RSPEED-3082: add build-nudge-files annotation for cross-repo nudging

[Lifto]

What

Add build.appstudio.openshift.io/build-nudge-files annotation to the push PipelineRun, targeting openshift/lightspeed-stack.yml in lscore-deploy.

Why

The Konflux nudge controller's default file pattern (.*Dockerfile.*, .*.yaml, .*Containerfile.*) only matches .yaml files. Since lscore-deploy uses openshift/lightspeed-stack.yml (note: .yml), the nudge controller silently skips it — no MR is opened to bump the image digest.

This annotation explicitly tells the nudge controller which file to scan, bypassing the default pattern entirely.

Tickets

• RSPEED-3082

Testing

Once merged, the push pipeline triggered by this merge will include the annotation. The nudge controller should then open an MR in lscore-deploy updating the image digest in openshift/lightspeed-stack.yml.

Summary by CodeRabbit

• Chores
  • Added a new metadata annotation to the build pipeline configuration.
  • Updated pipeline metadata to include a reference to a stack configuration file.
  • Minor metadata-only change; no functional behavior changes expected.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: b0d075c5-6020-419f-9218-1380c7eb1f51

📥 Commits

Reviewing files that changed from the base of the PR and between 60a4348 and a84fe82.

📒 Files selected for processing (1)

• .tekton/lightspeed-stack-push.yaml

📜 Recent review details

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (11)

• GitHub Check: E2E: server mode / ci / group 3
• GitHub Check: E2E: server mode / ci / group 1
• GitHub Check: E2E: server mode / ci / group 2
• GitHub Check: E2E: library mode / ci / group 2
• GitHub Check: E2E: library mode / ci / group 3
• GitHub Check: E2E: library mode / ci / group 1
• GitHub Check: Pylinter
• GitHub Check: build-pr
• GitHub Check: unit_tests (3.13)
• GitHub Check: E2E Tests for Lightspeed Evaluation job
• GitHub Check: unit_tests (3.12)

🔇 Additional comments (1)

.tekton/lightspeed-stack-push.yaml (1)

5-8: LGTM!

---

Walkthrough

Added a build-nudge-files annotation to the lightspeed-stack-push PipelineRun configuration file, specifying openshift/lightspeed-stack.yml as the file that triggers builds when modified.

Changes

PipelineRun Build Nudge Configuration

Layer / File(s)	Summary
PipelineRun metadata annotations .tekton/lightspeed-stack-push.yaml	Added build.appstudio.openshift.io/build-nudge-files: "openshift/lightspeed-stack.yml" annotation to the PipelineRun metadata to configure build triggering behavior when the manifest file changes.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The pull request title directly and clearly summarizes the main change: adding a build-nudge-files annotation for cross-repo nudging, which matches the core modification in the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

✨ Simplify code

• Create PR with simplified code

Warning

Review ran into problems

🔥 Problems

Stopped waiting for pipeline failures after 30000ms. One of your pipelines takes longer than our 30000ms fetch window to run, so review may not consider pipeline-failure results for inline comments if any failures occurred after the fetch window. Increase the timeout if you want to wait longer or run a @coderabbit review after the pipeline has finished.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[samdoran]

Wouldn't it be more straightforward to move the deployment config from lscore-deploy to this repo? Then we would be able to auto-deploy images to stage once changes are merged to this repo and the images are built.

Adding a nudge to this repo that references a file that doesn't exist anywhere in this repo may be confusing to future contributors.

[Lifto]

Wouldn't it be more straightforward to move the deployment config from lscore-deploy to this repo? Then we would be able to auto-deploy images to stage once changes are merged to this repo and the images are built.

Adding a nudge to this repo that references a file that doesn't exist anywhere in this repo may be confusing to future contributors.

Sam, thanks for your comment. Regarding the confusion I added a comment to the yml.

Some reasoning for why I want to do it this way:

• rls-backend is a separate project from lightspeed-stack
• lscore-deploy is the canonical home for rls-backend's deployment config
  • I need independent control over rls-backend's deploy because I'm responsible for rls-backend (or rhel-lightspeed team is, anyway.)
  • I'm not a maintainer on lightspeed-stack. Moving the template here puts deployment config behind a review gate I don't control
• Cross-repo nudging is not a hack, it's a proper Konflux feature for such situations.
• RSPEED-3082 considers such colocation "Alternative: Option A" and chose cross-repo nudging instead

[Lifto]

@samdoran There may be another option that lets us remove this change. Konflux has a default pattern that looks for files to do the digest replacement in, but Konflux's default file patterns only match .yaml, not .yml. We can override that pattern via a namespace ConfigMap in lightspeed-core-tenant so it also picks up .yml files. In that case we would not need this change, the cross-repo wiring would live entirely in Konflux cluster config. Do you think that's a better way?

(I have not tested that, btw. Claude tells me we have this option.)

[tisnik]

LGTM

[tisnik]

/ok-to-run

[tisnik]

/ok-to-test

[samdoran]

lscore-deploy is the canonical home for rls-backend's deployment config

That's the fundamental problem: app-interface expects the deployment config to live in the same repo as the code being deployed. That allows the container image tag to match the deployment config hash for automatic deployment. Fighting that design, limiting as it is, adds complexity.

I agree it would be odd to have our deployment config here, but that arrangement would align best with what app-interface recommends.

I need independent control over rls-backend's deploy because I'm responsible for rls-backend (or rhel-lightspeed team is, anyway.)
I'm not a maintainer on lightspeed-stack. Moving the template here puts deployment config behind a review gate I don't control

These two things are easily solved with a codeowners file.

Cross-repo nudging is not a hack, it's a proper Konflux feature for such situations.

Nudging is a very useful feature. This is the incorrect use of nudging. While this change does seem to work, it crosses many boundaries that were not meant to be crossed.

Nudging is meant for updating images used by components of the same application. A relationship is defined between the components of an application in Konflux within the same tenant. If component B uses component A in a FROM clause and component A changes, then component B needs to be rebuilt.

The simplest solution is to move the config from lscore-deploy to this repo.