[devantler]

🤖 Generated by the Agentic Engineer

Why

The scan-storage repair can reject unchanged records because two saved formats keep different timestamp precision, leaving reports inconsistent.

What

Compare creation times in the same saved format while preserving retained reports and all other identity checks. Publish the corrected repair for a separate reviewed rollout; production acceptance remains open.

Part of #5419

[devantler]

🤖 Generated by the Agentic Engineer

Validation at 091d58bac04e4abc039674f90beeedf3cc07e1d9:

• The new regression exercises real saveObject JSON/Gob storage in both internal and versioned formats, for coherent and split summaries. All four cases failed with summary identity changed before the correction.
• Replaying all four reviewed patches onto the exact pinned upstream commit produces the publisher-bound implementation and test hashes. The entire file-storage package passes with the race detector; existing refusal, payload preservation, stale-write and watch-event checks remain active.
• User evaluation: the new cases reconcile an intact fractional-second payload without changing its bytes, then complete the real scanner update with the expected next resource version. This observes the storage path in temporary SQLite and filesystem storage; it does not claim production repair.
• The publisher contract, workflow lint and whitespace validation pass. Correctness, security and simplification self-review found no remaining issue. The workflow retains its permissions, provenance, digest signing and exact source/preimage checks.

#5419 remains open. Signed image publication, a separately reviewed production image pin and fresh runtime acceptance are still required.

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: devantler-tech/platform
• Branch: codex/kubescape-time-codec-5419
• File: .coderabbit.yaml
• Commit: 091d58b
• Layers: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 87664749-dc12-4069-9caf-df70518cf6a9

Commits

Reviewing files that changed from the base of the PR and between 8578d84 and 091d58b.

Files selected for processing: 4

• .github/workflows/publish-kubescape-storage-hotfix.yaml
• docs/kubescape-result-coverage.md
• k8s/bases/infrastructure/controllers/kubescape/storage-v0.0.297-summary-native-codec.patch
• scripts/tests/test-kubescape-storage-hotfix.sh

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Recent review details

Context from checks skipped due to timeout: 22

• GitHub Check: 🧩 Validate Helm Post-Renderers
• GitHub Check: ⚖️ Validate Cluster Policies (tenant)
• GitHub Check: ⚖️ Validate Cluster Policies (placement)
• GitHub Check: ⚖️ Validate Cluster Policies (services)
• GitHub Check: ⚖️ Validate Cluster Policies (fixtures)
• GitHub Check: ⚖️ Validate Cluster Policies (storage)
• GitHub Check: 🧪 Validate Independent Manifest Regressions
• GitHub Check: 🛟 Validate PodDisruptionBudget Selectors
• GitHub Check: 🔐 Validate Production Authorization
• GitHub Check: 🧪 Validate Manifests
• GitHub Check: ⚖️ Validate Cluster Policies (observability)
• GitHub Check: 🔐 Validate Flux Credential Bridge
• GitHub Check: 🔬 Validate Nested RGD Templates
• GitHub Check: 🧩 Compile WebApp with pinned KRO
• GitHub Check: 🔏 Validate Cosign Matcher Efficacy
• GitHub Check: 🧪 Validate Complete Go Regressions
• GitHub Check: 🔐 Validate Consumer Discovery Regressions
• GitHub Check: 🛡️ Validate Repository Guards
• GitHub Check: 🔐 Validate Publication Generator
• GitHub Check: Verify pinned source and patch
• GitHub Check: Analyze (go)
• GitHub Check: Analyze (go)

Additional context used

Code guidelines: 1

AGENTS.md — auto-discovered

Path-based instructions: 3

Source excerpt: The platform uses a hierarchical kustomization structure: **base** configurations in `k8s/bases/` → **provider-specific** overlays in `k8s/providers/` → **cluster-specific** overlays in `k8s/clusters/`.

CodeRabbit inference engine (AGENTS.md)

Files:

• k8s/bases/infrastructure/controllers/kubescape/storage-v0.0.297-summary-native-codec.patch

Source excerpt: Resources under `k8s/bases/infrastructure/` are **component-folder-first**: a component's HelmRelease/HelmRepository and its own CRs live together in a folder named after the component — `controllers//` in the con...

CodeRabbit inference engine (AGENTS.md)

Files:

• k8s/bases/infrastructure/controllers/kubescape/storage-v0.0.297-summary-native-codec.patch

Source excerpt: **Put a change in the layer that matches its scope** — edit `k8s/bases/` when it should hold for **every consumer of that resource**; add an overlay `patches/` fragment only for a genuine per-consumer difference.

CodeRabbit inference engine (AGENTS.md)

Files:

• k8s/bases/infrastructure/controllers/kubescape/storage-v0.0.297-summary-native-codec.patch

Additional comments: 4

k8s/bases/infrastructure/controllers/kubescape/storage-v0.0.297-summary-native-codec.patch: 1

42-48: LGTM!

Also applies to: 52-52, 54-54, 225-284

.github/workflows/publish-kubescape-storage-hotfix.yaml: 1

33-33: LGTM!

Also applies to: 92-93, 158-159

docs/kubescape-result-coverage.md: 1

148-151: LGTM!

scripts/tests/test-kubescape-storage-hotfix.sh: 1

44-44: LGTM!

Walkthrough

The summary metadata reconciliation patch now supports versioned and flattened metadata formats. It rejects ambiguous wrapped metadata and compares creation times at RFC3339 wire precision while retaining the Gob payload. Tests cover reconciliation outcomes, watch events, timestamp precision, and payload preservation. The publisher workflow and its test advance to revision 10, and the documentation describes the updated timestamp comparison and retained guards.

Possibly related issues

• devantler-tech/platform#4263 — The change updates scan-storage reconciliation for stored vulnerability summaries.
• devantler-tech/platform#2043 — The change addresses a metadata-precision mismatch in stored vulnerability results.
• devantler-tech/platform#5403 — The change implements the metadata-precision repair described as a prerequisite; reference construction remains separate.
• devantler-tech/platform#5419 — The change applies the scan-storage summary repair that this issue adopts.
• devantler-tech/platform#2447 — The change addresses a persistence-coherence issue within the broader vulnerability coverage objective.

Possibly related PRs

• devantler-tech/platform#5420 — It pins an earlier revision of the same Kubescape summary metadata repair; this change advances the publisher revision and adds native-format handling and timestamp-precision comparison.

Priority: Normal

Merge Risk: Minimal · up to 091d5

The change aligns timestamp comparisons with stored metadata. No merge-blocking issue was established; production rollout remains separate.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: comparing summary creation times at metadata precision.
Description check		The description explains the timestamp precision problem and the intended repair behavior. It is directly related to the changeset.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 1 files. (3 skipped: 3 unsupported.)

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devantler]

🤖 Generated by the Agentic Engineer

Readiness rechecked at 091d58bac04e4abc039674f90beeedf3cc07e1d9: all 40 completed checks pass (11 intentionally skipped), the complete review-thread read is zero, and the authenticated current-head CodeRabbit summary returns GREEN. The PR is CLEAN against current main; no human direction, live checkout holder or active writer signal remains. The body contract and issue-closing check pass.

The exact-head regression and user evaluation in the validation receipt exercise retained fractional-second payloads, both storage codecs and the subsequent scanner update; payload bytes are preserved. Source review confirms identity and version guards remain in place. The required-gate helper confirms the check and workflow gates; the configured native code-quality rule remains API-unverifiable, with CLEAN and the protected queue retaining the provider decision.

Promoting this publisher repair for protected integration. #5419 remains open: signed image publication, a separate immutable production pin, rollback/data safeguards and runtime acceptance are still required.