GeezerVison

Summary by CodeRabbit

• Bug Fixes
  • Log checks now distinguish clean scans, detected blocked patterns, and scan errors through separate exit statuses. Errors from either scanning stage are reported as scan failures, while a clean scan remains distinct from a scan that finds a blocked pattern. This makes CI log-check results clearer and helps avoid confusing scanning problems with log findings.

The log-check script now documents exit statuses for clean scans, offending patterns, and scan errors. It checks both grep statuses and handles scan errors separately from clean scans.

Changes: Log scan

Layer / File(s)	Summary
Document and handle scan statuses scripts/ci/logcheck/check.sh	The usage comment documents statuses 0, 1, and 2. The scan pipeline checks both grep statuses and exits with 2 if either indicates a scan error. The outer failure branch propagates statuses other than 1; status 1 leads to the clean exit.

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Bug fix

Merge Risk: Minimal · up to ffb99

The change makes the CI log checker fail on grep or input errors instead of treating them as clean logs. Normal clean and suspicious results are unchanged. No actionable merge-blocking risk remains.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title "fix(ci): fail log checks when grep errors" matches the main change. The PR updates scripts/ci/logcheck/check.sh so that grep failures in either pipeline stage exit with status 2 instead of …
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description check		The description explains the problem (an allowlist grep error can leave the blocklist grep with no input, so the checker exits 0), the fix (inspect both pipeline exit statuses and return 2 for scan er…

Full details: Title check

Explanation

The title "fix(ci): fail log checks when grep errors" matches the main change. The PR updates scripts/ci/logcheck/check.sh so that grep failures in either pipeline stage exit with status 2 instead of being treated as clean logs. The title is short, specific, and states the primary fix.

Full details: Description check

Explanation

The description explains the problem (an allowlist grep error can leave the blocklist grep with no input, so the checker exits 0), the fix (inspect both pipeline exit statuses and return 2 for scan errors), the merge dependency on #24037, and gives a reproducible local validation example with before and after output. The template's required sections are present. Several template checkboxes are unchecked: CI results were not marked as inspected, and no unit, e2e, regression, compatibility, or modified tests are marked. The author says CI depends on #24037, and the template allows skipping tests with an explanation. The description does not clearly explain why no automated test was added for a shell checker, so this is a minor gap.

@@            Coverage Diff             @@
##           master   #24038      +/-   ##
==========================================
+ Coverage   52.69%   52.86%   +0.16%     
==========================================
  Files        2815     2755      -60     
  Lines      177457   175277    -2180     
==========================================
- Hits        93512    92656     -856     
+ Misses      75770    74534    -1236     
+ Partials     8175     8087      -88     

Flags with carried forward coverage won't be shown. Click here to find out more.

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.