Combined doc update - PSMICRO-900 - binary expansion docs - #96
Open
dbaker-arch wants to merge 24 commits into
Open
Combined doc update - PSMICRO-900 - binary expansion docs#96dbaker-arch wants to merge 24 commits into
dbaker-arch wants to merge 24 commits into
Conversation
Updating Jira base URL across all pages Re-created jira custom filter that was invalidated by the hosting change.
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughSummary by CodeRabbit
WalkthroughThe documentation updates describe current CSAF/VEX publication practices, clarify RPM and repository guidance, expand product metadata definitions, and replace legacy SECDATA links with Red Hat Atlassian URLs. ChangesDocumentation guidance updates
Estimated code review effort: 2 (Simple) | ~10 minutes Mergeability Score: ⚪ Minimal · up to This documentation-only update introduces no actionable merge-blocking risk; it is merge-ready after normal checks and review. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 8
🧹 Nitpick comments (1)
docs/csaf-vex.md (1)
43-43: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winUse descriptive link text.
Replace
herewith destination-specific text such asCSAF advisory directory,per-CVE VEX directory, andbinary-RPM-aware VEX feed. This improves link discoverability and addresses the MD059 warnings.Also applies to: 60-61
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/csaf-vex.md` at line 43, Update the links in docs/csaf-vex.md, including the additional occurrences around lines 60–61, to replace generic “here” link text with destination-specific labels such as “CSAF advisory directory,” “per-CVE VEX directory,” and “binary-RPM-aware VEX feed,” while preserving the existing URLs and surrounding content.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/csaf-vex.md`:
- Around line 204-206: Update the CPE definition in the documentation to
describe CPE as a structured naming scheme, not a centralized database; state
that the NVD hosts a dictionary of official CPE names, while preserving the
existing reference link.
- Around line 332-358: Update the RPM expansion documentation around “Binary RPM
Expansion” and “Modular RPM (rpmmod) Expansion” to define the consumer contract:
scanners must form product/component pairs, traverse module RPMs through
RPM-to-module and module-to-product relationships, and specify how to resolve
SRPM-level versus binary-RPM status mismatches so affectedness is neither
omitted nor misattributed. Align the wording with the relationship model
referenced in docs/scanning-vendors.md.
- Around line 5-9: Update the CSAF VEX coverage statement in the document
introduction to retain July 10, 2024 as the historical GA milestone while
qualifying the current effective scope and date, including the later all-CVE
rollout and subsequent removal of files based solely on public CVE data; link to
the Red Hat changelog for these changes if appropriate, and avoid implying that
an absent CVE indicates no association.
- Around line 132-133: Update the CSAF VEX field documentation to distinguish
document.tracking.id as the VEX document identifier and initial_release_date as
that document’s first publication date. Move CVE-specific metadata under
vulnerabilities[].cve, and document the Red Hat convention of using a CVE ID as
the document ID when applicable.
In `@docs/scanning-vendors.md`:
- Line 52: Update the RPM module statement in the documentation to say that RHEL
10 deprecates modularity and does not distribute modular RPM content, while
clarifying that module functionality is scheduled for removal in a future major
release. Avoid wording that implies rpmmod handling should be removed for all
RHEL releases.
- Around line 60-61: Update the documentation around RPM discovery to
distinguish regular packages from module streams and profiles: retain rpm -qa
for binary RPMs, document dnf module list --installed for RPM modules in
modularity-enabled content, and specify the fallback behavior when dnf is
unavailable.
- Around line 228-231: Align the rollout date in the legacy content manifest
section with the verified content-sets replacement date documented elsewhere,
replacing the conflicting July 2025 date while preserving the deprecation
guidance.
- Around line 328-334: Update the vendor-scanning documentation and
implementation described around the binary RPM repository lookup to use an
installed-package/transaction-scoped query, such as DNF5’s --installed query
with %{from_repo}, instead of unscoped dnf repoquery metadata. Ensure the
scanner emits only the repository recorded at installation time, preventing
currently available but uninvolved repositories from reaching the CPE-mapping
step.
---
Nitpick comments:
In `@docs/csaf-vex.md`:
- Line 43: Update the links in docs/csaf-vex.md, including the additional
occurrences around lines 60–61, to replace generic “here” link text with
destination-specific labels such as “CSAF advisory directory,” “per-CVE VEX
directory,” and “binary-RPM-aware VEX feed,” while preserving the existing URLs
and surrounding content.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 6079703c-33d2-4766-a0aa-15f476c58ae1
📒 Files selected for processing (6)
docs/csaf-vex.mddocs/purl.mddocs/sbom.mddocs/scanning-vendors.mddocs/vex-ga-details.mddocs/vex-ga.md
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
docs/csaf-vex.md (1)
235-235: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winUse
rpmwith therpmmodqualifier.
rpmmodis not a purl type. Update this sentence to listrpmandocipurl types, and state that modular RPMs use therpmmodqualifier.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/csaf-vex.md` at line 235, Update the purl content-type sentence in the CSAF VEX documentation to list only the rpm and oci types, and state that modular RPMs use the rpmmod qualifier.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/scanning-vendors.md`:
- Line 233: Update the container image path documentation in the scanning
guidance to use the absolute `/root/buildinfo/` directory instead of the
relative `root/buildinfo/` path, preserving the surrounding instructions.
---
Outside diff comments:
In `@docs/csaf-vex.md`:
- Line 235: Update the purl content-type sentence in the CSAF VEX documentation
to list only the rpm and oci types, and state that modular RPMs use the rpmmod
qualifier.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 368468fe-f343-43da-a071-2a18f41686b2
📒 Files selected for processing (4)
docs/csaf-vex.mddocs/purl.mddocs/scanning-vendors.mddocs/vex-ga.md
🚧 Files skipped from review as they are similar to previous changes (2)
- docs/purl.md
- docs/vex-ga.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Combined docs update for binary expansion notes.