fix: detect stale bundles when operand images change in LP assemblies

When an operand image is swapped in an LP assembly, the existing bundle
still references the old image. The pipeline was reusing these stale
bundles because it only checked operator NVR existence, not operand
content. Now find-builds returns each bundle's operand_nvrs, and the
pipeline validates them against the assembly's pins before reusing.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

rh-pre-commit.version: 2.3.2
rh-pre-commit.check-secrets: ENABLED

Author: ashwindasr

elliott/elliottlib/cli/find_builds_cli.py

@@ -982,5 +982,8 @@ async def find_builds_konflux_all_types(runtime: Runtime, include_shipped: bool
         'olm_builds': sorted([b.nvr for b in olm_records]),
         'olm_builds_not_found': sorted([b.nvr for b in olm_records_not_found]),
         'olm_operator_nvrs': sorted([b.nvr for b in operator_builds]),
+        'olm_builds_detail': {
+            b.nvr: {'operator_nvr': b.operator_nvr, 'operand_nvrs': b.operand_nvrs or []} for b in olm_records
+        },
     }
     return builds_tuple

pyartcd/pyartcd/pipelines/prepare_release_lp.py

@@ -273,6 +273,7 @@ async def _find_existing_bundles(self) -> Dict[str, List[str]]:
             "metadata": out.get("olm_builds", []),
             "olm_builds_not_found": out.get("olm_builds_not_found", []),
             "olm_operator_nvrs": out.get("olm_operator_nvrs", []),
+            "olm_builds_detail": out.get("olm_builds_detail", {}),
         }
         self._logger.info(
             "Found %d existing bundle NVRs; %d operators still need bundles",
@@ -326,6 +327,37 @@ async def _trigger_bundle_build(self, operand_nvrs: List[str]) -> Tuple[List[str
                 self._logger.info("Skipping %d operator(s) not pinned in assembly: %s", len(skipped), skipped)
             missing_operator_nvrs = scoped
 
+        # Detect stale bundles whose operands no longer match the assembly pins.
+        # When an operand image is swapped in the assembly, existing bundles
+        # still reference the old image and must be rebuilt.
+        builds_detail = existing.get("olm_builds_detail", {})
+        if operand_nvrs and existing_bundle_nvrs and builds_detail:
+            pinned_by_name = {parse_nvr(nvr)['name']: nvr for nvr in operand_nvrs}
+            stale_bundles = []
+            for bundle_nvr in existing_bundle_nvrs:
+                detail = builds_detail.get(bundle_nvr, {})
+                for bop_nvr in detail.get('operand_nvrs', []):
+                    bop_name = parse_nvr(bop_nvr)['name']
+                    if bop_name in pinned_by_name and pinned_by_name[bop_name] != bop_nvr:
+                        self._logger.info(
+                            "Bundle %s is stale: references %s but assembly pins %s",
+                            bundle_nvr,
+                            bop_nvr,
+                            pinned_by_name[bop_name],
+                        )
+                        stale_bundles.append(bundle_nvr)
+                        operator_nvr = detail.get('operator_nvr')
+                        if operator_nvr and operator_nvr not in missing_operator_nvrs:
+                            missing_operator_nvrs.append(operator_nvr)
+                        break
+            if stale_bundles:
+                existing_bundle_nvrs = [nvr for nvr in existing_bundle_nvrs if nvr not in stale_bundles]
+                self._logger.info(
+                    "Removed %d stale bundle(s); %d operator(s) need fresh bundles",
+                    len(stale_bundles),
+                    len(missing_operator_nvrs),
+                )
+
         if existing_bundle_nvrs:
             self._logger.info(
                 "Reusing %d existing bundle NVRs: %s",

pyartcd/tests/pipelines/test_prepare_release_lp.py

@@ -347,6 +347,80 @@ def test_all_operators_filtered_skips_build(self, mock_find):
         self.assertEqual(bundle_nvrs, ["existing-bundle-1"])
         self.assertEqual(operator_nvrs, [])
 
+    @patch.object(PrepareReleaseLPPipeline, '_find_existing_bundles', new_callable=AsyncMock)
+    @patch('pyartcd.pipelines.prepare_release_lp.exectools.cmd_gather_async', new_callable=AsyncMock)
+    def test_stale_bundle_triggers_rebuild(self, mock_cmd, mock_find):
+        """Bundles referencing old operand images must be rebuilt when the assembly pins a new version."""
+        mock_find.return_value = {
+            "metadata": [
+                "loki-rhel9-operator-metadata-container-6.0.15-1.assembly.stream.el9-1",
+            ],
+            "olm_builds_not_found": [],
+            "olm_operator_nvrs": [
+                "loki-rhel9-operator-container-6.0.15-1.assembly.stream.el9",
+            ],
+            "olm_builds_detail": {
+                "loki-rhel9-operator-metadata-container-6.0.15-1.assembly.stream.el9-1": {
+                    "operator_nvr": "loki-rhel9-operator-container-6.0.15-1.assembly.stream.el9",
+                    "operand_nvrs": [
+                        "logging-loki-rhel9-container-6.0.15-OLD.assembly.stream.el9",
+                    ],
+                },
+            },
+        }
+        mock_cmd.return_value = (
+            0,
+            json.dumps({"nvrs": ["loki-rhel9-operator-metadata-container-6.0.15-2"], "errors": []}),
+            "",
+        )
+
+        pipeline = self._make_pipeline()
+        operand_nvrs = [
+            "loki-rhel9-operator-container-6.0.15-1.assembly.stream.el9",
+            "logging-loki-rhel9-container-6.0.15-NEW.assembly.stream.el9",
+        ]
+        bundle_nvrs, operator_nvrs = asyncio.run(pipeline._trigger_bundle_build(operand_nvrs))
+
+        # The stale bundle should have been removed and a rebuild triggered
+        mock_cmd.assert_called_once()
+        cmd = mock_cmd.call_args[0][0]
+        self.assertIn("loki-rhel9-operator-container-6.0.15-1.assembly.stream.el9", cmd)
+        self.assertIn("loki-rhel9-operator-metadata-container-6.0.15-2", bundle_nvrs)
+        # The old stale bundle should not be in the result
+        self.assertNotIn("loki-rhel9-operator-metadata-container-6.0.15-1.assembly.stream.el9-1", bundle_nvrs)
+
+    @patch.object(PrepareReleaseLPPipeline, '_find_existing_bundles', new_callable=AsyncMock)
+    def test_matching_operands_reuses_bundle(self, mock_find):
+        """Bundles whose operands match the assembly pins should be reused."""
+        mock_find.return_value = {
+            "metadata": [
+                "loki-rhel9-operator-metadata-container-6.0.15-1.assembly.stream.el9-1",
+            ],
+            "olm_builds_not_found": [],
+            "olm_operator_nvrs": [
+                "loki-rhel9-operator-container-6.0.15-1.assembly.stream.el9",
+            ],
+            "olm_builds_detail": {
+                "loki-rhel9-operator-metadata-container-6.0.15-1.assembly.stream.el9-1": {
+                    "operator_nvr": "loki-rhel9-operator-container-6.0.15-1.assembly.stream.el9",
+                    "operand_nvrs": [
+                        "logging-loki-rhel9-container-6.0.15-SAME.assembly.stream.el9",
+                    ],
+                },
+            },
+        }
+
+        pipeline = self._make_pipeline()
+        operand_nvrs = [
+            "loki-rhel9-operator-container-6.0.15-1.assembly.stream.el9",
+            "logging-loki-rhel9-container-6.0.15-SAME.assembly.stream.el9",
+        ]
+        bundle_nvrs, operator_nvrs = asyncio.run(pipeline._trigger_bundle_build(operand_nvrs))
+
+        # The bundle should be reused since operands match
+        self.assertEqual(bundle_nvrs, ["loki-rhel9-operator-metadata-container-6.0.15-1.assembly.stream.el9-1"])
+        self.assertEqual(operator_nvrs, ["loki-rhel9-operator-container-6.0.15-1.assembly.stream.el9"])
+
 
 class TestPrepareReleaseLPRun(unittest.TestCase):
     """Integration-level tests for the run() method with mocked externals."""