Skip to content

Commit dd5593f

Browse files
vmrh21claude
vmrh21
and
claude
committed
feat: add subcomponent field for repo chain scoping
Add subcomponent field to repos in Model as a Service, llm-d, and AI Evaluations so cve.fix can identify which upstream/midstream/downstream repos belong to the same container chain. - cve.fix Step 3 now uses subcomponent to scope PRs to the affected container's chain only; falls back to all component repos (with scan-based filtering) when subcomponent is not defined - Add missing AI Evaluations container mappings (eval-hub, garak) and ragas repo chain (upstream/midstream/downstream) Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
1 parent 4c50369 commit dd5593f

2 files changed

Lines changed: 109 additions & 33 deletions

File tree

‎workflows/cve-fixer/.claude/commands/cve.fix.md‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -122,19 +122,19 @@ Summary:
122122

123123
If a `CONTAINER` was extracted in Step 1:
124124
- Look up `CONTAINER` in `container_to_repo_mapping` for the component
125-
- This gives the **primary repo** (e.g., `opendatahub-io/llm-d-routing-sidecar`)
126-
- From the `repositories` section, collect all repos that share the same logical chain as the primary repo:
127-
- The primary repo itself
128-
- Any repo with the same name but different org (upstream/midstream/downstream)
129-
- **This ensures only the repos relevant to that specific container get PRs** — not every repo under the component
125+
- This gives the **primary repo** (e.g., `opendatahub-io/workload-variant-autoscaler`)
126+
- Check if the primary repo has a `subcomponent` field in the `repositories` section
127+
- **If `subcomponent` is defined**: collect all repos in the component with the same `subcomponent` value — this is the chain (upstream + midstream + downstream)
128+
- **If `subcomponent` is not defined**: process ALL repositories in the component (safe fallback — the CVE scan in Step 5 will filter out repos where the CVE doesn't exist)
129+
- **This ensures only the repos relevant to that specific container get PRs** — not repos belonging to other subcomponents
130130

131-
Example: `rhoai/odh-llm-d-routing-sidecar-rhel9` maps to `red-hat-data-services/llm-d-routing-sidecar`.
132-
Only process repos in the routing-sidecar chain — not inference-scheduler or batch-gateway repos.
131+
Example: `rhoai/odh-workload-variant-autoscaler-controller-rhel9` → primary repo `opendatahub-io/workload-variant-autoscaler` → `subcomponent: autoscaler` → only process `llm-d/llm-d-workload-variant-autoscaler`, `opendatahub-io/workload-variant-autoscaler`, `red-hat-data-services/workload-variant-autoscaler`.
133132

134133
**3.2: Fallback — use all repos**
135134

136135
If no `CONTAINER` was extracted (summary doesn't match expected pattern):
137-
- Fall back to processing ALL repositories listed under the component
136+
- Process ALL repositories listed under the component
137+
- The CVE scan in Step 5 acts as the safety net — it will skip repos where the CVE doesn't exist
138138
- Log a warning: "⚠️ Could not extract container from summary — processing all component repos"
139139

140140
**3.3: For each target repo, gather:**

‎workflows/cve-fixer/component-repository-mappings.json‎

Lines changed: 101 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,8 @@
6060
},
6161
"build_location": "maas-api/",
6262
"notes": "Upstream repository. Contains maas-api Go application. Builds using Dockerfile.konflux for Red Hat builds.",
63-
"repo_type": "upstream"
63+
"repo_type": "upstream",
64+
"subcomponent": "maas-api"
6465
},
6566
"red-hat-data-services/models-as-a-service": {
6667
"github_url": "https://github.com/red-hat-data-services/models-as-a-service",
@@ -78,7 +79,8 @@
7879
},
7980
"build_location": "maas-api/",
8081
"notes": "Downstream Red Hat release repository for maas-api. Fixes from upstream should be backported to rhoai-3.0 branch.",
81-
"repo_type": "downstream"
82+
"repo_type": "downstream",
83+
"subcomponent": "maas-api"
8284
}
8385
}
8486
},
@@ -394,7 +396,8 @@
394396
"cve_fix_workflow": {
395397
"primary_target": "main",
396398
"backport_targets": "release-0.5, release-0.6"
397-
}
399+
},
400+
"subcomponent": "inference-scheduler"
398401
},
399402
"opendatahub-io/llm-d-inference-scheduler": {
400403
"github_url": "https://github.com/opendatahub-io/llm-d-inference-scheduler",
@@ -410,7 +413,8 @@
410413
"cve_fix_workflow": {
411414
"primary_target": "main",
412415
"backport_targets": "release-0.2, release-0.3.1, release-v0.4, stable-2.x"
413-
}
416+
},
417+
"subcomponent": "inference-scheduler"
414418
},
415419
"red-hat-data-services/llm-d-inference-scheduler": {
416420
"github_url": "https://github.com/red-hat-data-services/llm-d-inference-scheduler",
@@ -426,7 +430,8 @@
426430
"cve_fix_workflow": {
427431
"primary_target": "main",
428432
"backport_targets": "rhoai-3.3, rhoai-3.4, rhoai-3.4-ea.1, rhoai-3.4-ea.2"
429-
}
433+
},
434+
"subcomponent": "inference-scheduler"
430435
},
431436
"red-hat-data-services/llm-d-routing-sidecar": {
432437
"github_url": "https://github.com/red-hat-data-services/llm-d-routing-sidecar",
@@ -442,7 +447,8 @@
442447
"cve_fix_workflow": {
443448
"primary_target": "main",
444449
"backport_targets": "rhoai-2.25, rhoai-3.0, rhoai-3.2"
445-
}
450+
},
451+
"subcomponent": "routing-sidecar"
446452
},
447453
"llm-d-incubation/batch-gateway": {
448454
"github_url": "https://github.com/llm-d-incubation/batch-gateway",
@@ -453,7 +459,8 @@
453459
"cve_fix_workflow": {
454460
"primary_target": "main",
455461
"backport_targets": "None"
456-
}
462+
},
463+
"subcomponent": "batch-gateway"
457464
},
458465
"opendatahub-io/batch-gateway": {
459466
"github_url": "https://github.com/opendatahub-io/batch-gateway",
@@ -466,7 +473,8 @@
466473
"cve_fix_workflow": {
467474
"primary_target": "main",
468475
"backport_targets": "release-v0.5"
469-
}
476+
},
477+
"subcomponent": "batch-gateway"
470478
},
471479
"red-hat-data-services/batch-gateway": {
472480
"github_url": "https://github.com/red-hat-data-services/batch-gateway",
@@ -481,7 +489,8 @@
481489
"cve_fix_workflow": {
482490
"primary_target": "main",
483491
"backport_targets": "rhoai-3.4, rhoai-3.4-ea.1, rhoai-3.4-ea.2"
484-
}
492+
},
493+
"subcomponent": "batch-gateway"
485494
},
486495
"llm-d/llm-d-workload-variant-autoscaler": {
487496
"github_url": "https://github.com/llm-d/llm-d-workload-variant-autoscaler",
@@ -494,7 +503,8 @@
494503
"cve_fix_workflow": {
495504
"primary_target": "main",
496505
"backport_targets": "release-0.4.2"
497-
}
506+
},
507+
"subcomponent": "autoscaler"
498508
},
499509
"opendatahub-io/workload-variant-autoscaler": {
500510
"github_url": "https://github.com/opendatahub-io/workload-variant-autoscaler",
@@ -507,7 +517,8 @@
507517
"cve_fix_workflow": {
508518
"primary_target": "main",
509519
"backport_targets": "release-v0.5"
510-
}
520+
},
521+
"subcomponent": "autoscaler"
511522
},
512523
"red-hat-data-services/workload-variant-autoscaler": {
513524
"github_url": "https://github.com/red-hat-data-services/workload-variant-autoscaler",
@@ -522,14 +533,18 @@
522533
"cve_fix_workflow": {
523534
"primary_target": "main",
524535
"backport_targets": "rhoai-3.4, rhoai-3.4-ea.1, rhoai-3.4-ea.2"
525-
}
536+
},
537+
"subcomponent": "autoscaler"
526538
}
527539
}
528540
},
529541
"AI Evaluations": {
530542
"container_to_repo_mapping": {
531543
"rhoai/odh-ta-lmes-driver-rhel9": "opendatahub-io/trustyai-service-operator",
532-
"rhoai/odh-ta-lmes-job-rhel9": "opendatahub-io/lm-evaluation-harness"
544+
"rhoai/odh-ta-lmes-job-rhel9": "opendatahub-io/lm-evaluation-harness",
545+
"rhoai/odh-trustyai-ragas-lls-provider-dsp-rhel9": "opendatahub-io/llama-stack-provider-ragas",
546+
"rhoai/odh-eval-hub-rhel9": "opendatahub-io/eval-hub",
547+
"rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9": "opendatahub-io/llama-stack-provider-trustyai-garak"
533548
},
534549
"repositories": {
535550
"eval-hub/eval-hub": {
@@ -541,7 +556,8 @@
541556
"cve_fix_workflow": {
542557
"primary_target": "main",
543558
"backport_targets": "None"
544-
}
559+
},
560+
"subcomponent": "eval-hub"
545561
},
546562
"eval-hub/eval-hub-sdk": {
547563
"github_url": "https://github.com/eval-hub/eval-hub-sdk",
@@ -553,7 +569,8 @@
553569
"cve_fix_workflow": {
554570
"primary_target": "main",
555571
"backport_targets": "None"
556-
}
572+
},
573+
"subcomponent": "eval-hub-sdk"
557574
},
558575
"eval-hub/eval-hub-contrib": {
559576
"github_url": "https://github.com/eval-hub/eval-hub-contrib",
@@ -565,7 +582,8 @@
565582
"cve_fix_workflow": {
566583
"primary_target": "main",
567584
"backport_targets": "None"
568-
}
585+
},
586+
"subcomponent": "eval-hub-contrib"
569587
},
570588
"trustyai-explainability/llama-stack-provider-trustyai-garak": {
571589
"github_url": "https://github.com/trustyai-explainability/llama-stack-provider-trustyai-garak",
@@ -576,7 +594,8 @@
576594
"cve_fix_workflow": {
577595
"primary_target": "main",
578596
"backport_targets": "None"
579-
}
597+
},
598+
"subcomponent": "trustyai-garak"
580599
},
581600
"trustyai-explainability/trustyai-service-operator": {
582601
"github_url": "https://github.com/trustyai-explainability/trustyai-service-operator",
@@ -590,7 +609,8 @@
590609
"cve_fix_workflow": {
591610
"primary_target": "main",
592611
"backport_targets": "release/1.37.0, release/1.38.0"
593-
}
612+
},
613+
"subcomponent": "lm-evaluation-harness"
594614
},
595615
"opendatahub-io/eval-hub": {
596616
"github_url": "https://github.com/opendatahub-io/eval-hub",
@@ -604,7 +624,8 @@
604624
"cve_fix_workflow": {
605625
"primary_target": "main",
606626
"backport_targets": "release/odh-3.4, stable"
607-
}
627+
},
628+
"subcomponent": "eval-hub"
608629
},
609630
"opendatahub-io/lm-evaluation-harness": {
610631
"github_url": "https://github.com/opendatahub-io/lm-evaluation-harness",
@@ -620,7 +641,8 @@
620641
"cve_fix_workflow": {
621642
"primary_target": "main",
622643
"backport_targets": "release/odh-3.3, release/odh-3.4, release/odh-3.4-ea2, release/odh-3.5"
623-
}
644+
},
645+
"subcomponent": "lm-evaluation-harness"
624646
},
625647
"opendatahub-io/llama-stack-provider-trustyai-garak": {
626648
"github_url": "https://github.com/opendatahub-io/llama-stack-provider-trustyai-garak",
@@ -634,7 +656,8 @@
634656
"cve_fix_workflow": {
635657
"primary_target": "main",
636658
"backport_targets": "release/odh-3.4, stable"
637-
}
659+
},
660+
"subcomponent": "trustyai-garak"
638661
},
639662
"opendatahub-io/trustyai-service-operator": {
640663
"github_url": "https://github.com/opendatahub-io/trustyai-service-operator",
@@ -649,7 +672,8 @@
649672
"cve_fix_workflow": {
650673
"primary_target": "main",
651674
"backport_targets": "release/odh-3.3, release/odh-3.4, release/odh-3.4-ea2"
652-
}
675+
},
676+
"subcomponent": "lm-evaluation-harness"
653677
},
654678
"red-hat-data-services/eval-hub": {
655679
"github_url": "https://github.com/red-hat-data-services/eval-hub",
@@ -664,7 +688,8 @@
664688
"cve_fix_workflow": {
665689
"primary_target": "main",
666690
"backport_targets": "rhoai-3.4, rhoai-3.4-ea.1, rhoai-3.4-ea.2"
667-
}
691+
},
692+
"subcomponent": "eval-hub"
668693
},
669694
"red-hat-data-services/lm-evaluation-harness": {
670695
"github_url": "https://github.com/red-hat-data-services/lm-evaluation-harness",
@@ -680,7 +705,8 @@
680705
"cve_fix_workflow": {
681706
"primary_target": "main",
682707
"backport_targets": "rhoai-3.3, rhoai-3.4, rhoai-3.4-ea.1, rhoai-3.4-ea.2"
683-
}
708+
},
709+
"subcomponent": "lm-evaluation-harness"
684710
},
685711
"red-hat-data-services/llama-stack-provider-trustyai-garak": {
686712
"github_url": "https://github.com/red-hat-data-services/llama-stack-provider-trustyai-garak",
@@ -696,7 +722,8 @@
696722
"cve_fix_workflow": {
697723
"primary_target": "main",
698724
"backport_targets": "rhoai-3.3, rhoai-3.4, rhoai-3.4-ea.1, rhoai-3.4-ea.2"
699-
}
725+
},
726+
"subcomponent": "trustyai-garak"
700727
},
701728
"red-hat-data-services/trustyai-service-operator": {
702729
"github_url": "https://github.com/red-hat-data-services/trustyai-service-operator",
@@ -709,6 +736,55 @@
709736
],
710737
"branch_strategy": "Fork of midstream. RHOAI release branches follow pattern rhoai-X.Y.",
711738
"repo_type": "downstream",
739+
"cve_fix_workflow": {
740+
"primary_target": "main",
741+
"backport_targets": "rhoai-3.3, rhoai-3.4, rhoai-3.4-ea.1, rhoai-3.4-ea.2"
742+
},
743+
"subcomponent": "lm-evaluation-harness"
744+
},
745+
"trustyai-explainability/llama-stack-provider-ragas": {
746+
"github_url": "https://github.com/trustyai-explainability/llama-stack-provider-ragas",
747+
"default_branch": "main",
748+
"active_release_branches": [
749+
"release/0.4.x",
750+
"release/0.5.x"
751+
],
752+
"branch_strategy": "Fix in main. Release branches follow pattern release/X.Y.x.",
753+
"repo_type": "upstream",
754+
"subcomponent": "trustyai-ragas",
755+
"cve_fix_workflow": {
756+
"primary_target": "main",
757+
"backport_targets": "release/0.4.x, release/0.5.x"
758+
}
759+
},
760+
"opendatahub-io/llama-stack-provider-ragas": {
761+
"github_url": "https://github.com/opendatahub-io/llama-stack-provider-ragas",
762+
"default_branch": "main",
763+
"active_release_branches": [
764+
"release/odh-3.3",
765+
"release/odh-3.4-ea2",
766+
"stable"
767+
],
768+
"branch_strategy": "Fork of upstream trustyai-explainability/llama-stack-provider-ragas. Release branches follow pattern release/odh-X.Y.",
769+
"repo_type": "midstream",
770+
"subcomponent": "trustyai-ragas",
771+
"cve_fix_workflow": {
772+
"primary_target": "main",
773+
"backport_targets": "release/odh-3.3, release/odh-3.4-ea2, stable"
774+
}
775+
},
776+
"red-hat-data-services/llama-stack-provider-ragas": {
777+
"github_url": "https://github.com/red-hat-data-services/llama-stack-provider-ragas",
778+
"default_branch": "main",
779+
"active_release_branches": [
780+
"rhoai-3.3",
781+
"rhoai-3.4",
782+
"rhoai-3.4-ea.1",
783+
"rhoai-3.4-ea.2"
784+
],
785+
"branch_strategy": "Fork of midstream. RHOAI release branches follow pattern rhoai-X.Y.",
786+
"repo_type": "downstream",
787+
"subcomponent": "trustyai-ragas",
712788
"cve_fix_workflow": {
713789
"primary_target": "main",
714790
"backport_targets": "rhoai-3.3, rhoai-3.4, rhoai-3.4-ea.1, rhoai-3.4-ea.2"

0 commit comments

Comments
 (0)