carverauto/serviceradar
1
1
Fork 0
Code Issues 190 Pull requests 16 Projects Releases 173 Packages Wiki Activity Actions

adding missing deps #2425

Merged
mfreeman451 merged 1 commit from refs/pull/2425/head into main 2025-11-19 06:13:18 +00:00
Conversation 2 Commits 1 Files changed 1 +47
mfreeman451 commented 2025-11-19 06:10:41 +00:00 (Migrated from github.com)
Owner
Copy link

Imported from GitHub pull request.

Original GitHub pull request: #1957
Original author: @mfreeman451
Original URL: https://github.com/carverauto/serviceradar/pull/1957
Original created: 2025-11-19T06:10:41Z
Original updated: 2025-11-19T06:13:31Z
Original head: carverauto/serviceradar:chore/oci_image_failing
Original base: main
Original merged: 2025-11-19T06:13:18Z by @mfreeman451

User description

IMPORTANT: Please sign the Developer Certificate of Origin

Thank you for your contribution to ServiceRadar. Please note, when contributing, the developer must include
a DCO sign-off statement indicating the DCO acceptance in one commit message. Here
is an example DCO Signed-off-by line in a commit message:

Signed-off-by: J. Doe <j.doe@domain.com>

Describe your changes

Issue ticket number and link

Code checklist before requesting a review

  • I have signed the DCO?
  • The build completes without errors?
  • All tests are passing when running make test?

PR Type

Enhancement

Description

  • Add build dependencies installation step for Docker builds

  • Support multiple Linux package managers (apt-get, dnf, yum, microdnf)

  • Install required build tools: gcc, make, OpenSSL, protobuf, cmake, flex, bison

  • Add Bazel setup step using bazelbuild/setup-bazelisk action

Diagram Walkthrough

flowchart LR
  checkout["Checkout code"]
  install["Install build dependencies<br/>gcc, make, OpenSSL, protobuf, cmake"]
  bazel["Setup Bazel"]
  cache["Configure BuildBuddy cache"]
  checkout --> install
  install --> bazel
  bazel --> cache

File Walkthrough
Relevant files
Configuration changes
docker-build.yml
Add build dependencies and Bazel setup steps                         

.github/workflows/docker-build.yml

  • Added new step to install build dependencies with multi-distro support
  • Installs essential build tools: gcc, g++, make, OpenSSL headers,
    protobuf-compiler, cmake, flex, bison
  • Includes pkg-config installation with fallback logic for different
    package managers
  • Added Bazel setup step using bazelbuild/setup-bazelisk@v3 action
  • Validates protoc installation after dependency setup
 +47/-0   
Imported from GitHub pull request. Original GitHub pull request: #1957 Original author: @mfreeman451 Original URL: https://github.com/carverauto/serviceradar/pull/1957 Original created: 2025-11-19T06:10:41Z Original updated: 2025-11-19T06:13:31Z Original head: carverauto/serviceradar:chore/oci_image_failing Original base: main Original merged: 2025-11-19T06:13:18Z by @mfreeman451 --- ### **User description** ## IMPORTANT: Please sign the Developer Certificate of Origin Thank you for your contribution to ServiceRadar. Please note, when contributing, the developer must include a [DCO sign-off statement]( https://developercertificate.org/) indicating the DCO acceptance in one commit message. Here is an example DCO Signed-off-by line in a commit message: ``` Signed-off-by: J. Doe <j.doe@domain.com> ``` ## Describe your changes ## Issue ticket number and link ## Code checklist before requesting a review - [ ] I have signed the DCO? - [ ] The build completes without errors? - [ ] All tests are passing when running make test? ___ ### **PR Type** Enhancement ___ ### **Description** - Add build dependencies installation step for Docker builds - Support multiple Linux package managers (apt-get, dnf, yum, microdnf) - Install required build tools: gcc, make, OpenSSL, protobuf, cmake, flex, bison - Add Bazel setup step using bazelbuild/setup-bazelisk action ___ ### Diagram Walkthrough ```mermaid flowchart LR checkout["Checkout code"] install["Install build dependencies<br/>gcc, make, OpenSSL, protobuf, cmake"] bazel["Setup Bazel"] cache["Configure BuildBuddy cache"] checkout --> install install --> bazel bazel --> cache ``` <details> <summary><h3> File Walkthrough</h3></summary> <table><thead><tr><th></th><th align="left">Relevant files</th></tr></thead><tbody><tr><td><strong>Configuration changes</strong></td><td><table> <tr> <td> <details> <summary><strong>docker-build.yml</strong><dd><code>Add build dependencies and Bazel setup steps</code>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </dd></summary> <hr> .github/workflows/docker-build.yml <ul><li>Added new step to install build dependencies with multi-distro support<br> <li> Installs essential build tools: gcc, g++, make, OpenSSL headers, <br>protobuf-compiler, cmake, flex, bison<br> <li> Includes pkg-config installation with fallback logic for different <br>package managers<br> <li> Added Bazel setup step using bazelbuild/setup-bazelisk@v3 action<br> <li> Validates protoc installation after dependency setup</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1957/files#diff-3414847e2ad632333f775cabb810f0dc0df61a570365df34750a08b00912fe82">+47/-0</a>&nbsp; &nbsp; </td> </tr> </table></td></tr></tr></tbody></table> </details> ___
qodo-code-review[bot] commented 2025-11-19 06:11:04 +00:00 (Migrated from github.com)
Author
Owner
Copy link

Imported GitHub PR comment.

Original author: @qodo-code-review[bot]
Original URL: https://github.com/carverauto/serviceradar/pull/1957#issuecomment-3550965261
Original created: 2025-11-19T06:11:04Z

PR Compliance Guide 🔍

(Compliance updated until commit github.com/carverauto/serviceradar@e117da25a7)

Below is a summary of compliance checks for this PR:

Security Compliance
🟢
No security concerns identified No security vulnerabilities detected by AI analysis. Human verification advised for critical code.
Ticket Compliance
⚪
🎫 No ticket provided
  • Create ticket/issue
Codebase Duplication Compliance
⚪
Codebase context is not defined

Follow the guide to enable codebase context checks.

Custom Compliance
🟢
Generic: Meaningful Naming and Self-Documenting Code

Objective: Ensure all identifiers clearly express their purpose and intent, making code
self-documenting

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Robust Error Handling and Edge Case Management

Objective: Ensure comprehensive error handling that provides meaningful context and graceful
degradation

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Secure Error Handling

Objective: To prevent the leakage of sensitive system information through error messages while
providing sufficient detail for internal debugging.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Secure Logging Practices

Objective: To ensure logs are useful for debugging and auditing without exposing sensitive
information like PII, PHI, or cardholder data.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Security-First Input Validation and Data Handling

Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent
vulnerabilities

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

⚪
Generic: Comprehensive Audit Trails

Objective: To create a detailed and reliable record of critical system actions for security analysis
and compliance.

Status:
No audit logs: The added workflow steps perform package installations and tool setup without introducing
any logging of critical security-relevant actions, which may be acceptable for CI but
cannot be confirmed from the diff alone.

Referred Code 
- name: Install build dependencies
  run: |
    ensure_pkg_config() {
      if command -v pkg-config >/dev/null 2>&1; then
        return
      fi

      if command -v apt-get >/dev/null 2>&1; then
        sudo apt-get install -y pkg-config
      elif command -v dnf >/dev/null 2>&1; then
        if ! sudo dnf install -y pkgconfig; then
          sudo dnf install -y pkgconf-pkg-config
        fi
      elif command -v yum >/dev/null 2>&1; then
        if ! sudo yum install -y pkgconfig; then
          sudo yum install -y pkgconf-pkg-config
        fi
      elif command -v microdnf >/dev/null 2>&1; then
        if ! sudo microdnf install -y pkgconfig; then
          sudo microdnf install -y pkgconf-pkg-config
        fi


 ... (clipped 30 lines)

Learn more about managing compliance generic rules or creating your own custom rules

Compliance status legend 🟢 - Fully Compliant
🟡 - Partial Compliant
🔴 - Not Compliant
⚪ - Requires Further Human Verification
🏷️ - Compliance label

Previous compliance checks

Compliance check up to commit e117da2
Security Compliance
⚪
Unpinned dependencies

Description: Installing packages via system package managers in CI without pinning versions or
verifying package integrity can expose the build to supply‑chain risks (e.g., malicious or
compromised repo mirrors), especially when using broad meta-packages like
'build-essential' and unpinned tools like 'protobuf-compiler' across multiple distros.
docker-build.yml [62-74]

Referred Code 
if command -v apt-get >/dev/null 2>&1; then
  sudo apt-get update
  sudo apt-get install -y build-essential pkg-config libssl-dev protobuf-compiler cmake flex bison
elif command -v dnf >/dev/null 2>&1; then
  sudo dnf install -y gcc gcc-c++ make openssl-devel protobuf-compiler cmake flex bison
elif command -v yum >/dev/null 2>&1; then
  sudo yum install -y gcc gcc-c++ make openssl-devel protobuf-compiler cmake flex bison
elif command -v microdnf >/dev/null 2>&1; then
  sudo microdnf install -y gcc gcc-c++ make openssl-devel protobuf-compiler cmake flex bison
else
  echo "Unsupported package manager; please install gcc, g++ (or clang), make, OpenSSL headers, pkg-config, cmake, flex, bison, and protoc manually." >&2
  exit 1
fi
Elevated privileges in CI

Description: Multiple commands using 'sudo' to install packages in the GitHub Actions runner increase
blast radius if any preceding step is compromised; least-privilege execution or
isolated/containerized install phases would reduce risk.
docker-build.yml [35-78]

Referred Code 
- name: Install build dependencies
  run: |
    ensure_pkg_config() {
      if command -v pkg-config >/dev/null 2>&1; then
        return
      fi

      if command -v apt-get >/dev/null 2>&1; then
        sudo apt-get install -y pkg-config
      elif command -v dnf >/dev/null 2>&1; then
        if ! sudo dnf install -y pkgconfig; then
          sudo dnf install -y pkgconf-pkg-config
        fi
      elif command -v yum >/dev/null 2>&1; then
        if ! sudo yum install -y pkgconfig; then
          sudo yum install -y pkgconf-pkg-config
        fi
      elif command -v microdnf >/dev/null 2>&1; then
        if ! sudo microdnf install -y pkgconfig; then
          sudo microdnf install -y pkgconf-pkg-config
        fi


 ... (clipped 23 lines)
Untrusted binary execution

Description: Blindly executing 'protoc' from the PATH without constraining its source (e.g.,
checked-in, pinned version, or verified download) risks invoking an unexpected binary if
PATH is manipulated, leading to build or supply-chain compromise.
docker-build.yml [77-77]

Referred Code 
protoc --version || (echo "protoc installation failed" && exit 1)
Ticket Compliance
⚪
🎫 No ticket provided
  • Create ticket/issue
Codebase Duplication Compliance
⚪
Codebase context is not defined

Follow the guide to enable codebase context checks.

Custom Compliance
🟢
Generic: Meaningful Naming and Self-Documenting Code

Objective: Ensure all identifiers clearly express their purpose and intent, making code
self-documenting

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Robust Error Handling and Edge Case Management

Objective: Ensure comprehensive error handling that provides meaningful context and graceful
degradation

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Secure Error Handling

Objective: To prevent the leakage of sensitive system information through error messages while
providing sufficient detail for internal debugging.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Secure Logging Practices

Objective: To ensure logs are useful for debugging and auditing without exposing sensitive
information like PII, PHI, or cardholder data.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

⚪
Generic: Comprehensive Audit Trails

Objective: To create a detailed and reliable record of critical system actions for security analysis
and compliance.

Status:
No audit logs: The workflow adds steps to install dependencies and setup Bazel but does not introduce or
modify any application logic related to auditing critical actions, so audit trail
compliance cannot be assessed from this diff.

Referred Code 
- name: Install build dependencies
  run: |
    ensure_pkg_config() {
      if command -v pkg-config >/dev/null 2>&1; then
        return
      fi

      if command -v apt-get >/dev/null 2>&1; then
        sudo apt-get install -y pkg-config
      elif command -v dnf >/dev/null 2>&1; then
        if ! sudo dnf install -y pkgconfig; then
          sudo dnf install -y pkgconf-pkg-config
        fi
      elif command -v yum >/dev/null 2>&1; then
        if ! sudo yum install -y pkgconfig; then
          sudo yum install -y pkgconf-pkg-config
        fi
      elif command -v microdnf >/dev/null 2>&1; then
        if ! sudo microdnf install -y pkgconfig; then
          sudo microdnf install -y pkgconf-pkg-config
        fi


 ... (clipped 30 lines)

Learn more about managing compliance generic rules or creating your own custom rules

Generic: Security-First Input Validation and Data Handling

Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent
vulnerabilities

Status:
Secrets exposure risk: The workflow uses multiple package managers with elevated privileges and accesses secrets
via environment variables, but the new steps do not log sensitive values; still,
verification is needed to ensure commands and outputs never echo secrets in downstream
steps not visible in this diff.

Referred Code 
env:
  BUILDBUDDY_ORG_API_KEY: ${{ secrets.BUILDBUDDY_ORG_API_KEY }}
  GHCR_DOCKER_AUTH: ${{ secrets.GHCR_DOCKER_AUTH }}
  GHCR_USERNAME: ${{ secrets.GHCR_USERNAME }}
  GHCR_TOKEN: ${{ secrets.GHCR_TOKEN }}
  GHCR_REGISTRY: ghcr.io
steps:
  - name: Checkout
    uses: actions/checkout@v5
    with:
      fetch-depth: 0

Learn more about managing compliance generic rules or creating your own custom rules

Imported GitHub PR comment. Original author: @qodo-code-review[bot] Original URL: https://github.com/carverauto/serviceradar/pull/1957#issuecomment-3550965261 Original created: 2025-11-19T06:11:04Z --- ## PR Compliance Guide 🔍 <!-- https://github.com/carverauto/serviceradar/commit/e117da25a73e5eed07f93f6dc3f13ef074afc454 --> #### (Compliance updated until commit https://github.com/carverauto/serviceradar/commit/e117da25a73e5eed07f93f6dc3f13ef074afc454) Below is a summary of compliance checks for this PR:<br> <table><tbody><tr><td colspan='2'><strong>Security Compliance</strong></td></tr> <tr><td>🟢</td><td><details><summary><strong>No security concerns identified</strong></summary> No security vulnerabilities detected by AI analysis. Human verification advised for critical code. </details></td></tr> <tr><td colspan='2'><strong>Ticket Compliance</strong></td></tr> <tr><td>⚪</td><td><details><summary>🎫 <strong>No ticket provided </strong></summary> - [ ] Create ticket/issue <!-- /create_ticket --create_ticket=true --> </details></td></tr> <tr><td colspan='2'><strong>Codebase Duplication Compliance</strong></td></tr> <tr><td>⚪</td><td><details><summary><strong>Codebase context is not defined </strong></summary> Follow the <a href='https://qodo-merge-docs.qodo.ai/core-abilities/rag_context_enrichment/'>guide</a> to enable codebase context checks. </details></td></tr> <tr><td colspan='2'><strong>Custom Compliance</strong></td></tr> <tr><td rowspan=5>🟢</td><td> <details><summary><strong>Generic: Meaningful Naming and Self-Documenting Code</strong></summary><br> **Objective:** Ensure all identifiers clearly express their purpose and intent, making code <br>self-documenting<br> **Status:** Passed<br> > Learn more about managing compliance <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#configuration-options'>generic rules</a> or creating your own <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#custom-compliance'>custom rules</a> </details></td></tr> <tr><td> <details><summary><strong>Generic: Robust Error Handling and Edge Case Management</strong></summary><br> **Objective:** Ensure comprehensive error handling that provides meaningful context and graceful <br>degradation<br> **Status:** Passed<br> > Learn more about managing compliance <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#configuration-options'>generic rules</a> or creating your own <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#custom-compliance'>custom rules</a> </details></td></tr> <tr><td> <details><summary><strong>Generic: Secure Error Handling</strong></summary><br> **Objective:** To prevent the leakage of sensitive system information through error messages while <br>providing sufficient detail for internal debugging.<br> **Status:** Passed<br> > Learn more about managing compliance <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#configuration-options'>generic rules</a> or creating your own <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#custom-compliance'>custom rules</a> </details></td></tr> <tr><td> <details><summary><strong>Generic: Secure Logging Practices</strong></summary><br> **Objective:** To ensure logs are useful for debugging and auditing without exposing sensitive <br>information like PII, PHI, or cardholder data.<br> **Status:** Passed<br> > Learn more about managing compliance <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#configuration-options'>generic rules</a> or creating your own <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#custom-compliance'>custom rules</a> </details></td></tr> <tr><td> <details><summary><strong>Generic: Security-First Input Validation and Data Handling</strong></summary><br> **Objective:** Ensure all data inputs are validated, sanitized, and handled securely to prevent <br>vulnerabilities<br> **Status:** Passed<br> > Learn more about managing compliance <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#configuration-options'>generic rules</a> or creating your own <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#custom-compliance'>custom rules</a> </details></td></tr> <tr><td rowspan=1>⚪</td> <td><details> <summary><strong>Generic: Comprehensive Audit Trails</strong></summary><br> **Objective:** To create a detailed and reliable record of critical system actions for security analysis <br>and compliance.<br> **Status:** <br><a href='https://github.com/carverauto/serviceradar/pull/1957/files#diff-3414847e2ad632333f775cabb810f0dc0df61a570365df34750a08b00912fe82R35-R85'><strong>No audit logs</strong></a>: The added workflow steps perform package installations and tool setup without introducing <br>any logging of critical security-relevant actions, which may be acceptable for CI but <br>cannot be confirmed from the diff alone.<br> <details open><summary>Referred Code</summary> ```yaml - name: Install build dependencies run: | ensure_pkg_config() { if command -v pkg-config >/dev/null 2>&1; then return fi if command -v apt-get >/dev/null 2>&1; then sudo apt-get install -y pkg-config elif command -v dnf >/dev/null 2>&1; then if ! sudo dnf install -y pkgconfig; then sudo dnf install -y pkgconf-pkg-config fi elif command -v yum >/dev/null 2>&1; then if ! sudo yum install -y pkgconfig; then sudo yum install -y pkgconf-pkg-config fi elif command -v microdnf >/dev/null 2>&1; then if ! sudo microdnf install -y pkgconfig; then sudo microdnf install -y pkgconf-pkg-config fi ... (clipped 30 lines) ``` </details> > Learn more about managing compliance <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#configuration-options'>generic rules</a> or creating your own <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#custom-compliance'>custom rules</a> </details></td></tr> <tr><td align="center" colspan="2"> <!-- placeholder --> <!-- /compliance --update_compliance=true --> </td></tr></tbody></table> <details><summary>Compliance status legend</summary> 🟢 - Fully Compliant<br> 🟡 - Partial Compliant<br> 🔴 - Not Compliant<br> ⚪ - Requires Further Human Verification<br> 🏷️ - Compliance label<br> </details> ___ #### Previous compliance checks <details> <summary>Compliance check up to commit <a href='https://github.com/carverauto/serviceradar/commit/e117da25a73e5eed07f93f6dc3f13ef074afc454'>e117da2</a></summary><br> <table><tbody><tr><td colspan='2'><strong>Security Compliance</strong></td></tr> <tr><td rowspan=3>⚪</td> <td><details><summary><strong>Unpinned dependencies </strong></summary><br> <b>Description:</b> Installing packages via system package managers in CI without pinning versions or <br>verifying package integrity can expose the build to supply‑chain risks (e.g., malicious or <br>compromised repo mirrors), especially when using broad meta-packages like <br>'build-essential' and unpinned tools like 'protobuf-compiler' across multiple distros.<br> <strong><a href='https://github.com/carverauto/serviceradar/pull/1957/files#diff-3414847e2ad632333f775cabb810f0dc0df61a570365df34750a08b00912fe82R62-R74'>docker-build.yml [62-74]</a></strong><br> <details open><summary>Referred Code</summary> ```yaml if command -v apt-get >/dev/null 2>&1; then sudo apt-get update sudo apt-get install -y build-essential pkg-config libssl-dev protobuf-compiler cmake flex bison elif command -v dnf >/dev/null 2>&1; then sudo dnf install -y gcc gcc-c++ make openssl-devel protobuf-compiler cmake flex bison elif command -v yum >/dev/null 2>&1; then sudo yum install -y gcc gcc-c++ make openssl-devel protobuf-compiler cmake flex bison elif command -v microdnf >/dev/null 2>&1; then sudo microdnf install -y gcc gcc-c++ make openssl-devel protobuf-compiler cmake flex bison else echo "Unsupported package manager; please install gcc, g++ (or clang), make, OpenSSL headers, pkg-config, cmake, flex, bison, and protoc manually." >&2 exit 1 fi ``` </details></details></td></tr> <tr><td><details><summary><strong>Elevated privileges in CI </strong></summary><br> <b>Description:</b> Multiple commands using 'sudo' to install packages in the GitHub Actions runner increase <br>blast radius if any preceding step is compromised; least-privilege execution or <br>isolated/containerized install phases would reduce risk.<br> <strong><a href='https://github.com/carverauto/serviceradar/pull/1957/files#diff-3414847e2ad632333f775cabb810f0dc0df61a570365df34750a08b00912fe82R35-R78'>docker-build.yml [35-78]</a></strong><br> <details open><summary>Referred Code</summary> ```yaml - name: Install build dependencies run: | ensure_pkg_config() { if command -v pkg-config >/dev/null 2>&1; then return fi if command -v apt-get >/dev/null 2>&1; then sudo apt-get install -y pkg-config elif command -v dnf >/dev/null 2>&1; then if ! sudo dnf install -y pkgconfig; then sudo dnf install -y pkgconf-pkg-config fi elif command -v yum >/dev/null 2>&1; then if ! sudo yum install -y pkgconfig; then sudo yum install -y pkgconf-pkg-config fi elif command -v microdnf >/dev/null 2>&1; then if ! sudo microdnf install -y pkgconfig; then sudo microdnf install -y pkgconf-pkg-config fi ... (clipped 23 lines) ``` </details></details></td></tr> <tr><td><details><summary><strong>Untrusted binary execution </strong></summary><br> <b>Description:</b> Blindly executing 'protoc' from the PATH without constraining its source (e.g., <br>checked-in, pinned version, or verified download) risks invoking an unexpected binary if <br>PATH is manipulated, leading to build or supply-chain compromise.<br> <strong><a href='https://github.com/carverauto/serviceradar/pull/1957/files#diff-3414847e2ad632333f775cabb810f0dc0df61a570365df34750a08b00912fe82R77-R77'>docker-build.yml [77-77]</a></strong><br> <details open><summary>Referred Code</summary> ```yaml protoc --version || (echo "protoc installation failed" && exit 1) ``` </details></details></td></tr> <tr><td colspan='2'><strong>Ticket Compliance</strong></td></tr> <tr><td>⚪</td><td><details><summary>🎫 <strong>No ticket provided </strong></summary> - [ ] Create ticket/issue <!-- /create_ticket --create_ticket=true --> </details></td></tr> <tr><td colspan='2'><strong>Codebase Duplication Compliance</strong></td></tr> <tr><td>⚪</td><td><details><summary><strong>Codebase context is not defined </strong></summary> Follow the <a href='https://qodo-merge-docs.qodo.ai/core-abilities/rag_context_enrichment/'>guide</a> to enable codebase context checks. </details></td></tr> <tr><td colspan='2'><strong>Custom Compliance</strong></td></tr> <tr><td rowspan=4>🟢</td><td> <details><summary><strong>Generic: Meaningful Naming and Self-Documenting Code</strong></summary><br> **Objective:** Ensure all identifiers clearly express their purpose and intent, making code <br>self-documenting<br> **Status:** Passed<br> > Learn more about managing compliance <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#configuration-options'>generic rules</a> or creating your own <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#custom-compliance'>custom rules</a> </details></td></tr> <tr><td> <details><summary><strong>Generic: Robust Error Handling and Edge Case Management</strong></summary><br> **Objective:** Ensure comprehensive error handling that provides meaningful context and graceful <br>degradation<br> **Status:** Passed<br> > Learn more about managing compliance <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#configuration-options'>generic rules</a> or creating your own <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#custom-compliance'>custom rules</a> </details></td></tr> <tr><td> <details><summary><strong>Generic: Secure Error Handling</strong></summary><br> **Objective:** To prevent the leakage of sensitive system information through error messages while <br>providing sufficient detail for internal debugging.<br> **Status:** Passed<br> > Learn more about managing compliance <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#configuration-options'>generic rules</a> or creating your own <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#custom-compliance'>custom rules</a> </details></td></tr> <tr><td> <details><summary><strong>Generic: Secure Logging Practices</strong></summary><br> **Objective:** To ensure logs are useful for debugging and auditing without exposing sensitive <br>information like PII, PHI, or cardholder data.<br> **Status:** Passed<br> > Learn more about managing compliance <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#configuration-options'>generic rules</a> or creating your own <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#custom-compliance'>custom rules</a> </details></td></tr> <tr><td rowspan=2>⚪</td> <td><details> <summary><strong>Generic: Comprehensive Audit Trails</strong></summary><br> **Objective:** To create a detailed and reliable record of critical system actions for security analysis <br>and compliance.<br> **Status:** <br><a href='https://github.com/carverauto/serviceradar/pull/1957/files#diff-3414847e2ad632333f775cabb810f0dc0df61a570365df34750a08b00912fe82R35-R85'><strong>No audit logs</strong></a>: The workflow adds steps to install dependencies and setup Bazel but does not introduce or <br>modify any application logic related to auditing critical actions, so audit trail <br>compliance cannot be assessed from this diff.<br> <details open><summary>Referred Code</summary> ```yaml - name: Install build dependencies run: | ensure_pkg_config() { if command -v pkg-config >/dev/null 2>&1; then return fi if command -v apt-get >/dev/null 2>&1; then sudo apt-get install -y pkg-config elif command -v dnf >/dev/null 2>&1; then if ! sudo dnf install -y pkgconfig; then sudo dnf install -y pkgconf-pkg-config fi elif command -v yum >/dev/null 2>&1; then if ! sudo yum install -y pkgconfig; then sudo yum install -y pkgconf-pkg-config fi elif command -v microdnf >/dev/null 2>&1; then if ! sudo microdnf install -y pkgconfig; then sudo microdnf install -y pkgconf-pkg-config fi ... (clipped 30 lines) ``` </details> > Learn more about managing compliance <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#configuration-options'>generic rules</a> or creating your own <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#custom-compliance'>custom rules</a> </details></td></tr> <tr><td><details> <summary><strong>Generic: Security-First Input Validation and Data Handling</strong></summary><br> **Objective:** Ensure all data inputs are validated, sanitized, and handled securely to prevent <br>vulnerabilities<br> **Status:** <br><a href='https://github.com/carverauto/serviceradar/pull/1957/files#diff-3414847e2ad632333f775cabb810f0dc0df61a570365df34750a08b00912fe82R23-R34'><strong>Secrets exposure risk</strong></a>: The workflow uses multiple package managers with elevated privileges and accesses secrets <br>via environment variables, but the new steps do not log sensitive values; still, <br>verification is needed to ensure commands and outputs never echo secrets in downstream <br>steps not visible in this diff.<br> <details open><summary>Referred Code</summary> ```yaml env: BUILDBUDDY_ORG_API_KEY: ${{ secrets.BUILDBUDDY_ORG_API_KEY }} GHCR_DOCKER_AUTH: ${{ secrets.GHCR_DOCKER_AUTH }} GHCR_USERNAME: ${{ secrets.GHCR_USERNAME }} GHCR_TOKEN: ${{ secrets.GHCR_TOKEN }} GHCR_REGISTRY: ghcr.io steps: - name: Checkout uses: actions/checkout@v5 with: fetch-depth: 0 ``` </details> > Learn more about managing compliance <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#configuration-options'>generic rules</a> or creating your own <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#custom-compliance'>custom rules</a> </details></td></tr> <tr><td align="center" colspan="2"> <!-- placeholder --> <!-- /compliance --update_compliance=true --> </td></tr></tbody></table> </details>
qodo-code-review[bot] commented 2025-11-19 06:12:04 +00:00 (Migrated from github.com)
Author
Owner
Copy link

Imported GitHub PR comment.

Original author: @qodo-code-review[bot]
Original URL: https://github.com/carverauto/serviceradar/pull/1957#issuecomment-3550967606
Original created: 2025-11-19T06:12:04Z

PR Code Suggestions ✨

Explore these optional code suggestions:

CategorySuggestion                                                                                                                                    Impact
High-level
Use a custom Docker image for build environment

Instead of installing build dependencies with a shell script in the workflow,
create and use a custom Docker image with all required tools pre-installed. This
change will accelerate the build process, simplify the workflow file, and ensure
a consistent environment.

Examples:

.github/workflows/docker-build.yml [35-77] 
      - name: Install build dependencies
        run: |
          ensure_pkg_config() {
            if command -v pkg-config >/dev/null 2>&1; then
              return
            fi

            if command -v apt-get >/dev/null 2>&1; then
              sudo apt-get install -y pkg-config
            elif command -v dnf >/dev/null 2>&1; then

 ... (clipped 33 lines)

Solution Walkthrough:

Before:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Install build dependencies
        run: |
          if command -v apt-get >/dev/null 2>&1; then
            sudo apt-get install -y ...
          elif command -v dnf >/dev/null 2>&1; then
            sudo dnf install -y ...
          elif command -v yum >/dev/null 2>&1; then
            sudo yum install -y ...
          # ... etc
          fi
      - name: Setup Bazel
        uses: bazelbuild/setup-bazelisk@v3
      # ...

After:

# In Dockerfile:
FROM ubuntu:22.04
RUN apt-get update && apt-get install -y \
    build-essential pkg-config libssl-dev \
    protobuf-compiler cmake flex bison

# In .github/workflows/docker-build.yml:
jobs:
  build:
    runs-on: ubuntu-latest
    container: my-custom-build-image:tag
    steps:
      - name: Checkout
        uses: actions/checkout@v5

      # Dependency installation step is removed

      - name: Setup Bazel
        uses: bazelbuild/setup-bazelisk@v3
      # ...
Suggestion importance[1-10]: 9

__

Why: This is a significant architectural improvement that replaces an inefficient and hard-to-maintain script with a standard best practice, improving build speed and reproducibility.

High
Possible issue
Add error handling for dependency installation

Add a check after attempting to install pkg-config to verify it was successful,
and exit with an error if it was not.

.github/workflows/docker-build.yml [37-60]

 ensure_pkg_config() {
   if command -v pkg-config >/dev/null 2>&1; then
     return
   fi
 
+  echo "Attempting to install pkg-config..."
   if command -v apt-get >/dev/null 2>&1; then
     sudo apt-get install -y pkg-config
   elif command -v dnf >/dev/null 2>&1; then
-    if ! sudo dnf install -y pkgconfig; then
-      sudo dnf install -y pkgconf-pkg-config
-    fi
+    sudo dnf install -y pkgconfig || sudo dnf install -y pkgconf-pkg-config
   elif command -v yum >/dev/null 2>&1; then
-    if ! sudo yum install -y pkgconfig; then
-      sudo yum install -y pkgconf-pkg-config
-    fi
+    sudo yum install -y pkgconfig || sudo yum install -y pkgconf-pkg-config
   elif command -v microdnf >/dev/null 2>&1; then
-    if ! sudo microdnf install -y pkgconfig; then
-      sudo microdnf install -y pkgconf-pkg-config
-    fi
+    sudo microdnf install -y pkgconfig || sudo microdnf install -y pkgconf-pkg-config
   else
     echo "pkg-config is required but no supported package manager was found." >&2
     exit 1
   fi
+
+  if ! command -v pkg-config >/dev/null 2>&1; then
+    echo "Failed to install pkg-config." >&2
+    exit 1
+  fi
 }
  • Apply / Chat
Suggestion importance[1-10]: 7

__

Why: The suggestion correctly identifies a lack of error handling and proposes adding a check to ensure the dependency installation was successful, which improves the script's robustness.

Medium
General
Refactor dependency installation for clarity

Refactor the script to handle pkg-config installation consistently for all
package managers by calling ensure_pkg_config before the main installation
block.

.github/workflows/docker-build.yml [62-76]

+ensure_pkg_config
+
 if command -v apt-get >/dev/null 2>&1; then
   sudo apt-get update
-  sudo apt-get install -y build-essential pkg-config libssl-dev protobuf-compiler cmake flex bison
+  sudo apt-get install -y build-essential libssl-dev protobuf-compiler cmake flex bison
 elif command -v dnf >/dev/null 2>&1; then
   sudo dnf install -y gcc gcc-c++ make openssl-devel protobuf-compiler cmake flex bison
 elif command -v yum >/dev/null 2>&1; then
   sudo yum install -y gcc gcc-c++ make openssl-devel protobuf-compiler cmake flex bison
 elif command -v microdnf >/dev/null 2>&1; then
   sudo microdnf install -y gcc gcc-c++ make openssl-devel protobuf-compiler cmake flex bison
 else
   echo "Unsupported package manager; please install gcc, g++ (or clang), make, OpenSSL headers, pkg-config, cmake, flex, bison, and protoc manually." >&2
   exit 1
 fi
 
-ensure_pkg_config
-
  • Apply / Chat
Suggestion importance[1-10]: 5

__

Why: This is a valid refactoring suggestion that improves code clarity and consistency by centralizing the pkg-config installation logic, making the script easier to maintain.

Low
  • More
Imported GitHub PR comment. Original author: @qodo-code-review[bot] Original URL: https://github.com/carverauto/serviceradar/pull/1957#issuecomment-3550967606 Original created: 2025-11-19T06:12:04Z --- ## PR Code Suggestions ✨ <!-- e117da2 --> Explore these optional code suggestions: <table><thead><tr><td><strong>Category</strong></td><td align=left><strong>Suggestion&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </strong></td><td align=center><strong>Impact</strong></td></tr><tbody><tr><td rowspan=1>High-level</td> <td> <details><summary>Use a custom Docker image for build environment</summary> ___ **Instead of installing build dependencies with a shell script in the workflow, <br>create and use a custom Docker image with all required tools pre-installed. This <br>change will accelerate the build process, simplify the workflow file, and ensure <br>a consistent environment.** ### Examples: <details> <summary> <a href="https://github.com/carverauto/serviceradar/pull/1957/files#diff-3414847e2ad632333f775cabb810f0dc0df61a570365df34750a08b00912fe82R35-R77">.github/workflows/docker-build.yml [35-77]</a> </summary> ```yaml - name: Install build dependencies run: | ensure_pkg_config() { if command -v pkg-config >/dev/null 2>&1; then return fi if command -v apt-get >/dev/null 2>&1; then sudo apt-get install -y pkg-config elif command -v dnf >/dev/null 2>&1; then ... (clipped 33 lines) ``` </details> ### Solution Walkthrough: #### Before: ```yaml jobs: build: runs-on: ubuntu-latest steps: - name: Checkout uses: actions/checkout@v5 - name: Install build dependencies run: | if command -v apt-get >/dev/null 2>&1; then sudo apt-get install -y ... elif command -v dnf >/dev/null 2>&1; then sudo dnf install -y ... elif command -v yum >/dev/null 2>&1; then sudo yum install -y ... # ... etc fi - name: Setup Bazel uses: bazelbuild/setup-bazelisk@v3 # ... ``` #### After: ```yaml # In Dockerfile: FROM ubuntu:22.04 RUN apt-get update && apt-get install -y \ build-essential pkg-config libssl-dev \ protobuf-compiler cmake flex bison # In .github/workflows/docker-build.yml: jobs: build: runs-on: ubuntu-latest container: my-custom-build-image:tag steps: - name: Checkout uses: actions/checkout@v5 # Dependency installation step is removed - name: Setup Bazel uses: bazelbuild/setup-bazelisk@v3 # ... ``` <details><summary>Suggestion importance[1-10]: 9</summary> __ Why: This is a significant architectural improvement that replaces an inefficient and hard-to-maintain script with a standard best practice, improving build speed and reproducibility. </details></details></td><td align=center>High </td></tr><tr><td rowspan=1>Possible issue</td> <td> <details><summary>Add error handling for dependency installation</summary> ___ **Add a check after attempting to install <code>pkg-config</code> to verify it was successful, <br>and exit with an error if it was not.** [.github/workflows/docker-build.yml [37-60]](https://github.com/carverauto/serviceradar/pull/1957/files#diff-3414847e2ad632333f775cabb810f0dc0df61a570365df34750a08b00912fe82R37-R60) ```diff ensure_pkg_config() { if command -v pkg-config >/dev/null 2>&1; then return fi + echo "Attempting to install pkg-config..." if command -v apt-get >/dev/null 2>&1; then sudo apt-get install -y pkg-config elif command -v dnf >/dev/null 2>&1; then - if ! sudo dnf install -y pkgconfig; then - sudo dnf install -y pkgconf-pkg-config - fi + sudo dnf install -y pkgconfig || sudo dnf install -y pkgconf-pkg-config elif command -v yum >/dev/null 2>&1; then - if ! sudo yum install -y pkgconfig; then - sudo yum install -y pkgconf-pkg-config - fi + sudo yum install -y pkgconfig || sudo yum install -y pkgconf-pkg-config elif command -v microdnf >/dev/null 2>&1; then - if ! sudo microdnf install -y pkgconfig; then - sudo microdnf install -y pkgconf-pkg-config - fi + sudo microdnf install -y pkgconfig || sudo microdnf install -y pkgconf-pkg-config else echo "pkg-config is required but no supported package manager was found." >&2 exit 1 fi + + if ! command -v pkg-config >/dev/null 2>&1; then + echo "Failed to install pkg-config." >&2 + exit 1 + fi } ``` - [ ] **Apply / Chat** <!-- /improve --apply_suggestion=1 --> <details><summary>Suggestion importance[1-10]: 7</summary> __ Why: The suggestion correctly identifies a lack of error handling and proposes adding a check to ensure the dependency installation was successful, which improves the script's robustness. </details></details></td><td align=center>Medium </td></tr><tr><td rowspan=1>General</td> <td> <details><summary>Refactor dependency installation for clarity</summary> ___ **Refactor the script to handle <code>pkg-config</code> installation consistently for all <br>package managers by calling <code>ensure_pkg_config</code> before the main installation <br>block.** [.github/workflows/docker-build.yml [62-76]](https://github.com/carverauto/serviceradar/pull/1957/files#diff-3414847e2ad632333f775cabb810f0dc0df61a570365df34750a08b00912fe82R62-R76) ```diff +ensure_pkg_config + if command -v apt-get >/dev/null 2>&1; then sudo apt-get update - sudo apt-get install -y build-essential pkg-config libssl-dev protobuf-compiler cmake flex bison + sudo apt-get install -y build-essential libssl-dev protobuf-compiler cmake flex bison elif command -v dnf >/dev/null 2>&1; then sudo dnf install -y gcc gcc-c++ make openssl-devel protobuf-compiler cmake flex bison elif command -v yum >/dev/null 2>&1; then sudo yum install -y gcc gcc-c++ make openssl-devel protobuf-compiler cmake flex bison elif command -v microdnf >/dev/null 2>&1; then sudo microdnf install -y gcc gcc-c++ make openssl-devel protobuf-compiler cmake flex bison else echo "Unsupported package manager; please install gcc, g++ (or clang), make, OpenSSL headers, pkg-config, cmake, flex, bison, and protoc manually." >&2 exit 1 fi -ensure_pkg_config - ``` - [ ] **Apply / Chat** <!-- /improve --apply_suggestion=2 --> <details><summary>Suggestion importance[1-10]: 5</summary> __ Why: This is a valid refactoring suggestion that improves code clarity and consistency by centralizing the `pkg-config` installation logic, making the script easier to maintain. </details></details></td><td align=center>Low </td></tr> <tr><td align="center" colspan="2"> - [ ] More <!-- /improve --more_suggestions=true --> </td><td></td></tr></tbody></table>
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
1week

   
2weeks

   
Failed compliance check

   
IP cameras

   
NATS

NATS JetStream

  
Possible security concern

   
Review effort 1/5

   
Review effort 2/5

   
Review effort 3/5

   
Review effort 4/5

   
Review effort 5/5

   
UI

   
aardvark

   
accessibility

   
amd64

   
api

   
arm64

   
auth

   
back-end

   
bgp

   
blog

   
bug

Something isn't working

  
build

   
checkers

   
ci-cd

continuous integration-continuous deployments

  
cleanup

   
cnpg

cloud-native postgres

  
codex

   
core

core service

  
dependencies

Pull requests that update a dependency file

  
device-management

   
documentation

Improvements or additions to documentation

  
duplicate

This issue or pull request already exists

  
dusk

   
ebpf

   
enhancement

New feature or request

  
eta 1d

   
eta 1hr

   
eta 3d

   
eta 3hr

   
feature

   
fieldsurvey

   
github_actions

Pull requests that update GitHub Actions code

  
go

Pull requests that update Go code

  
good first issue

Good for newcomers

  
help wanted

Extra attention is needed

  
invalid

This doesn't seem right

  
javascript

Pull requests that update Javascript code

  
k8s

   
log-collector

   
mapper

   
mtr

multi traceroute

  
needs-triage

   
netflow

   
network-sweep

   
observability

   
oracle

Oracle Linux related issues

  
otel

opentelemetry logs, traces, metrics

  
plug-in

   
proton

timeplus proton streaming database

  
python

   
question

Further information is requested

  
reddit

   
redhat

   
research

   
rperf

   
rperf-checker

   
rust

Pull requests that update rust code

  
sdk

   
security

   
serviceradar-agent

   
serviceradar-agent-gateway

   
serviceradar-web

   
serviceradar-web-ng

   
siem

   
snmp

   
sysmon

   
topology

   
ubiquiti

   
wasm

   
wontfix

This will not be worked on

  
zen-engine
No labels
1week
2weeks
Failed compliance check
IP cameras
NATS
Possible security concern
Review effort 1/5
Review effort 2/5
Review effort 3/5
Review effort 4/5
Review effort 5/5
UI
aardvark
accessibility
amd64
api
arm64
auth
back-end
bgp
blog
bug
build
checkers
ci-cd
cleanup
cnpg
codex
core
dependencies
device-management
documentation
duplicate
dusk
ebpf
enhancement
eta 1d
eta 1hr
eta 3d
eta 3hr
feature
fieldsurvey
github_actions
go
good first issue
help wanted
invalid
javascript
k8s
log-collector
mapper
mtr
needs-triage
netflow
network-sweep
observability
oracle
otel
plug-in
proton
python
question
reddit
redhat
research
rperf
rperf-checker
rust
sdk
security
serviceradar-agent
serviceradar-agent-gateway
serviceradar-web
serviceradar-web-ng
siem
snmp
sysmon
topology
ubiquiti
wasm
wontfix
zen-engine
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
carverauto/serviceradar!2425
No description provided.