Skip to content

Refactor Dockerfile and analysis script to remove Node.js dependency for Claude CLI installation #2101

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
kaovilai wants to merge 1 commit into
base: oadp-dev
Choose a base branch
from
+12 −14
Open

Refactor Dockerfile and analysis script to remove Node.js dependency for Claude CLI installation #2101

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 5 additions & 6 deletions build/ci-Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,12 +14,11 @@ RUN curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/s
chmod +x kubectl && \
mv kubectl /usr/local/bin/

# Install Node.js and Claude CLI
# Using NodeSource setup script for RHEL-based images
RUN curl -fsSL https://rpm.nodesource.com/setup_20.x | bash - && \
dnf install -y nodejs && \
npm install -g @anthropic-ai/claude-code && \
dnf clean all
# Install Claude CLI (native binary, no Node.js dependency)
# Installer places binary at ~/.local/bin/claude
RUN curl -fsSL https://claude.ai/install.sh | bash && \
Copy link

Copilot AI Feb 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The RUN curl -fsSL https://claude.ai/install.sh | bash line executes a remote installation script as root during the CI image build without any integrity or authenticity verification beyond HTTPS. If an attacker compromises claude.ai or this script’s delivery path, they can run arbitrary code inside your build image and, transitively, any CI jobs that use it, leading to a supply chain compromise. Prefer installing the Claude CLI from a package or pinned artifact with a verified checksum or signature instead of piping a mutable remote script directly to bash.

Copilot uses AI. Check for mistakes.
ln -sf ~/.local/bin/claude /usr/local/bin/claude && \
claude --version

# Clone openshift/velero source code for failure analysis
# Uses oadp-dev branch to match OADP operator development
Expand Down
13 changes: 6 additions & 7 deletions docs/design/claude-prow-failure-analysis_design.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,12 +63,11 @@ RUN curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/s
chmod +x kubectl && \
mv kubectl /usr/local/bin/

# Install Node.js and Claude CLI
# Using NodeSource setup script for RHEL-based images
RUN curl -fsSL https://rpm.nodesource.com/setup_20.x | bash - && \
dnf install -y nodejs && \
npm install -g @anthropic-ai/claude-code && \
dnf clean all
# Install Claude CLI (native binary, no Node.js dependency)
# Installer places binary at ~/.local/bin/claude
RUN curl -fsSL https://claude.ai/install.sh | bash && \
ln -sf ~/.local/bin/claude /usr/local/bin/claude && \
claude --version

RUN go mod download && \
mkdir -p $(go env GOCACHE) && \
Expand Down Expand Up @@ -332,7 +331,7 @@ preprocess_large_artifacts() {
# Check for Claude CLI availability
if ! command -v claude &> /dev/null; then
echo "⚠ Claude CLI not found in PATH"
echo "Skipping Claude analysis (install with: npm install -g @anthropic-ai/claude-code)"
echo "Skipping Claude analysis (install with: curl -fsSL https://claude.ai/install.sh | bash)"
exit $EXIT_CODE
fi

Expand Down
2 changes: 1 addition & 1 deletion tests/e2e/scripts/analyze_failures.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -171,7 +171,7 @@ preprocess_large_artifacts() {
# Check for Claude CLI availability
if ! command -v claude &> /dev/null; then
echo "⚠ Claude CLI not found in PATH"
echo "Skipping Claude analysis (install with: npm install -g @anthropic-ai/claude-code)"
echo "Skipping Claude analysis (install with: curl -fsSL https://claude.ai/install.sh | bash)"
exit $EXIT_CODE
fi

Expand Down