fix(kubescape): compare summary times at metadata precision - #5501

🤖 Generated by the Agentic Engineer

Validation at 091d58bac04e4abc039674f90beeedf3cc07e1d9:

• The new regression exercises real saveObject JSON/Gob storage in both internal and versioned formats, for coherent and split summaries. All four cases failed with summary identity changed before the correction.
• Replaying all four reviewed patches onto the exact pinned upstream commit produces the publisher-bound implementation and test hashes. The entire file-storage package passes with the race detector; existing refusal, payload preservation, stale-write and watch-event checks remain active.
• User evaluation: the new cases reconcile an intact fractional-second payload without changing its bytes, then complete the real scanner update with the expected next resource version. This observes the storage path in temporary SQLite and filesystem storage; it does not claim production repair.
• The publisher contract, workflow lint and whitespace validation pass. Correctness, security and simplification self-review found no remaining issue. The workflow retains its permissions, provenance, digest signing and exact source/preimage checks.

#5419 remains open. Signed image publication, a separately reviewed production image pin and fresh runtime acceptance are still required.

🤖 Generated by the Agentic Engineer

@coderabbitai review

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: devantler-tech/platform
• Branch: codex/kubescape-time-codec-5419
• File: .coderabbit.yaml
• Commit: 091d58b
• Layers: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 87664749-dc12-4069-9caf-df70518cf6a9

Commits

Reviewing files that changed from the base of the PR and between 8578d84 and 091d58b.

Files selected for processing: 4

• .github/workflows/publish-kubescape-storage-hotfix.yaml
• docs/kubescape-result-coverage.md
• k8s/bases/infrastructure/controllers/kubescape/storage-v0.0.297-summary-native-codec.patch
• scripts/tests/test-kubescape-storage-hotfix.sh

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Recent review details

Context from checks skipped due to timeout: 22

• GitHub Check: 🧩 Validate Helm Post-Renderers
• GitHub Check: ⚖️ Validate Cluster Policies (tenant)
• GitHub Check: ⚖️ Validate Cluster Policies (placement)
• GitHub Check: ⚖️ Validate Cluster Policies (services)
• GitHub Check: ⚖️ Validate Cluster Policies (fixtures)
• GitHub Check: ⚖️ Validate Cluster Policies (storage)
• GitHub Check: 🧪 Validate Independent Manifest Regressions
• GitHub Check: 🛟 Validate PodDisruptionBudget Selectors
• GitHub Check: 🔐 Validate Production Authorization
• GitHub Check: 🧪 Validate Manifests
• GitHub Check: ⚖️ Validate Cluster Policies (observability)
• GitHub Check: 🔐 Validate Flux Credential Bridge
• GitHub Check: 🔬 Validate Nested RGD Templates
• GitHub Check: 🧩 Compile WebApp with pinned KRO
• GitHub Check: 🔏 Validate Cosign Matcher Efficacy
• GitHub Check: 🧪 Validate Complete Go Regressions
• GitHub Check: 🔐 Validate Consumer Discovery Regressions
• GitHub Check: 🛡️ Validate Repository Guards
• GitHub Check: 🔐 Validate Publication Generator
• GitHub Check: Verify pinned source and patch
• GitHub Check: Analyze (go)
• GitHub Check: Analyze (go)

Additional context used

Code guidelines: 1

AGENTS.md — auto-discovered

Path-based instructions: 3

Source excerpt: The platform uses a hierarchical kustomization structure: **base** configurations in `k8s/bases/` → **provider-specific** overlays in `k8s/providers/` → **cluster-specific** overlays in `k8s/clusters/`.

CodeRabbit inference engine (AGENTS.md)

Files:

• k8s/bases/infrastructure/controllers/kubescape/storage-v0.0.297-summary-native-codec.patch

Source excerpt: Resources under `k8s/bases/infrastructure/` are **component-folder-first**: a component's HelmRelease/HelmRepository and its own CRs live together in a folder named after the component — `controllers//` in the con...

CodeRabbit inference engine (AGENTS.md)

Files:

• k8s/bases/infrastructure/controllers/kubescape/storage-v0.0.297-summary-native-codec.patch

Source excerpt: **Put a change in the layer that matches its scope** — edit `k8s/bases/` when it should hold for **every consumer of that resource**; add an overlay `patches/` fragment only for a genuine per-consumer difference.

CodeRabbit inference engine (AGENTS.md)

Files:

• k8s/bases/infrastructure/controllers/kubescape/storage-v0.0.297-summary-native-codec.patch

Additional comments: 4

k8s/bases/infrastructure/controllers/kubescape/storage-v0.0.297-summary-native-codec.patch: 1

42-48: LGTM!

Also applies to: 52-52, 54-54, 225-284

.github/workflows/publish-kubescape-storage-hotfix.yaml: 1

33-33: LGTM!

Also applies to: 92-93, 158-159

docs/kubescape-result-coverage.md: 1

148-151: LGTM!

scripts/tests/test-kubescape-storage-hotfix.sh: 1

44-44: LGTM!

Priority: Normal

Merge Risk: Minimal · up to 091d5

The change aligns timestamp comparisons with stored metadata. No merge-blocking issue was established; production rollout remains separate.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: comparing summary creation times at metadata precision.
Description check		The description explains the timestamp precision problem and the intended repair behavior. It is directly related to the changeset.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 1 files. (3 skipped: 3 unsupported.)

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{Comment @coderabbitai help to get the list of available commands.}

🤖 Generated by the Agentic Engineer

Readiness rechecked at 091d58bac04e4abc039674f90beeedf3cc07e1d9: all 40 completed checks pass (11 intentionally skipped), the complete review-thread read is zero, and the authenticated current-head CodeRabbit summary returns GREEN. The PR is CLEAN against current main; no human direction, live checkout holder or active writer signal remains. The body contract and issue-closing check pass.

The exact-head regression and user evaluation in the validation receipt exercise retained fractional-second payloads, both storage codecs and the subsequent scanner update; payload bytes are preserved. Source review confirms identity and version guards remain in place. The required-gate helper confirms the check and workflow gates; the configured native code-quality rule remains API-unverifiable, with CLEAN and the protected queue retaining the provider decision.

Promoting this publisher repair for protected integration. #5419 remains open: signed image publication, a separate immutable production pin, rollback/data safeguards and runtime acceptance are still required.