Skip to content

ROB-0000 add labels to robusta alerts using subject information#2065

Open
RoiGlinik wants to merge 5 commits intomasterfrom
ROB-0000-bettson-add-label-to-robusta-alerts
Open

ROB-0000 add labels to robusta alerts using subject information#2065
RoiGlinik wants to merge 5 commits intomasterfrom
ROB-0000-bettson-add-label-to-robusta-alerts

Conversation

@RoiGlinik
Copy link
Copy Markdown
Contributor

No description provided.

RoiGlinik added 2 commits May 3, 2026 17:05
Signed-off-by: Roi Glinik <groi.tech@gmail.com>
Signed-off-by: Roi Glinik <groi.tech@gmail.com>
@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 4, 2026

Docker image ready for 37c01bc (built in 1m 40s)

⚠️ Warning: does not support ARM (ARM images are built on release only - not on every PR)

Use this tag to pull the image for testing.

📋 Copy commands

⚠️ Temporary images are deleted after 30 days. Copy to a permanent registry before using them:

gcloud auth configure-docker us-central1-docker.pkg.dev
docker pull us-central1-docker.pkg.dev/robusta-development/temporary-builds/robusta-runner:37c01bc
docker tag us-central1-docker.pkg.dev/robusta-development/temporary-builds/robusta-runner:37c01bc me-west1-docker.pkg.dev/robusta-development/development/robusta-runner-dev:37c01bc
docker push me-west1-docker.pkg.dev/robusta-development/development/robusta-runner-dev:37c01bc

Patch Helm values in one line:

helm upgrade --install robusta robusta/robusta \
  --reuse-values \
  --set runner.image=me-west1-docker.pkg.dev/robusta-development/development/robusta-runner-dev:37c01bc

@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented May 4, 2026

Review Change Stack

Walkthrough

Adds configurable regex-based relabeling for finding subjects: new FindingLabelRule model, FindingOverrides accepts rules, customise_finding evaluates rules and injects labels via ExecutionBaseEvent.inject_finding_labels(), and guards Finding.subject when None.

Changes

Finding Label Relabeling Feature

Layer / File(s) Summary
Data Models
playbooks/robusta_playbooks/common_actions.py
Added FindingLabelRule model with source_fields, regex, target_label, replacement, and separator. Extended FindingOverrides with optional finding_label_rules list.
Core Implementation
playbooks/robusta_playbooks/common_actions.py, src/robusta/core/model/events.py
customise_finding templates and forwards aggregation_key to overrides; builds a subject source map (namespace/name/kind, labels.*, annotations.*), applies re.fullmatch per rule with capture-group substitution into replacement, injects matched labels via event.inject_finding_labels(), and adds a vertical TableBlock enrichment with Slack attachment type alert_labels. Added ExecutionBaseEvent.inject_finding_labels(labels) to update finding subject labels across named sinks.
Constructor Guard
src/robusta/core/reporting/base.py
Finding.__init__ now replaces an explicit subject=None with a default FindingSubject() instance.
Tests
tests/test_customise_finding_relabel.py
Added an edge-case test that supplies an invalid regex rule followed by a valid one, asserting the invalid rule is skipped without crashing and the valid rule still sets the expected target label.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 3.70% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
Description check ❓ Inconclusive No pull request description was provided by the author, making it impossible to assess whether it relates to the changeset or is off-topic. Add a description explaining the purpose, approach, and rationale for adding label rules to Robusta alerts.
✅ Passed checks (3 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly and concisely describes the main change: adding labels to Robusta alerts using subject information, which aligns with the primary features introduced (FindingLabelRule and label injection via customise_finding).
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch ROB-0000-bettson-add-label-to-robusta-alerts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3

🧹 Nitpick comments (1)
tests/test_customise_finding_relabel.py (1)

179-208: ⚡ Quick win

Add a malformed-regex regression test.

Coverage is solid; one high-value gap is a rule with invalid regex to ensure customise_finding skips the bad rule without crashing.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@tests/test_customise_finding_relabel.py` around lines 179 - 208, Add a test
that verifies customise_finding/FindingOverrides tolerate an invalid regex by
creating a FindingSubject (use _run or _make_event) and a rule where "regex" is
malformed (e.g. unmatched bracket), then call customise_finding or _run with
that rule and assert the function does not raise and the finding's labels remain
unchanged (e.g. existing "team" label stays the same or target_label is not
added); reference customise_finding, FindingOverrides, _run, _make_event and
FindingSubject to locate where to add the test and ensure the bad rule is
skipped rather than crashing.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@playbooks/robusta_playbooks/common_actions.py`:
- Around line 110-111: The current logging in customise_finding logs full
labels_to_inject which can leak sensitive metadata; change the call in the
customise_finding block so you do not log full label values—either downgrade to
logging.debug or log only the label keys (e.g., list(labels_to_inject.keys()))
before calling event.inject_finding_labels(labels_to_inject); keep the injection
via event.inject_finding_labels unchanged but ensure only non-sensitive key
names or a debug-level message is emitted.
- Around line 102-103: customise_finding currently calls
re.fullmatch(rule.regex, source_value) which will raise re.error for malformed
user regexes; wrap the re.fullmatch call in a try/except catching re.error, log
the invalid pattern and exception (including rule.regex and any identifying rule
id) using the existing logger, then continue to the next rule so the bad pattern
is skipped instead of crashing customise_finding.

In `@src/robusta/core/model/events.py`:
- Around line 158-161: The issue is that Finding uses a shared mutable default
FindingSubject which causes inject_finding_labels to mutate a shared labels
dict; fix by changing the Finding constructor signature (class Finding) to use
subject: Optional[FindingSubject] = None instead of a default instance, and
inside the constructor create a fresh FindingSubject() when subject is None
(assign self.subject = subject or FindingSubject()); keep inject_finding_labels
as-is but this ensures each Finding has its own subject.labels so .update()
won't bleed labels across Findings.

---

Nitpick comments:
In `@tests/test_customise_finding_relabel.py`:
- Around line 179-208: Add a test that verifies
customise_finding/FindingOverrides tolerate an invalid regex by creating a
FindingSubject (use _run or _make_event) and a rule where "regex" is malformed
(e.g. unmatched bracket), then call customise_finding or _run with that rule and
assert the function does not raise and the finding's labels remain unchanged
(e.g. existing "team" label stays the same or target_label is not added);
reference customise_finding, FindingOverrides, _run, _make_event and
FindingSubject to locate where to add the test and ensure the bad rule is
skipped rather than crashing.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: e57f4745-7ead-4c6f-b04e-e9ac2d6aa0d8

📥 Commits

Reviewing files that changed from the base of the PR and between 447c385 and 46c2a3f.

📒 Files selected for processing (3)
  • playbooks/robusta_playbooks/common_actions.py
  • src/robusta/core/model/events.py
  • tests/test_customise_finding_relabel.py

Comment thread playbooks/robusta_playbooks/common_actions.py Outdated
Comment thread playbooks/robusta_playbooks/common_actions.py Outdated
Comment thread src/robusta/core/model/events.py
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
src/robusta/core/reporting/base.py (1)

261-272: ⚡ Quick win

Type annotation doesn't reflect the accepted None value

The parameter is declared as subject: FindingSubject = FindingSubject(), but the new guard at lines 271-272 explicitly handles subject=None. This creates an invisible contract break: static type-checkers (mypy/pyright) will flag any call-site that passes subject=None as a type error, even though the runtime now handles it safely.

Combining the guard with an annotation update also resolves the mutable-default-argument TODO in one shot:

🛠️ Proposed fix
-    # TODO: this is bug-prone - see https://towardsdatascience.com/python-pitfall-mutable-default-arguments-9385e8265422
-    subject: FindingSubject = FindingSubject(),
+    subject: Optional[FindingSubject] = None,

The if subject is None: subject = FindingSubject() guard already in place is then the canonical place where the default is applied, fixing both the type mismatch and the mutable-default pitfall.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/robusta/core/reporting/base.py` around lines 261 - 272, Update the
subject parameter to accept None by changing its type to
Optional[FindingSubject] and make its default value None (i.e., subject:
Optional[FindingSubject] = None) so the existing guard "if subject is None:
subject = FindingSubject()" is authoritative; this also removes the
mutable-default issue—adjust any import/type hints as needed to reference
Optional and keep the runtime logic in the constructor (the parameter and the
guard in the function/method that declares subject and uses FindingSubject).
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@src/robusta/core/reporting/base.py`:
- Around line 261-272: Update the subject parameter to accept None by changing
its type to Optional[FindingSubject] and make its default value None (i.e.,
subject: Optional[FindingSubject] = None) so the existing guard "if subject is
None: subject = FindingSubject()" is authoritative; this also removes the
mutable-default issue—adjust any import/type hints as needed to reference
Optional and keep the runtime logic in the constructor (the parameter and the
guard in the function/method that declares subject and uses FindingSubject).

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: d75e73ba-4dc6-4a3a-b971-679b4f7dfb23

📥 Commits

Reviewing files that changed from the base of the PR and between 46c2a3f and 81a7207.

⛔ Files ignored due to path filters (1)
  • .claude/scheduled_tasks.lock is excluded by !**/*.lock
📒 Files selected for processing (3)
  • playbooks/robusta_playbooks/common_actions.py
  • src/robusta/core/reporting/base.py
  • tests/test_customise_finding_relabel.py
🚧 Files skipped from review as they are similar to previous changes (2)
  • playbooks/robusta_playbooks/common_actions.py
  • tests/test_customise_finding_relabel.py

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant