:
- Around line 54-58: Confirm the repository’s Go directive and CI toolchain
images meet Slack SDK v0.23.1’s minimum Go 1.25/toolchain go1.25.9 requirement,
updating them if necessary. Then run the complete verification command `make
verify lint test all`, ensuring verification includes the gcs build tag and
race-enabled tests.

In `@pkg/slack/actions_request_test.go`:
- Around line 306-318: Strengthen the upload callback assertion in the test
setup around uploadFileFunc to validate the complete slack.UploadFileParameters
payload, including Content, FileSize, Channel, and InitialComment, in addition
to the existing conditional Filename check. Derive expected values from the
current test case and report mismatches through the test assertion mechanism.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: c247404c-8a6b-41bc-9ed7-ac5cdc4e8ae3

📥 Commits

Reviewing files that changed from the base of the PR and between 50ae70a and 2ad8f85.

⛔ Files ignored due to path filters (162)
  • go.sum is excluded by !**/*.sum
  • vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/gcp_authn/v3/gcp_authn.pb.go is excluded by !**/*.pb.go, !vendor/**
  • vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/gcp_authn/v3/gcp_authn.pb.validate.go is excluded by !vendor/**
  • vendor/github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/gcp_authn/v3/gcp_authn_vtproto.pb.go is excluded by !**/*.pb.go, !vendor/**
  • vendor/github.com/slack-go/slack/.gitignore is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/.golangci.yml is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/CHANGELOG.md is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/CONTRIBUTING.md is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/Makefile is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/README.md is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/TODO.txt is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/admin.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/admin_conversations.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/admin_conversations_ekm.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/admin_conversations_restrictAccess.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/admin_roles.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/admin_teams.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/apps.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/assistant.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/attachments.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/audit.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/auth.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_action.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_alert.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_call.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_card.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_carousel.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_context.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_context_actions.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_conv.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_divider.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_element.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_file.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_header.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_image.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_input.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_json.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_markdown.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_object.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_plan.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_rich_text.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_section.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_table.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_task_card.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_unknown.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/block_video.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/channels.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/chat.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/chat_stream_chunks.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/conversation.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/dialog.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/dnd.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/entity.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/files.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/function_execute.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/huddle.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/im.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/info.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/interactions.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/manifests.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/messages.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/metadata.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/migration.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/misc.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/mise.toml is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/oauth.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/reactions.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/remotefiles.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/retry.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/rtm.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/search.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/security.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/slack.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/slackevents/action_events.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/slackevents/inner_events.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/slackevents/parsers.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/socket_mode.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/stars.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/team.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/usergroups.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/users.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/views.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/webhooks.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/websocket_groups.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/websocket_managed_conn.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/websocket_misc.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/workflow_step.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/workflow_step_execute.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/workflows_featured.go is excluded by !vendor/**
  • vendor/github.com/slack-go/slack/workflows_triggers.go is excluded by !vendor/**
  • vendor/golang.org/x/text/cases/context.go is excluded by !vendor/**
  • vendor/golang.org/x/text/cases/map.go is excluded by !vendor/**
  • vendor/golang.org/x/text/unicode/norm/forminfo.go is excluded by !vendor/**
  • vendor/golang.org/x/text/unicode/norm/iter.go is excluded by !vendor/**
  • vendor/golang.org/x/text/unicode/norm/normalize.go is excluded by !vendor/**
  • vendor/golang.org/x/tools/go/packages/packages.go is excluded by !vendor/**
  • vendor/golang.org/x/tools/internal/gcimporter/iexport.go is excluded by !vendor/**
  • vendor/golang.org/x/tools/internal/gcimporter/iimport.go is excluded by !vendor/**
  • vendor/golang.org/x/tools/internal/imports/fix.go is excluded by !vendor/**
  • vendor/golang.org/x/tools/internal/imports/imports.go is excluded by !vendor/**
  • vendor/golang.org/x/tools/internal/stdlib/deps.go is excluded by !vendor/**
  • vendor/golang.org/x/tools/internal/stdlib/manifest.go is excluded by !vendor/**
  • vendor/golang.org/x/tools/internal/typesinternal/element.go is excluded by !vendor/**
  • vendor/golang.org/x/tools/internal/typesinternal/types.go is excluded by !vendor/**
  • vendor/golang.org/x/tools/internal/typesinternal/zerovalue.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/balancer/balancer.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/balancer/grpclb/grpc_lb_v1/load_balancer_grpc.pb.go is excluded by !**/*.pb.go, !vendor/**
  • vendor/google.golang.org/grpc/balancer/pickfirst/pickfirst.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/balancer/ringhash/ringhash.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/balancer/rls/control_channel.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/credentials/alts/alts.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/credentials/alts/internal/proto/grpc_gcp/handshaker_grpc.pb.go is excluded by !**/*.pb.go, !vendor/**
  • vendor/google.golang.org/grpc/dialoptions.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/encoding/encoding.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/encoding/gzip/gzip.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/experimental/balancer/hostname/hostname.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/experimental/balancer/weight/weight.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/health/grpc_health_v1/health_grpc.pb.go is excluded by !**/*.pb.go, !vendor/**
  • vendor/google.golang.org/grpc/internal/envconfig/envconfig.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/internal/envconfig/xds.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/internal/grpcutil/encode_duration.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/internal/proto/grpc_lookup_v1/rls_grpc.pb.go is excluded by !**/*.pb.go, !vendor/**
  • vendor/google.golang.org/grpc/internal/resolver/config_selector.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/internal/stats/labels.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/internal/transport/client_stream.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/internal/transport/controlbuf.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/internal/transport/flowcontrol.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/internal/transport/handler_server.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/internal/transport/http2_client.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/internal/transport/http2_server.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/internal/transport/internal/internal.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/internal/transport/transport.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/internal/xds/balancer/cdsbalancer/configbuilder.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/internal/xds/balancer/clusterimpl/clusterimpl.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/internal/xds/balancer/clusterimpl/picker.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/internal/xds/httpfilter/extconfig.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/internal/xds/httpfilter/httpfilter.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/internal/xds/matcher/matcher_header.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/internal/xds/matcher/string_matcher.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/internal/xds/rbac/matchers.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/internal/xds/resolver/serviceconfig.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/internal/xds/resolver/xds_resolver.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/internal/xds/server/filter_chain_manager.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/internal/xds/server/listener_wrapper.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/grpc_service.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/matcher_path.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/metadata.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/type_cds.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/type_lds.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/unmarshal_cds.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/unmarshal_eds.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/unmarshal_lds.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/internal/xds/xdsclient/xdsresource/unmarshal_rds.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/rpc_util.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/server.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/stats/opentelemetry/client_metrics.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/stats/opentelemetry/client_tracing.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/stats/opentelemetry/opentelemetry.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/stats/opentelemetry/trace.go is excluded by !vendor/**
  • vendor/google.golang.org/grpc/version.go is excluded by !vendor/**
  • vendor/modules.txt is excluded by !vendor/**
📒 Files selected for processing (16)
  • cmd/ci-chat-bot/slack.go
  • go.mod
  • pkg/slack/actions_request_test.go
  • pkg/slack/events/router/router.go
  • pkg/slack/events/workflowSubmissionEvents/types.go
  • pkg/slack/events/workflowSubmissionEvents/workflow_handler.go
  • pkg/slack/interactions/router/router.go
  • pkg/slack/modals/common/simple_modals.go
  • pkg/slack/modals/common/version_views.go
  • pkg/slack/modals/launch/views.go
  • pkg/slack/modals/list/views.go
  • pkg/slack/modals/mce/create/views.go
  • pkg/slack/modals/stepsFromApp/jira_step.go
  • pkg/slack/modals/stepsFromApp/workflow_submit.go
  • pkg/slack/parser/types.go
  • pkg/slack/slack.go
🚧 Files skipped from review as they are similar to previous changes (2)
  • pkg/slack/modals/stepsFromApp/jira_step.go
  • pkg/slack/modals/list/views.go

@bradmwilliams

Copy link
Copy Markdown
Contributor

/approve
/label tide/merge-method-squash

@openshift-ci openshift-ci Bot added tide/merge-method-squash Denotes a PR that should be squashed by tide when it merges. approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Jul 30, 2026
@thiagoalessio

Copy link
Copy Markdown
Member Author

/unhold

@openshift-ci openshift-ci Bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 30, 2026
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (2)
pkg/slack/events/workflowSubmissionEvents/types.go (2)

140-147: 🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win

Reject non-2xx responses before JSON decoding.

postJSON decodes resp.Body before checking resp.StatusCode. A non-2xx gateway error can become a JSON decoding error, and a non-success response with {"ok":true} can be treated as successful. Return an error for success codes outside the 2xx range, then keep the existing sr.OK == false handling.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/slack/events/workflowSubmissionEvents/types.go` around lines 140 - 147,
Update postJSON to validate resp.StatusCode before decoding resp.Body, returning
an error for any status outside the 2xx range. Preserve the existing JSON
decoding and sr.OK == false handling for successful HTTP responses.

4-14: 🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift

Keep workflow values JSON-compatible.

Slack workflow step inputs and outputs can contain arrays or other non-string JSON values. The current string boundary at WorkflowStepInputElement.Value, WorkflowStepCompleted, and workflowStepInputsFromApp can drop valid payloads or fail to represent them. Model the Slack boundary with any/json.RawMessage, then convert only the supported Jira fields to strings.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/slack/events/workflowSubmissionEvents/types.go` around lines 4 - 14,
Update the workflow value boundary across WorkflowStepInputElement.Value,
workflowSubmit.WorkflowStepCompleted, and workflowStepInputsFromApp to preserve
arrays and other JSON values using any or json.RawMessage instead of string.
Ensure JSON decoding and output propagation retain non-string payloads, while
converting only the supported Jira fields to strings at the Jira integration
boundary.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@pkg/slack/events/workflowSubmissionEvents/types.go`:
- Around line 140-147: Update postJSON to validate resp.StatusCode before
decoding resp.Body, returning an error for any status outside the 2xx range.
Preserve the existing JSON decoding and sr.OK == false handling for successful
HTTP responses.
- Around line 4-14: Update the workflow value boundary across
WorkflowStepInputElement.Value, workflowSubmit.WorkflowStepCompleted, and
workflowStepInputsFromApp to preserve arrays and other JSON values using any or
json.RawMessage instead of string. Ensure JSON decoding and output propagation
retain non-string payloads, while converting only the supported Jira fields to
strings at the Jira integration boundary.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: a8f3cb2f-0796-4d60-b650-3fd71732d6a0

📥 Commits

Reviewing files that changed from the base of the PR and between 2ad8f85 and 11ab6bb.

📒 Files selected for processing (3)
  • pkg/slack/events/workflowSubmissionEvents/types.go
  • pkg/slack/events/workflowSubmissionEvents/workflow_handler.go
  • pkg/slack/interactions/router/router.go
🚧 Files skipped from review as they are similar to previous changes (2)
  • pkg/slack/interactions/router/router.go
  • pkg/slack/events/workflowSubmissionEvents/workflow_handler.go

@thiagoalessio

Copy link
Copy Markdown
Member Author

/hold

found an issue on the launch modal.

@openshift-ci openshift-ci Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Aug 3, 2026
Re-register workflow_step_execute in EventsAPIInnerEventMapping since
the slack-go library removed it, and add a nil guard for the Jira filer
to prevent panics when Jira is not configured. Add tests covering the
workflow handler, event parsing, and slack-go serialization changes
(RichTextPreformatted flattening, *bool Emoji field).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
pkg/slack/events/workflowSubmissionEvents/workflow_handler_test.go (1)

191-293: 📐 Maintainability & Code Quality | 🔵 Trivial | 🏗️ Heavy lift

Exercise the positive handler path.

Line 192 creates handler, but lines 224-293 never call handler.Handle. The test only verifies Slack event parsing and local JSON decoding. It cannot detect a regression where Handler does not call handleJiraStep for jira_ticket.

Pass the parsed callback event to handler.Handle with controllable Jira filing and workflow API dependencies. Assert the Jira action and the completion or failure request.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/slack/events/workflowSubmissionEvents/workflow_handler_test.go` around
lines 191 - 293, Update TestHandlerEndToEndJiraTicket to invoke handler.Handle
with the parsed callback event instead of stopping after local decoding. Provide
controllable Jira filing and workflow API dependencies, then assert that the
jira_ticket path triggers the expected Jira action and sends the appropriate
workflow completion or failure request.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@pkg/slack/events/workflowSubmissionEvents/workflow_handler_test.go`:
- Around line 191-293: Update TestHandlerEndToEndJiraTicket to invoke
handler.Handle with the parsed callback event instead of stopping after local
decoding. Provide controllable Jira filing and workflow API dependencies, then
assert that the jira_ticket path triggers the expected Jira action and sends the
appropriate workflow completion or failure request.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 09bfd33b-a4d7-491a-b7f1-032209b10bcc

📥 Commits

Reviewing files that changed from the base of the PR and between 2ad8f85 and 8600e10.

📒 Files selected for processing (5)
  • pkg/slack/events/workflowSubmissionEvents/types.go
  • pkg/slack/events/workflowSubmissionEvents/workflow_handler.go
  • pkg/slack/events/workflowSubmissionEvents/workflow_handler_test.go
  • pkg/slack/interactions/router/router.go
  • pkg/slack/modals/common/simple_modals_test.go
🚧 Files skipped from review as they are similar to previous changes (3)
  • pkg/slack/events/workflowSubmissionEvents/types.go
  • pkg/slack/interactions/router/router.go
  • pkg/slack/events/workflowSubmissionEvents/workflow_handler.go

Replace interface{} with any in test files to satisfy go fix, and
improve TestHandlerEndToEndJiraTicket to exercise handler.Handle()
with mock dependencies.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@thiagoalessio

Copy link
Copy Markdown
Member Author

/unhold

the only thing I didn't manage to test manually was the workflow steps ... but I asked claude to add a bunch of unit tests for that.

the rest seems to be working just fine.

@openshift-ci openshift-ci Bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Aug 4, 2026
Comment on lines +28 to +29
// workflowStepExecuteEvent mirrors the deprecated slackevents.WorkflowStepExecuteEvent
// which was removed from slack-go/slack v0.23.0+.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What is the "new" way to handle these kinds of things then? Trying to figure out if this is something we need to fully address (i.e. convert to the "new" path) sooner than later?

@bradmwilliams

Copy link
Copy Markdown
Contributor

/hold
To prevent unwanted merge while we work through some potential dead code removal

@openshift-ci openshift-ci Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Aug 4, 2026
thiagoalessio and others added 2 commits August 6, 2026 10:58
Slack deprecated Steps from Apps and removed the UI to create new
workflow steps. The entire Jira integration existed solely to support
this feature and has no remaining callers.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Comment thread cmd/ci-chat-bot/main.go
Comment on lines -92 to -93

jiraOptions flagutil.JiraOptions

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just so you are aware, this is a breaking change.
What happen if/when there is deployment logic that currently references these parameters?
That is absolutely the case for the ClusterBot's deployment:
https://github.com/openshift/release/blob/3abed544b8d6d696ffa2bd56ad2cb4d0baf92d3c/clusters/app.ci/ci-chat-bot/ci-chat-bot.yaml#L434-L436
An alternate implementation would be: remove all the logic, leaving the options as is, and if specified printing a "deprecation" warning type message. This would ensure that the PR is non-breaking.
As currently written this PR cannot merge until the aforementioned parameters are removed or an alternate approach is taken. I'll let you decide how to proceed, because technically we're responsible for both pieces regardless, but this situation is an important nuance in our world!

Comment thread cmd/ci-chat-bot/main.go
opt.GitHubOptions.AddFlags(emptyFlags)
opt.KubernetesOptions.AddFlags(emptyFlags)
opt.InstrumentationOptions.AddFlags(emptyFlags)
opt.jiraOptions.AddFlags(emptyFlags)

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same as above! This is what actually adds the options if they are to stay

@openshift-ci openshift-ci Bot removed the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 6, 2026
The deployment config in openshift/release still passes --jira-endpoint,
--jira-username, and --jira-password-file. Retain the flags as no-ops
with a deprecation warning so this PR can merge without a coordinated
deployment change.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@openshift-ci

openshift-ci Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: thiagoalessio
Once this PR has been reviewed and has the lgtm label, please ask for approval from bradmwilliams. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci

openshift-ci Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

@thiagoalessio: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. tide/merge-method-squash Denotes a PR that should be squashed by tide when it merges.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants