fix mdmproxy build by reverting back to previous but not filtering tags#48264
Conversation
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Claude Code Review
This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.
Tip: disable this comment in your organization's Code Review settings.
There was a problem hiding this comment.
Pull request overview
This PR updates the mdmproxy Docker build to compile the binary from a checked-out Fleet repo (instead of go install ...@TAG), aiming to restore successful builds while allowing the build arg to reference tags/branches as needed.
Changes:
- Install
gitin the builder stage andgit cloneFleet at the providedTAG. - Build
mdmproxyviago buildfrom the cloned source. - Update the final-stage
COPYto pull the binary from the build output path in the cloned repo.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
WalkthroughThe Dockerfile for 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@tools/mdm/migration/mdmproxy/Dockerfile`:
- Around line 2-5: The Dockerfile’s git clone step uses TAG unquoted in a shell
RUN, which can allow build-time command injection if the value is
user-controlled. Update the mdmproxy Dockerfile to validate TAG before it
reaches the shell and ensure the git clone invocation in the RUN block treats it
as a safe branch/ref value. Locate the fix around the ARG TAG and the git clone
command so the build only accepts expected tag formats and does not expand
arbitrary shell metacharacters.
- Around line 4-6: The Dockerfile build step that clones Fleet in the mdmproxy
image currently checks out only by tag, which can drift if the tag is moved.
Update the git clone flow to accept a commit SHA input alongside the existing
TAG, then verify the checked-out revision in the same RUN sequence after
checkout before running go build in tools/mdm/migration/mdmproxy. Use the
existing git clone command block as the fix point and ensure the HEAD SHA
matches the expected commit SHA.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 979f0d44-8aa3-4fab-9691-e917b4ba4841
📒 Files selected for processing (1)
tools/mdm/migration/mdmproxy/Dockerfile
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Related issue: Resolves #
Checklist for submitter
If some of the following don't apply, delete the relevant line.
Changes file added for user-visible changes in
changes/,orbit/changes/oree/fleetd-chrome/changes.See Changes files for more information.
Input data is properly validated,
SELECT *is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters.Timeouts are implemented and retries are limited to avoid infinite loops
If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes
Testing
Added/updated automated tests
Where appropriate, automated tests simulate multiple hosts and test for host isolation (updates to one hosts's records do not affect another)
QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
Database migrations
COLLATE utf8mb4_unicode_ci).New Fleet configuration settings
If you didn't check the box above, follow this checklist for GitOps-enabled settings:
fleetctl generate-gitopsfleetd/orbit/Fleet Desktop
runtime.GOOSis used as needed to isolate changesSummary by CodeRabbit