Cleanup/serviceradar core removal #2647
No reviewers
Labels
No labels
1week
2weeks
Failed compliance check
IP cameras
NATS
Possible security concern
Review effort 1/5
Review effort 2/5
Review effort 3/5
Review effort 4/5
Review effort 5/5
UI
aardvark
accessibility
amd64
api
arm64
auth
back-end
bgp
blog
bug
build
checkers
ci-cd
cleanup
cnpg
codex
core
dependencies
device-management
documentation
duplicate
dusk
ebpf
enhancement
eta 1d
eta 1hr
eta 3d
eta 3hr
feature
fieldsurvey
github_actions
go
good first issue
help wanted
invalid
javascript
k8s
log-collector
mapper
mtr
needs-triage
netflow
network-sweep
observability
oracle
otel
plug-in
proton
python
question
reddit
redhat
research
rperf
rperf-checker
rust
sdk
security
serviceradar-agent
serviceradar-agent-gateway
serviceradar-web
serviceradar-web-ng
siem
snmp
sysmon
topology
ubiquiti
wasm
wontfix
zen-engine
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
carverauto/serviceradar!2647
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "refs/pull/2647/head"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Imported from GitHub pull request.
Original GitHub pull request: #2244
Original author: @mfreeman451
Original URL: https://github.com/carverauto/serviceradar/pull/2244
Original created: 2026-01-11T16:50:35Z
Original updated: 2026-01-11T16:53:39Z
Original head: carverauto/serviceradar:cleanup/serviceradar-core_removal
Original base: testing
Original merged: 2026-01-11T16:53:38Z by @mfreeman451
User description
IMPORTANT: Please sign the Developer Certificate of Origin
Thank you for your contribution to ServiceRadar. Please note, when contributing, the developer must include
a DCO sign-off statement indicating the DCO acceptance in one commit message. Here
is an example DCO Signed-off-by line in a commit message:
Describe your changes
Issue ticket number and link
Code checklist before requesting a review
PR Type
Enhancement, Documentation
Description
Remove deprecated Go-based core service, replace with Elixir core-elx
Update all service references from serviceradar-core to serviceradar-core-elx
Remove webhook configuration dependency from CoreServiceConfig struct
Add comprehensive design documentation for golang core removal
Diagram Walkthrough
File Walkthrough
1 files
Remove webhook config and core alerts import5 files
Replace golang core with Elixir core-elx serviceMigrate core service to Elixir with updated environment configUpdate service references to core-elx hostnameUpdate build references from core to core-elx imageUpdate SBOM workflow to reference core-elx image8 files
Update installation docs to reference core-elx serviceDocument Elixir core-elx as primary container imageUpdate example references from core to agent componentsRemove golang core references from SPIRE documentationAdd proposal for removing deprecated golang core serviceAdd detailed design and dependency analysis for core removalAdd comprehensive task checklist for core service removalAdd architecture requirements for Elixir-only core service101 files
Imported GitHub PR comment.
Original author: @qodo-code-review[bot]
Original URL: https://github.com/carverauto/serviceradar/pull/2244#issuecomment-3735021132
Original created: 2026-01-11T16:51:11Z
PR Compliance Guide 🔍
Below is a summary of compliance checks for this PR:
Hardcoded default credentials
Description: The new
core-elxservice configuration hardcodes and/or provides insecure default secrets(e.g.,
CNPG_PASSWORD=serviceradarhere and similarlyCNPG_PASSWORD=${CNPG_PASSWORD:-serviceradar}plusRELEASE_COOKIE=${RELEASE_COOKIE:-serviceradar_cookie}indocker-compose.spiffe.yml), whichcan lead to credential exposure and accidental deployment with known credentials.
docker-compose.dev.yml [23-35]
Referred Code
🎫 No ticket provided
Codebase context is not defined
Follow the guide to enable codebase context checks.
Generic: Comprehensive Audit Trails
Objective: To create a detailed and reliable record of critical system actions for security analysis
and compliance.
Status: Passed
Generic: Meaningful Naming and Self-Documenting Code
Objective: Ensure all identifiers clearly express their purpose and intent, making code
self-documenting
Status: Passed
Generic: Robust Error Handling and Edge Case Management
Objective: Ensure comprehensive error handling that provides meaningful context and graceful
degradation
Status: Passed
Generic: Secure Error Handling
Objective: To prevent the leakage of sensitive system information through error messages while
providing sufficient detail for internal debugging.
Status: Passed
Generic: Secure Logging Practices
Objective: To ensure logs are useful for debugging and auditing without exposing sensitive
information like PII, PHI, or cardholder data.
Status: Passed
Generic: Security-First Input Validation and Data Handling
Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent
vulnerabilities
Status:
Hardcoded DB password: The PR introduces hardcoded database credentials via
CNPG_PASSWORD=serviceradar, which isinsecure handling of sensitive configuration data.
Referred Code
Compliance status legend
🟢 - Fully Compliant🟡 - Partial Compliant
🔴 - Not Compliant
⚪ - Requires Further Human Verification
🏷️ - Compliance label
Imported GitHub PR comment.
Original author: @qodo-code-review[bot]
Original URL: https://github.com/carverauto/serviceradar/pull/2244#issuecomment-3735021937
Original created: 2026-01-11T16:51:32Z
CI Feedback 🧐
A test triggered by this PR failed. Here is an AI-generated analysis of the failure:
Action: build
Failed stage: Configure SRQL fixture database for tests [❌]
Failure summary:
The action failed because a required secret/environment variable for the test setup was missing:
-
The workflow expects
SRQL_TEST_DATABASE_CA_CERTto be configured so it can verify TLS for the SRQLtest/fixture database.
- The log shows
SRQL_TEST_DATABASE_CA_CERT:is empty, followed by:SRQL_TEST_DATABASE_CA_CERT secret must be configured to verify SRQL fixture TLS.- This caused the
step to exit with code
1(Process completed with exit code 1), stopping the job before any testscould run.
Relevant error logs:
Imported GitHub PR comment.
Original author: @qodo-code-review[bot]
Original URL: https://github.com/carverauto/serviceradar/pull/2244#issuecomment-3735024111
Original created: 2026-01-11T16:52:23Z
PR Code Suggestions ✨
Explore these optional code suggestions:
The PR is incomplete
The PR is incomplete as it does not remove the deprecated Go source code from
cmd/core/andpkg/core/. To fulfill its purpose, the PR should also delete thiscode and its related build artifacts.
Examples:
openspec/changes/archive/2026-01-11-remove-golang-core/tasks.md [16-20]
Solution Walkthrough:
Before:
After:
Suggestion importance[1-10]: 10
__
Why: The suggestion correctly identifies a critical flaw where the PR fails to execute its primary goal of removing the deprecated Go source code, leaving the repository in an inconsistent state.
Add a healthcheck to service
Add a
healthcheckto thecore-elxservice indocker-compose.dev.ymlto ensure itis running correctly, similar to the configuration of the service it replaces.
docker-compose.dev.yml [16-45]
Suggestion importance[1-10]: 6
__
Why: The PR removes the old
coreservice which had a healthcheck, but does not add one to the newcore-elxservice; this suggestion correctly identifies and restores this useful feature for the development environment.Rename variable for improved clarity
In
docker/images/BUILD.bazel, rename thecore_digestvariable tocore_elx_digestfor consistency with the updated error message and service name.
docker/images/BUILD.bazel [467-471]
Suggestion importance[1-10]: 3
__
Why: This is a valid suggestion that improves code clarity and maintainability by renaming the
core_digestvariable tocore_elx_digestto match the updated context, but it has no functional impact.