From d2ad619622ee2ab1a52a9ba85415b1f573e66e37 Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Thu, 20 Aug 2026 01:36:50 -0400 Subject: [PATCH 1/3] [scanner] fix: route reports by booted image Signed-off-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .../bluefin/usr/libexec/bonedigger-report | 22 +++++++++++-- tests/test_bonedigger_report.bats | 32 +++++++++++++++++++ 2 files changed, 52 insertions(+), 2 deletions(-) diff --git a/system_files/bluefin/usr/libexec/bonedigger-report b/system_files/bluefin/usr/libexec/bonedigger-report index b07ea285..ce33f324 100755 --- a/system_files/bluefin/usr/libexec/bonedigger-report +++ b/system_files/bluefin/usr/libexec/bonedigger-report @@ -76,6 +76,24 @@ read_image_info() { IMAGE_REF="$(read_image_field image-ref)" IMAGE_TAG="$(read_image_field image-tag)" IMAGE_FLAVOR="$(read_image_field image-flavor)" + + local booted_ref="" + if command -v jq &>/dev/null; then + booted_ref="$(printf '%s' "$BOOTC_JSON" | \ + jq -r '.status.booted.image.image.image // empty' 2>/dev/null || true)" + fi + if [[ -n "$booted_ref" ]]; then + local ref_without_digest="${booted_ref%@*}" + local image_component="${ref_without_digest##*/}" + IMAGE_REF="$booted_ref" + if [[ "$image_component" == *:* ]]; then + IMAGE_NAME="${image_component%:*}" + IMAGE_TAG="${image_component##*:}" + else + IMAGE_NAME="$image_component" + IMAGE_TAG="unknown" + fi + fi } read_boot_status() { @@ -652,6 +670,7 @@ start_bug_report() { local description local reproduction + read_boot_status read_image_info route_issue_repo gum style --bold --foreground 212 "Bug report" @@ -663,7 +682,6 @@ start_bug_report() { printf '\nSelect any relevant smart-log profiles (or none):\n' choose_profiles - read_boot_status create_draft "$BUG_REPO" : > "$DRAFT_DIR/bug-report.txt" collect_baseline "$title" "$description" "$reproduction" @@ -692,8 +710,8 @@ main() { parse_args "$@" if [[ -n "$CONFIRM_TARGET" ]]; then - read_image_info read_boot_status + read_image_info route_issue_repo parse_confirm_target "$CONFIRM_TARGET" "$BUG_REPO" confirm_report "$CONFIRM_ISSUE" "$CONFIRM_REPO" diff --git a/tests/test_bonedigger_report.bats b/tests/test_bonedigger_report.bats index 8ed9a6e4..6f12007b 100755 --- a/tests/test_bonedigger_report.bats +++ b/tests/test_bonedigger_report.bats @@ -61,6 +61,38 @@ teardown() { [ "$output" = "projectbluefin/common" ] } +@test "image info prefers booted image reference over stale build metadata" { + printf '%s\n' '{"image-name":"bluefin","image-tag":"latest","image-ref":"ghcr.io/projectbluefin/bluefin:latest","image-flavor":"main"}' \ + > "$WORKDIR/stale-image-info.json" + + run bash -c ' + source "$1" + BOOTC_JSON='{"status":{"booted":{"image":{"image":{"image":"ghcr.io/projectbluefin/dakota:stable"}}}}}' + IMAGE_INFO_FILE="$2" + read_image_info + printf "%s|%s|%s" "$IMAGE_NAME" "$IMAGE_TAG" "$IMAGE_REF" + ' _ "$BONEDIGGER_SCRIPT" "$WORKDIR/stale-image-info.json" + + [ "$status" -eq 0 ] + [ "$output" = "dakota|stable|ghcr.io/projectbluefin/dakota:stable" ] +} + +@test "image info falls back when no booted image is reported" { + printf '%s\n' '{"image-name":"bluefin","image-tag":"latest","image-ref":"ghcr.io/projectbluefin/bluefin:latest","image-flavor":"main"}' \ + > "$WORKDIR/stale-image-info.json" + + run bash -c ' + source "$1" + BOOTC_JSON='{"status":{"booted":null}}' + IMAGE_INFO_FILE="$2" + read_image_info + printf "%s|%s" "$IMAGE_NAME" "$IMAGE_TAG" + ' _ "$BONEDIGGER_SCRIPT" "$WORKDIR/stale-image-info.json" + + [ "$status" -eq 0 ] + [ "$output" = "bluefin|latest" ] +} + @test "queue choices map to at most one supported queue label" { run bash -c 'source "$1"; queue_label_for_choice "$2"' _ \ "$BONEDIGGER_SCRIPT" "Submit to the clanker queue for machine analysis" From 299e5e213455648de21306316e62e4bfa57fc72e Mon Sep 17 00:00:00 2001 From: castrojo Date: Sun, 6 Sep 2026 01:07:48 +0000 Subject: [PATCH 2/3] chore: trigger CI with updated PR title From 0bffce89212efe84476a9fb2aa6f2b38b6b1b39b Mon Sep 17 00:00:00 2001 From: "sec-check[bot]" Date: Thu, 17 Sep 2026 19:56:43 -0400 Subject: [PATCH 3/3] test(bonedigger-report): fix shell quoting that stubbed BOOTC_JSON with invalid JSON MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The two image-info tests embedded their BOOTC_JSON fixture inside the single-quoted 'bash -c' body: run bash -c ' ... BOOTC_JSON='{"status":{"booted":...}}' ... ' _ "$BONEDIGGER_SCRIPT" "$WORKDIR/stale-image-info.json" The inner quotes close the outer single-quoted string, so the JSON was left unquoted and the outer shell stripped every double quote from it: {status:{booted:{image:{image:{image:ghcr.io/projectbluefin/dakota:stable}}}}} jq could not parse that, returned empty, and read_image_info silently fell back to the stale image-info.json. That made 'image info prefers booted image reference over stale build metadata' fail, and made 'image info falls back when no booted image is reported' pass for the wrong reason — it exercised the fallback because the fixture was corrupt, not because booted was null. Pass the fixture as a positional argument instead so it reaches the script intact. Both tests now exercise the branch they name; mutating the jq query in read_image_info turns the first one red, which it did not before. Signed-off-by: sec-check[bot] --- tests/test_bonedigger_report.bats | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/tests/test_bonedigger_report.bats b/tests/test_bonedigger_report.bats index 6f12007b..c96e136b 100755 --- a/tests/test_bonedigger_report.bats +++ b/tests/test_bonedigger_report.bats @@ -67,11 +67,12 @@ teardown() { run bash -c ' source "$1" - BOOTC_JSON='{"status":{"booted":{"image":{"image":{"image":"ghcr.io/projectbluefin/dakota:stable"}}}}}' IMAGE_INFO_FILE="$2" + BOOTC_JSON="$3" read_image_info printf "%s|%s|%s" "$IMAGE_NAME" "$IMAGE_TAG" "$IMAGE_REF" - ' _ "$BONEDIGGER_SCRIPT" "$WORKDIR/stale-image-info.json" + ' _ "$BONEDIGGER_SCRIPT" "$WORKDIR/stale-image-info.json" \ + '{"status":{"booted":{"image":{"image":{"image":"ghcr.io/projectbluefin/dakota:stable"}}}}}' [ "$status" -eq 0 ] [ "$output" = "dakota|stable|ghcr.io/projectbluefin/dakota:stable" ] @@ -83,11 +84,12 @@ teardown() { run bash -c ' source "$1" - BOOTC_JSON='{"status":{"booted":null}}' IMAGE_INFO_FILE="$2" + BOOTC_JSON="$3" read_image_info printf "%s|%s" "$IMAGE_NAME" "$IMAGE_TAG" - ' _ "$BONEDIGGER_SCRIPT" "$WORKDIR/stale-image-info.json" + ' _ "$BONEDIGGER_SCRIPT" "$WORKDIR/stale-image-info.json" \ + '{"status":{"booted":null}}' [ "$status" -eq 0 ] [ "$output" = "bluefin|latest" ]