Y stream handling by inheritance

[opohorel]

Summary

Add a Y-stream inheritance fast path for Important and Critical CVEs so the backport agent can reuse a shipped Z-stream packaging fix instead of rediscovering the patch from scratch.
When triage sees an Important/Critical Y-stream CVE with at least one shipped Z-stream clone, it now carries that clone’s Jira key, Fixed in Build NVR, and fixVersions in the backport task. The backport agent may then:

1. Resolve the Brew build to a trusted gitlab.com/redhat/rhel/rpms/<package>#<full-sha> source
2. Select a same-major clone whose Epoch:Version matches the Y-stream spec
3. Find the single-issue Resolves: commit in the diverged Z-stream history
4. Copy inherited patch files from their Git blobs (byte-for-byte, not rewritten)
5. Let a restricted LLM map only the spec change onto cXs (no shell, network, or file-creation tools)
6. Audit protected spec metadata, patch blob IDs, and %prep usage
7. Require clean %prep, SRPM, and Copr before commit/push/MR
   If inheritance cannot be applied safely, the existing backport path runs unchanged. An already-present fix is a terminal error, not an empty success. After a validated commit is pushed, retries resume at MR creation only (same ymir_backport label and consolidation queue).

Why

Y-stream Important/Critical CVEs often already have a shipped Z-stream fix for the same upstream tarball. Re-running the full LLM backport duplicates that work and can produce a different patch. This path prefers the shipped evidence when the packaging commit is simple enough to inherit.

[qodo-for-packit]

PR Summary by Qodo

Inherit shipped Z-stream fixes in Y-stream CVE backports

✨ Enhancement 🧪 Tests 📝 Documentation 🕐 40+ Minutes

AI Description

• Reuses shipped Z-stream fixes for eligible Important and Critical Y-stream CVEs.
• Validates provenance, immutable patches, spec adaptation, builds, and publication checkpoints.
• Falls back safely to normal backporting before push when inheritance is unsuitable.

Diagram

sequenceDiagram
    participant Jira as Jira Triage
    participant Backport as Backport Workflow
    participant Brew as Brew
    participant Source as GitLab Source
    participant LLM as Restricted LLM
    participant Validate as Validation
    participant Fork as Package Fork
    participant MR as Merge Request
    Jira->>Backport: Shipped candidate
    Backport->>Brew: Resolve NVR
    Brew-->>Backport: Trusted source
    Backport->>Source: Fetch full SHA
    Source-->>Backport: Fix commit
    Backport->>LLM: Adapt spec only
    LLM-->>Validate: Spec changes
    Validate-->>Backport: Fallback if unsafe
    Validate->>Fork: Push validated commit
    Fork->>MR: Open or resume

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Direct commit cherry-pick

• ➕ Simpler workflow with native Git provenance
• ➕ Preserves the complete shipped packaging commit
• ➖ Fails when Y-stream spec history diverges
• ➖ Can incorrectly copy release, changelog, or unrelated packaging state

2. Always use normal backporting

• ➕ Reuses the existing broadly compatible workflow
• ➕ Avoids maintaining inheritance-specific validation logic
• ➖ Rediscovers an already shipped fix
• ➖ May generate a different patch with weaker shipped-build provenance

Recommendation: Keep the hybrid deterministic-plus-restricted-adaptation approach. It preserves shipped patch evidence while accommodating spec divergence, and its pre-push fallback retains existing compatibility; direct cherry-picking is too brittle and unconditional normal backporting forfeits the primary provenance benefit.

Files changed (23) +2869 / -182

Enhancement (8) +1743 / -138

backport_agent.pyOrchestrate validated Y-stream inheritance +824/-82

Orchestrate validated Y-stream inheritance

• Adds candidate selection, provenance resolution, restricted spec adaptation, package validation, safe fallback, and immutable patch staging. Separates commit, push, and MR phases so retries resume publication without duplicating backports.

ymir/agents/backport_agent.py

instructions_inherit.j2Constrain inheritance adaptation behavior +38/-0

Constrain inheritance adaptation behavior

• Defines a spec-only editing workflow that treats source content as data, preserves protected metadata, and requires immutable patch integration.

ymir/agents/prompts/backport/instructions_inherit.j2

prompt_inherit.j2Provide validated inheritance context +29/-0

Provide validated inheritance context

• Supplies source and target Jira keys, commit metadata, immutable patch names, and the source spec diff to the adaptation agent.

ymir/agents/prompts/backport/prompt_inherit.j2

ystream_inherit.pyImplement deterministic Z-stream inheritance helpers +584/-0

Implement deterministic Z-stream inheritance helpers

• Validates Brew and Git provenance, finds one Jira-specific commit, materializes exact patch blobs, and audits spec adaptation and patch usage. Also provides cleanup and commit-message rewriting utilities.

ymir/agents/ystream_inherit.py

__init__.pyExport shipped candidate model +2/-1

Export shipped candidate model

• Makes the shipped Z-stream candidate type available through the common package API.

ymir/common/init.py

models.pyModel inheritance candidates and adaptation results +40/-0

Model inheritance candidates and adaptation results

• Adds shipped clone metadata to CVE eligibility and defines structured input and output contracts for guided spec adaptation.

ymir/common/models.py

gitlab.pyAdd authenticated commit and branch-head tools +113/-3

Add authenticated commit and branch-head tools

• Adds full-SHA fetching into namespaced refs and exact remote branch resolution, while returning stdout from the shared Git runner.

ymir/tools/privileged/gitlab.py

jira.pyCollect shipped current Z-stream candidates +113/-52

Collect shipped current Z-stream candidates

• Extends dependency checks to retain deterministic Jira, Fixed in Build, and fixVersion metadata from shipped current Z-stream clones. Only Important and Critical Y-stream eligibility results expose candidates.

ymir/tools/privileged/jira.py

Refactor (1) +47 / -3

tasks.pySeparate commit, push, and MR operations +47/-3

Separate commit, push, and MR operations

• Extracts independent commit, push, and merge-request helpers so inherited publication can checkpoint and resume after a validated commit.

ymir/agents/tasks.py

Tests (6) +998 / -41

test_backport_helpers.pyTest inheritance routing and retry helpers +198/-1

Test inheritance routing and retry helpers

• Covers candidate extraction, eligibility guards, durable fallback, prep failures, cleanup retries, remote-head checks, and publication checkpoint restoration.

ymir/agents/tests/unit/test_backport_helpers.py

test_jinja2_templates.pyTest inheritance prompt constraints +52/-2

Test inheritance prompt constraints

• Verifies that inheritance templates expose required context and enforce spec-only edits, immutable patches, protected metadata, and prompt-injection boundaries.

ymir/agents/tests/unit/test_jinja2_templates.py

test_tasks.pyTest independent commit and push phases +34/-0

Test independent commit and push phases

• Confirms local commit SHA capture and separately invoked authenticated branch publication.

ymir/agents/tests/unit/test_tasks.py

test_ystream_inherit.pyTest deterministic inheritance safeguards +432/-0

Test deterministic inheritance safeguards

• Exercises Brew validation, candidate selection, diverged history search, commit inventory restrictions, blob immutability, spec audits, cleanup, and message rewriting.

ymir/agents/tests/unit/test_ystream_inherit.py

test_gitlab.pyTest privileged inheritance Git operations +114/-0

Test privileged inheritance Git operations

• Validates namespaced SHA fetching, input rejection, exact branch-head lookup, and missing-branch failures.

ymir/tools/privileged/tests/unit/test_gitlab.py

test_jira.pyTest shipped candidate eligibility metadata +168/-38

Test shipped candidate eligibility metadata

• Updates dependency-result tests and verifies current-stream filtering, missing-NVR behavior, severity gating, and candidate propagation.

ymir/tools/privileged/tests/unit/test_jira.py

Documentation (7) +77 / -0

README-agents.mdDocument the Y-stream inheritance fast path +27/-0

Document the Y-stream inheritance fast path

• Explains eligibility, immutable patch handling, restricted adaptation, validation gates, fallback behavior, and publication-only retries.

README-agents.md

THREAT_MODEL.mdModel Brew and dist-git inheritance threats +1/-0

Model Brew and dist-git inheritance threats

• Adds the risk of malicious Brew source metadata or source commits and documents provenance, tool, file, and build mitigations.

THREAT_MODEL.md

ai_providers_data_flow.mdRecord restricted AI-assisted spec adaptation +2/-0

Record restricted AI-assisted spec adaptation

• Documents guided Y-stream spec adaptation as an AI use case while emphasizing external patch immutability checks.

ai_providers_data_flow.md

mr_consolidation_architecture.mdIntegrate inherited MRs with consolidation +6/-0

Integrate inherited MRs with consolidation

• Clarifies that inherited backports retain standard labels and consolidation behavior while preserving source provenance in the MR.

docs/mr_consolidation_architecture.md

gitlab_distgit_data_flow.mdDocument commit fetching and resumable publication +18/-0

Document commit fetching and resumable publication

• Describes namespaced full-SHA fetching, immutable blob verification, push reconciliation, and MR-only recovery after publication begins.

gitlab_distgit_data_flow.md

jira_data_flow.mdDocument shipped clone metadata propagation +10/-0

Document shipped clone metadata propagation

• Explains how current Z-stream Jira keys, build NVRs, and fix versions flow through triage metadata to backport tasks.

jira_data_flow.md

jira_label_workflow_routing.mdDocument inheritance routing and failure semantics +13/-0

Document inheritance routing and failure semantics

• Describes unchanged labels, pre-push fallback, terminal already-inherited failures, durable disable markers, and publication checkpoints.

jira_label_workflow_routing.md

Other (1) +4 / -0

gateway.pyRegister inheritance Git tools +4/-0

Register inheritance Git tools

• Exposes authenticated full-commit fetching and exact remote branch head lookup through the privileged gateway.

ymir/tools/privileged/gateway.py

[qodo-for-packit]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📜 Skill insights (0)

1. Upcoming clones bypass dependency gate ✗ Dismissed 🐞 Bug ≡ Correctness

Description

_check_zstream_clones_shipped now filters only against current_z_streams, so pending upcoming
Z-stream clones are skipped and the function reports the dependency as satisfied, allowing
Important/Critical Y-stream triage prematurely. Shipped upcoming clones are also omitted from
candidate metadata, although the documented restriction applies to inheritance sources rather than
the existing dependency decision.

Code

ymir/tools/privileged/jira.py[449]

-    upcoming_z_streams = rhel_config.get("upcoming_z_streams", {})

Relevance

●●● Strong

Recent accepted Jira precedent supports correcting Z-stream dependency handling; this directly
prevents premature Important/Critical triage.

PR-#729

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The current implementation builds the relevant set solely from current streams, skips nonmatching
issues before evaluating status, and returns any_shipped=True when no relevant pending issue
remains. The sibling Low/Moderate dependency path still uses both current and upcoming streams,
while the added documentation says upcoming streams are excluded as inheritance sources,
demonstrating that source selection and dependency gating are distinct concerns.

ymir/tools/privileged/jira.py[470-482]
ymir/tools/privileged/jira.py[487-499]
ymir/tools/privileged/jira.py[504-512]
ymir/tools/privileged/jira.py[541-546]
ymir/tools/privileged/jira.py[678-688]
jira_data_flow.md[138-146]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Preserve upcoming Z-stream clones in the existing dependency eligibility decision while restricting inheritance candidates to configured current Z-streams.

## Issue Context
A pending upcoming clone must still block Y-stream triage. Only candidate creation for the inheritance fast path should use the current/leading-stream subset.

## Fix Focus Areas
- ymir/tools/privileged/jira.py[470-546]
- ymir/tools/privileged/jira.py[683-688]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context sources

✅ Compliance rules (platform): 8 rules

Tip of the day

💡 Did you know, you can type 'qodo, fix this' on a finding and the fix lands right on your PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗