Skip to content

Commit 64d2e65

Browse files
coleenquadroscoleenquadros
authored
Add observability component repository mappings
Added mappings for observability components to their respective GitHub repositories and branch strategies for CVE fix workflows.
1 parent 2239b41 commit 64d2e65

1 file changed

Lines changed: 301 additions & 1 deletion

File tree

‎workflows/cve-fixer/component-repository-mappings.json‎

Lines changed: 301 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -887,8 +887,308 @@
887887
}
888888
}
889889
}
890+
},
891+
"Observability": {
892+
"container_to_repo_mapping": {
893+
"rhacm2/multicluster-observability-rhel9-operator": "stolostron/multicluster-observability-operator",
894+
"rhacm2/acm-multicluster-observability-addon-rhel9": "stolostron/multicluster-observability-addon",
895+
"rhacm2/kube-state-metrics-rhel9": "stolostron/kube-state-metrics",
896+
"rhacm2/observatorium-rhel9": "stolostron/observatorium",
897+
"rhacm2/observatorium-operator-rhel9": "stolostron/observatorium-operator",
898+
"rhacm2/thanos-rhel9": "stolostron/thanos",
899+
"rhacm2/thanos-receive-controller-rhel9": "stolostron/thanos-receive-controller",
900+
"rhacm2/prometheus-alertmanager-rhel9": "stolostron/prometheus-alertmanager",
901+
"rhacm2/prometheus-rhel9": "stolostron/prometheus",
902+
"rhacm2/prometheus-operator-rhel9": "stolostron/prometheus-operator",
903+
"rhacm2/node-exporter-rhel9": "stolostron/node-exporter",
904+
"rhacm2/kube-rbac-proxy-rhel9": "stolostron/kube-rbac-proxy",
905+
"rhacm2/acm-grafana-rhel9": "stolostron/grafana",
906+
"rhacm2/memcached-exporter-rhel9": "stolostron/memcached-exporter"
907+
},
908+
"repositories": {
909+
"stolostron/multicluster-observability-operator": {
910+
"github_url": "https://github.com/stolostron/multicluster-observability-operator",
911+
"default_branch": "main",
912+
"active_release_branches": [
913+
"release-2.16",
914+
"release-2.15",
915+
"release-2.14",
916+
"release-2.13"
917+
],
918+
"branch_strategy": "Fix in main, backport to active release branches (release-2.13 through release-2.16)",
919+
"repo_type": "golang",
920+
"cve_fix_workflow": {
921+
"primary_target": "main",
922+
"backport_targets": "release-2.16, release-2.15, release-2.14, release-2.13"
923+
},
924+
"test_command": "make lint",
925+
"build_command": "make build",
926+
"notes": "Go project. Run 'go mod tidy' after dependency updates. CI config in .github/workflows/"
927+
},
928+
"stolostron/multicluster-observability-addon": {
929+
"github_url": "https://github.com/stolostron/multicluster-observability-addon",
930+
"default_branch": "main",
931+
"active_release_branches": [
932+
"release-2.16",
933+
"release-2.15",
934+
"release-2.14",
935+
"release-2.13"
936+
],
937+
"branch_strategy": "Fix in main, backport to active release branches (release-2.13 through release-2.16)",
938+
"repo_type": "golang",
939+
"cve_fix_workflow": {
940+
"primary_target": "main",
941+
"backport_targets": "release-2.16, release-2.15, release-2.14, release-2.13"
942+
},
943+
"test_command": "make lint",
944+
"build_command": "make addon",
945+
"special_requirements": [
946+
"Uses bingo for tool management (.bingo/Variables.mk)",
947+
"Different golangci-lint versions per branch (v2.0.2 on release-2.14, v2.5.0 on release-2.16+)",
948+
"May require 'replace' directives for transitive dependency issues (e.g., go.opentelemetry.io/contrib/otelconf)"
949+
],
950+
"notes": "Go project with OpenTelemetry dependencies. Run 'make deps' to verify go.mod/go.sum completeness."
951+
},
952+
"stolostron/kube-state-metrics": {
953+
"github_url": "https://github.com/stolostron/kube-state-metrics",
954+
"default_branch": "main",
955+
"active_release_branches": [
956+
"release-2.17",
957+
"release-2.16",
958+
"release-2.15",
959+
"release-2.14",
960+
"release-2.13"
961+
],
962+
"branch_strategy": "Release branches only (no main branch used for CVE fixes). Fix in latest release branch first.",
963+
"repo_type": "golang",
964+
"cve_fix_workflow": {
965+
"primary_target": "release-2.17",
966+
"backport_targets": "release-2.16, release-2.15, release-2.14, release-2.13"
967+
},
968+
"test_command": "make test",
969+
"build_command": "make build",
970+
"notes": "No main branch - work directly on release branches"
971+
},
972+
"stolostron/observatorium": {
973+
"github_url": "https://github.com/stolostron/observatorium",
974+
"default_branch": "main",
975+
"active_release_branches": [
976+
"release-2.16",
977+
"release-2.15",
978+
"release-2.14",
979+
"release-2.13"
980+
],
981+
"branch_strategy": "Fix in main, backport to active release branches (release-2.13 through release-2.16)",
982+
"repo_type": "golang",
983+
"cve_fix_workflow": {
984+
"primary_target": "main",
985+
"backport_targets": "release-2.16, release-2.15, release-2.14, release-2.13"
986+
},
987+
"test_command": "make test",
988+
"build_command": "make build",
989+
"special_requirements": [
990+
"Uses 'replace' directives in go.mod for dependency pinning",
991+
"API compatibility: prometheus/common version upgrades may require code changes (e.g., version.NewCollector removed in v0.63.0)",
992+
"Vendor directory excluded in .gitignore - CI runs 'go mod vendor' during build"
993+
],
994+
"notes": "Go project. Check main.go for API usage when upgrading prometheus/common or similar packages."
995+
},
996+
"stolostron/observatorium-operator": {
997+
"github_url": "https://github.com/stolostron/observatorium-operator",
998+
"default_branch": "main",
999+
"active_release_branches": [
1000+
"release-2.16",
1001+
"release-2.15",
1002+
"release-2.14",
1003+
"release-2.13"
1004+
],
1005+
"branch_strategy": "Fix in main, backport to active release branches (release-2.13 through release-2.16)",
1006+
"repo_type": "golang",
1007+
"cve_fix_workflow": {
1008+
"primary_target": "main",
1009+
"backport_targets": "release-2.16, release-2.15, release-2.14, release-2.13"
1010+
},
1011+
"test_command": "make test",
1012+
"build_command": "make build",
1013+
"notes": "Go project. Verify dependency usage before applying CVE fixes."
1014+
},
1015+
"stolostron/thanos": {
1016+
"github_url": "https://github.com/stolostron/thanos",
1017+
"default_branch": "release-2.17",
1018+
"active_release_branches": [
1019+
"release-2.16",
1020+
"release-2.15",
1021+
"release-2.14",
1022+
"release-2.13"
1023+
],
1024+
"branch_strategy": "Release branches (release-2.13 through release-2.17). Fix in latest release branch first.",
1025+
"repo_type": "golang",
1026+
"cve_fix_workflow": {
1027+
"primary_target": "release-2.17",
1028+
"backport_targets": "release-2.16, release-2.15, release-2.14, release-2.13"
1029+
},
1030+
"test_command": "make test",
1031+
"build_command": "make build",
1032+
"notes": "Go project. Thanos fork."
1033+
},
1034+
"stolostron/thanos-receive-controller": {
1035+
"github_url": "https://github.com/stolostron/thanos-receive-controller",
1036+
"default_branch": "release-2.17",
1037+
"active_release_branches": [
1038+
"release-2.16",
1039+
"release-2.15",
1040+
"release-2.14",
1041+
"release-2.13"
1042+
],
1043+
"branch_strategy": "Release branches only. Fix in latest release branch first.",
1044+
"repo_type": "golang",
1045+
"cve_fix_workflow": {
1046+
"primary_target": "release-2.17",
1047+
"backport_targets": "release-2.16, release-2.15, release-2.14, release-2.13"
1048+
},
1049+
"test_command": "make test",
1050+
"build_command": "make build",
1051+
"special_requirements": [
1052+
"CI configuration in .github/env (golang-version setting)",
1053+
"Go version upgrades require updating both go.mod AND .github/env",
1054+
"golangci-lint must be built with Go version >= project's Go version"
1055+
],
1056+
"notes": "Update .github/env golang-version when upgrading Go version in go.mod"
1057+
},
1058+
"stolostron/prometheus-alertmanager": {
1059+
"github_url": "https://github.com/stolostron/prometheus-alertmanager",
1060+
"default_branch": "release-2.17",
1061+
"active_release_branches": [
1062+
"release-2.16",
1063+
"release-2.15",
1064+
"release-2.14",
1065+
"release-2.13"
1066+
],
1067+
"branch_strategy": "Release branches (release-2.13 through release-2.17). Fix in latest release branch first.",
1068+
"repo_type": "golang",
1069+
"cve_fix_workflow": {
1070+
"primary_target": "release-2.17",
1071+
"backport_targets": "release-2.16, release-2.15, release-2.14, release-2.13"
1072+
},
1073+
"test_command": "make test",
1074+
"build_command": "make build",
1075+
"special_requirements": [
1076+
"CI configuration in .github/workflows/golangci-lint.yml",
1077+
"Go version upgrades require updating both go.mod AND .github/workflows/.yml",
1078+
"golangci-lint version pinning: use 'version: latest' for Go 1.24+ compatibility",
1079+
"Workflow scope required on GitHub PAT to modify .github/workflows/.yml files"
1080+
],
1081+
"notes": "Update .github/workflows/golangci-lint.yml go-version when upgrading Go version. Use 'version: latest' for golangci-lint."
1082+
},
1083+
"stolostron/prometheus": {
1084+
"github_url": "https://github.com/stolostron/prometheus",
1085+
"default_branch": "release-2.17",
1086+
"active_release_branches": [
1087+
"release-2.16",
1088+
"release-2.15",
1089+
"release-2.14",
1090+
"release-2.13"
1091+
],
1092+
"branch_strategy": "Release branches (release-2.13 through release-2.17). Fix in latest release branch first.",
1093+
"repo_type": "golang",
1094+
"cve_fix_workflow": {
1095+
"primary_target": "release-2.17",
1096+
"backport_targets": "release-2.16, release-2.15, release-2.14, release-2.13"
1097+
},
1098+
"test_command": "make test",
1099+
"build_command": "make build",
1100+
"notes": "Go project. Standard prometheus fork."
1101+
},
1102+
"stolostron/prometheus-operator": {
1103+
"github_url": "https://github.com/stolostron/prometheus-operator",
1104+
"default_branch": "release-2.17",
1105+
"active_release_branches": [
1106+
"release-2.16",
1107+
"release-2.15",
1108+
"release-2.14",
1109+
"release-2.13"
1110+
],
1111+
"branch_strategy": "Release branches (release-2.13 through release-2.17). Fix in latest release branch first.",
1112+
"repo_type": "golang",
1113+
"cve_fix_workflow": {
1114+
"primary_target": "release-2.17",
1115+
"backport_targets": "release-2.16, release-2.15, release-2.14, release-2.13"
1116+
},
1117+
"test_command": "make test",
1118+
"build_command": "make build",
1119+
"notes": "Go project. Kubernetes operator for Prometheus."
1120+
},
1121+
"stolostron/node-exporter": {
1122+
"github_url": "https://github.com/stolostron/node-exporter",
1123+
"default_branch": "release-2.17",
1124+
"active_release_branches": [
1125+
"release-2.16",
1126+
"release-2.15",
1127+
"release-2.14",
1128+
"release-2.13"
1129+
],
1130+
"branch_strategy": "Release branches (release-2.13 through release-2.17). Fix in latest release branch first.",
1131+
"repo_type": "golang",
1132+
"cve_fix_workflow": {
1133+
"primary_target": "release-2.17",
1134+
"backport_targets": "release-2.16, release-2.15, release-2.14, release-2.13"
1135+
},
1136+
"test_command": "make test",
1137+
"build_command": "make build",
1138+
"notes": "Go project. Prometheus node exporter."
1139+
},
1140+
"stolostron/kube-rbac-proxy": {
1141+
"github_url": "https://github.com/stolostron/kube-rbac-proxy",
1142+
"default_branch": "release-2.17",
1143+
"active_release_branches": [
1144+
"release-2.16",
1145+
"release-2.15",
1146+
"release-2.14",
1147+
"release-2.13",
1148+
"backplane-2.10",
1149+
"backplane-2.9",
1150+
"backplane-2.8",
1151+
"backplane-2.7",
1152+
"backplane-2.6"
1153+
],
1154+
"branch_strategy": "Release branches (release-2.13 through release-2.17). Fix in latest release branch first. Backplane branches (backplane-2.6 through backplane-2.10). Different branch naming pattern from other observability repos.",
1155+
"repo_type": "golang",
1156+
"cve_fix_workflow": {
1157+
"primary_target": "release-2.17",
1158+
"backport_targets": "release-2.16, release-2.15, release-2.14, release-2.13, backplane-2.10 backplane-2.9, backplane-2.8, backplane-2.7, backplane-2.6"
1159+
},
1160+
"test_command": "make test-unit",
1161+
"build_command": "make build",
1162+
"special_requirements": [
1163+
"Different branch naming: backplane-X.Y in addtion to release-X.Y",
1164+
"May require k8s.io/klog/v2 compatibility updates when upgrading grpc",
1165+
"Go version upgrades may be required (e.g., grpc v1.79.3 requires Go 1.24.0)",
1166+
"Some branches may need downgrading to consistent versions (e.g., backplane-2.9 and 2.10 had grpc v1.80.0, downgraded to v1.79.3 for consistency)"
1167+
],
1168+
"notes": "Older branches (backplane-2.6, 2.7) use Go 1.23-1.24 with grpc v1.56.3. Newer branches (2.9, 2.10) had newer versions but were standardized to v1.79.3."
1169+
},
1170+
"stolostron/grafana": {
1171+
"github_url": "https://github.com/stolostron/grafana",
1172+
"default_branch": "release-2.17",
1173+
"active_release_branches": [
1174+
"release-2.16",
1175+
"release-2.15",
1176+
"release-2.14",
1177+
"release-2.13"
1178+
],
1179+
"branch_strategy": "Release branches (release-2.13 through release-2.17). Fix in latest release branch first.",
1180+
"repo_type": "golang",
1181+
"cve_fix_workflow": {
1182+
"primary_target": "release-2.17",
1183+
"backport_targets": "release-2.16, release-2.15, release-2.14, release-2.13"
1184+
},
1185+
"test_command": "make test",
1186+
"build_command": "make build",
1187+
"notes": "Go project. Grafana fork."
1188+
}
1189+
}
8901190
}
891-
},
1191+
},
8921192
"metadata": {
8931193
"description": "Component to repository and branch mappings for CVE fix workflow automation",
8941194
"purpose": "Maps Jira components to GitHub repositories and their branch strategies for automated CVE patching",

0 commit comments

Comments
 (0)