Skip to content

HYPERFLEET-1195 - docs: add common when patterns and combination guide#238

Merged
openshift-merge-bot[bot] merged 1 commit into
openshift-hyperfleet:mainfrom
rafabene:HYPERFLEET-1195-when-condition-docs
Jul 13, 2026
Merged

HYPERFLEET-1195 - docs: add common when patterns and combination guide#238
openshift-merge-bot[bot] merged 1 commit into
openshift-hyperfleet:mainfrom
rafabene:HYPERFLEET-1195-when-condition-docs

Conversation

@rafabene

@rafabene rafabene commented Jul 10, 2026

Copy link
Copy Markdown
Member

Summary

  • Add skipped-path example (adapter.resourcesSkipped) to the kubernetes/ example adapter, complementing the existing normal-path when gate — demonstrates both conditional payloads and conditional post-actions
  • Add "Common when patterns" quick-reference table with 5 common expressions
  • Add "Combining when on payloads and post-actions" subsection explaining the dual-gate pattern vs. auto-skip behavior
  • Add cross-reference to the kubernetes example

Context

HYPERFLEET-1195

Test plan

  • Verify YAML syntax is valid
  • Review that skipped payload follows the status contract "Preconditions NOT Met" pattern
  • Confirm when expressions use standard CEL patterns
  • Verify markdown formatting renders correctly

@openshift-ci
openshift-ci Bot requested review from ma-hill and rh-amarin July 10, 2026 14:33
@coderabbitai

coderabbitai Bot commented Jul 10, 2026

Copy link
Copy Markdown
📝 Walkthrough

Walkthrough

Adds a “Common when patterns” subsection to the adapter authoring guide. It documents CEL expressions for resource skipping, successful or failed execution, deletion handling, and optional resource existence. The Kubernetes adapter configuration now provides a simplified status payload and conditional post-action when resources are skipped, while gating the full status path otherwise. No exported or public entities are changed.

Estimated code review effort: 2 (Simple) | ~10 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Adapter
  participant Payload
  participant ClusterAPI
  Adapter->>Payload: Evaluate adapter.resourcesSkipped
  Payload->>ClusterAPI: PUT cluster status
Loading

Suggested reviewers: ma-hill, rh-amarin

🚥 Pre-merge checks | ✅ 11
✅ Passed checks (11 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Sec-02: Secrets In Log Output ✅ Passed Touched files are docs/YAML only; no slog/logr/zap/fmt.Print* calls with token/password/credential/secret fields. CWE-532 not present.
No Hardcoded Secrets ✅ Passed PASS: In the modified docs/YAML sections, I found no CWE-798/CWE-259 secrets, no >32-char base64 blobs, and no user:pass@ URLs; only example CEL/status text.
No Weak Cryptography ✅ Passed No CWE-327/916 issues: the PR only changes docs/YAML and contains no banned primitives, ECB, custom crypto, or secret comparisons.
No Injection Vectors ✅ Passed PASS: touched docs/YAML only; no CWE-89/78/79/502 sinks found in changed files.
No Privileged Containers ✅ Passed PR files are docs/example YAML only; scan found no privileged:true, hostPID/Network/IPC, allowPrivilegeEscalation, SYS_ADMIN, or root-user settings (CWE-250).
No Pii Or Sensitive Data In Logs ✅ Passed PASS: PR changes only docs/YAML; no slog/logr/zap/fmt.Print* calls or other logging paths were added, so no CWE-532 exposure.
Title check ✅ Passed The title is concise and accurately reflects the main docs change about common when patterns and combining gates.
Description check ✅ Passed The description matches the documented when patterns, skipped-path example, and payload/post-action combination changes.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
✨ Simplify code
  • Create PR with simplified code

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/adapter-authoring-guide.md`:
- Line 1234: The “Skip when no work done” pattern uses the inverted condition
`!adapter.resourcesSkipped`, which runs when work was done. Rename it to “Run
when work was done,” or change the example condition to
`adapter.resourcesSkipped` so the label and behavior match.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: b3a3b097-7e3c-403a-b51a-eaab83d640bc

📥 Commits

Reviewing files that changed from the base of the PR and between aa7a440 and c716072.

📒 Files selected for processing (1)
  • docs/adapter-authoring-guide.md
🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

  • openshift-hyperfleet/architecture (manual)
  • openshift-hyperfleet/hyperfleet-api (manual)
  • openshift-hyperfleet/hyperfleet-sentinel (manual)
  • openshift-hyperfleet/hyperfleet-adapter (manual)
  • openshift-hyperfleet/hyperfleet-broker (manual)

Comment thread docs/adapter-authoring-guide.md Outdated
@hyperfleet-ci-bot

hyperfleet-ci-bot Bot commented Jul 10, 2026

Copy link
Copy Markdown

Risk Score: 0 — risk/low

Signal Detail Points
PR size 77 lines +0
Sensitive paths none +0

Computed by hyperfleet-risk-scorer

@rafabene
rafabene force-pushed the HYPERFLEET-1195-when-condition-docs branch from c716072 to a46c325 Compare July 13, 2026 13:24
Add skipped-path example (adapter.resourcesSkipped) to the kubernetes
example adapter, complementing the existing normal-path when gate.
Demonstrates conditional payloads and post-actions for adapter authors.

Enhance authoring guide with common when patterns table, guidance on
combining when on payloads and post-actions, and cross-reference to
the kubernetes example.
@rafabene
rafabene force-pushed the HYPERFLEET-1195-when-condition-docs branch from a46c325 to e865be9 Compare July 13, 2026 13:25

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@charts/examples/kubernetes/adapter-task-config.yaml`:
- Around line 171-191: Update the resourcesSkipped handling in the adapter build
configuration so this payload is selected only for the successful
PreconditionNotMet outcome, rather than every skipped-resource case. Add a
separate failure-reporting path for PreconditionFailed and other skip causes,
preserving accurate outcome-specific condition type, status, reason, and message
metadata instead of hardcoding Health=True, NoErrors, and PreconditionsNotMet.
- Around line 168-172: The Kubernetes example defines skippedStatusPayload
without any precondition or skip-triggering flow. Update the task configuration
around checkClusterState and skippedStatusPayload to add a concrete precondition
with explicit match and no-match handling that sets adapter.resourcesSkipped
when resources are skipped, or remove the skipped status payload branch if this
example should not support skipping.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 8b3b8ec0-552e-4cb8-83e4-4a56f7c29912

📥 Commits

Reviewing files that changed from the base of the PR and between c716072 and e865be9.

📒 Files selected for processing (2)
  • charts/examples/kubernetes/adapter-task-config.yaml
  • docs/adapter-authoring-guide.md
🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

  • openshift-hyperfleet/architecture (manual)
  • openshift-hyperfleet/hyperfleet-api (manual)
  • openshift-hyperfleet/hyperfleet-sentinel (manual)
  • openshift-hyperfleet/hyperfleet-adapter (manual)
  • openshift-hyperfleet/hyperfleet-broker (manual)
🚧 Files skipped from review as they are similar to previous changes (1)
  • docs/adapter-authoring-guide.md

Comment on lines +168 to +172
# Skipped path: preconditions not met — report simplified status without
# evaluating resources.* (which may not exist in this context)
- name: "skippedStatusPayload"
when:
expression: "adapter.resourcesSkipped"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

rg -n -C3 \
  '^[[:space:]]*preconditions:|ResourcesSkipped|SetSkipped|PreconditionFailed|ResourceNotFound|skippedStatusPayload|reportClusterStatusSkipped' \
  internal/executor charts/examples/kubernetes/adapter-task-config.yaml

Repository: openshift-hyperfleet/hyperfleet-adapter

Length of output: 38076


🏁 Script executed:

#!/bin/bash
set -euo pipefail

sed -n '1,260p' charts/examples/kubernetes/adapter-task-config.yaml

Repository: openshift-hyperfleet/hyperfleet-adapter

Length of output: 8256


🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
from pathlib import Path
p = Path('charts/examples/kubernetes/adapter-task-config.yaml')
for start, end in [(1, 260)]:
    lines = p.read_text().splitlines()
    for i in range(start-1, min(end, len(lines))):
        print(f"{i+1:4d}: {lines[i]}")
PY

Repository: openshift-hyperfleet/hyperfleet-adapter

Length of output: 9582


🏁 Script executed:

#!/bin/bash
set -euo pipefail

fd -t f -a . charts/examples | sed -n '1,120p'

Repository: openshift-hyperfleet/hyperfleet-adapter

Length of output: 1769


🏁 Script executed:

#!/bin/bash
set -euo pipefail

rg -n -C2 'preconditions:|resourcesSkipped|skippedStatusPayload|reportClusterStatusSkipped' charts/examples

Repository: openshift-hyperfleet/hyperfleet-adapter

Length of output: 11862


🏁 Script executed:

#!/bin/bash
set -euo pipefail

sed -n '1,220p' charts/examples/kubernetes/README.md

Repository: openshift-hyperfleet/hyperfleet-adapter

Length of output: 3968


Add a real skip path to the Kubernetes example (CWE-561). charts/examples/kubernetes/adapter-task-config.yaml documents skippedStatusPayload, but this example never defines any preconditions: or other skip-triggering branch, so adapter.resourcesSkipped cannot drive that payload/post-action. Wire checkClusterState into a concrete precondition with both match and no-match cases, or drop the skipped branch from the example.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@charts/examples/kubernetes/adapter-task-config.yaml` around lines 168 - 172,
The Kubernetes example defines skippedStatusPayload without any precondition or
skip-triggering flow. Update the task configuration around checkClusterState and
skippedStatusPayload to add a concrete precondition with explicit match and
no-match handling that sets adapter.resourcesSkipped when resources are skipped,
or remove the skipped status payload branch if this example should not support
skipping.

Source: Path instructions

Comment on lines +171 to +191
when:
expression: "adapter.resourcesSkipped"
build:
adapter: "{{ .adapter.name }}"
conditions:
- type: "Applied"
status: "False"
reason: "PreconditionsNotMet"
message:
expression: |
"Resources skipped: " + adapter.?skipReason.orValue("preconditions not met")
- type: "Available"
status: "False"
reason: "PreconditionsNotMet"
message:
expression: |
"Resources not available: " + adapter.?skipReason.orValue("preconditions not met")
- type: "Health"
status: "True"
reason: "NoErrors"
message: "Adapter is healthy, no work performed due to preconditions"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift

Do not classify every resourcesSkipped outcome as a healthy precondition skip (CWE-754).

This payload hardcodes Health=True, NoErrors, and PreconditionsNotMet, but resourcesSkipped also represents failed precondition evaluation and resource-not-found handling. A failed precondition can therefore be persisted through the new PUT action as a healthy status, while a not-found case is mislabeled as a precondition skip. (raw.githubusercontent.com)

Use distinct outcome metadata: select this payload only for a successful PreconditionNotMet business outcome, and add a separate failure-reporting path for PreconditionFailed and other skip causes.

As per path instructions: “Prioritize Critical and Major severity issues” and validate cross-layer contracts.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@charts/examples/kubernetes/adapter-task-config.yaml` around lines 171 - 191,
Update the resourcesSkipped handling in the adapter build configuration so this
payload is selected only for the successful PreconditionNotMet outcome, rather
than every skipped-resource case. Add a separate failure-reporting path for
PreconditionFailed and other skip causes, preserving accurate outcome-specific
condition type, status, reason, and message metadata instead of hardcoding
Health=True, NoErrors, and PreconditionsNotMet.

Source: Path instructions

@rh-amarin

Copy link
Copy Markdown
Contributor

/lgtm

@openshift-ci

openshift-ci Bot commented Jul 13, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: rh-amarin

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@kuudori

kuudori commented Jul 13, 2026

Copy link
Copy Markdown
Contributor

/test presubmits-integration

@openshift-merge-bot
openshift-merge-bot Bot merged commit be45443 into openshift-hyperfleet:main Jul 13, 2026
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants