disconnected-readiness-scorer

Disconnected Readiness Scorer

Score a repository's readiness for deployment in disconnected / air-gapped OpenShift environments.

Why this exists

Disconnected and air-gapped deployments are a core requirement for many Red Hat OpenShift AI customers — particularly in government, financial services, and regulated industries where clusters have no outbound internet access. Analysis of ~96 open JIRA issues across RHAIRFE, RHAISTRAT, and RHOAIENG revealed that 75% of disconnected failures fall into four patterns detectable by static analysis before code is merged:

Pattern	% of Issues	Rule
Missing images from manifests	~30%	image-manifest-complete
Hardcoded external dependencies	~25%	python-imports
Image tags instead of digests	~10%	no-image-tags
Runtime external URL calls	~10%	no-runtime-egress

Today, none of these are checked automatically — failures are only discovered during manual disconnected testing, often weeks or months after the breaking change was merged. This scanner catches them at PR time.

Quick start

As a Claude Code skill

/disconnected-score

Run from the root of any RHOAI component repository. The skill definition is in SKILL.md.

As a CLI tool

python3 main.py /path/to/target/repo                        # all default rules
python3 main.py /path/to/target/repo --rules csv,tags        # subset of rules
python3 main.py /path/to/target/repo --report json           # JSON output
python3 main.py /path/to/target/repo --operator-path /tmp/opendatahub-operator  # pre-cloned operator
python3 main.py /path/to/target/repo --config /path/to/config.yaml              # custom central config

Exit code is 0 for READY, 1 for NOT READY.

Individual rules

Each rule is a standalone script:

python3 rules/image_manifest_complete.py /path/to/target/repo
python3 rules/params_env.py /path/to/target/repo
python3 rules/no_image_tags.py /path/to/target/repo
python3 rules/no_runtime_egress.py /path/to/target/repo
python3 rules/python_imports.py /path/to/target/repo
python3 rules/operator_manifest.py /path/to/opendatahub-operator

All rules output JSON to stdout with rule, passed, and findings fields.

Output

Disconnected Readiness Score: NOT READY

  FAIL     image-manifest-complete   2 blocker(s)
  PASS     no-image-tags             All checks passed
  PASS     no-runtime-egress         All checks passed
  PASS     python-imports-bundled    All checks passed

Blockers: 2 | Passed: 3

Reports are also generated as markdown (default) or JSON (--report json). Write to a file with --output report.md.

Rules

image-manifest-complete (alias: csv)

Checks that every container image referenced in code is accounted for in the disconnected manifest. Auto-detects whether the repo uses RELATED_IMAGE_* env vars (opendatahub-operator pattern) or static CSV relatedImages.

Files scanned: .go, .py, .yaml, .yml, .json, .sh (git-tracked only). Comments (//, #) are skipped. Directories managed by params.env + kustomize are skipped (covered by params-env-wiring).

Severity logic:

Condition	Severity
Image ref uses a RELATED_IMAGE var not in operator manifest	blocker
Hardcoded image with no RELATED_IMAGE_* wiring	blocker
Image near a related env var (same file/sibling)	info
Manifest vars not referenced in repo	info

When the env var pattern is detected, the orchestrator clones the opendatahub-operator and cross-references against the authoritative manifest.

params-env-wiring (alias: params_env)

Validates repos using the params.env + kustomize pattern. Checks the full wiring chain: params.env → kustomize configMap → rendered manifest → Go os.Getenv. Requires kustomize binary on PATH.

When manifest_source is available (from operator manifest mapping), uses the operator's kustomize folders as the source of truth: copies the entire manifest source folder to a temp dir, replaces all params.env image values with probe sentinels, then builds every kustomization.yaml in the copy. Any non-sentinel image in the rendered output is hardcoded and not wired through params.env. Falls back to discover_overlays() (scanning the repo for co-located params.env + kustomization.yaml dirs) when no manifest source mapping is available.

Files scanned: params.env, kustomize overlays, .go files (git-tracked only)

Severity logic: