ART-21305: add BuildConfig for rpm-lockfile-prototype image#3035
Conversation
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
openshift-ci-robot
added
the
jira/valid-reference
|
@fgallott: This pull request references ART-18202 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Skipping CI for Draft Pull Request. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository: openshift-eng/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (4)
🚧 Files skipped from review as they are similar to previous changes (4)
WalkthroughThis PR adds a UBI9-based rpm-lockfile-prototype container image, an OpenShift BuildConfig and ImageStream targeting Changesrpm-lockfile-prototype image
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 11✅ Passed checks (11 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Switch from building the rpm-lockfile-prototype container locally to pulling the pre-built image from the art-cluster internal registry. The image is now built and served via BuildConfig in art-cd (PR openshift-eng#3035). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED
|
/lgtm |
fc001f2 to
f949b57
Compare
f949b57 to
6ec4f41
Compare
openshift-ci
Bot
removed
the
do-not-merge/work-in-progress
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (1)
art-cluster/pipelines/config/argocd/project/art-cd/common/image/rpm_lockfile_build.yaml (1)
9-9:⚠️ Potential issue | 🟠 Major | ⚡ Quick win
spec.source.dockerfileis being used as a path, not inline content.Line 9 should not point to a file path; this field is for literal Dockerfile text and can conflict with
dockerfilePathon Line 16. Keep onlydockerStrategy.dockerfilePath.In OpenShift BuildConfig (build.openshift.io/v1), what is the exact contract of `spec.source.dockerfile` versus `spec.strategy.dockerStrategy.dockerfilePath`, and which one takes precedence when both are set?Proposed change
spec: source: - dockerfile: art-cluster/pipelines/data/project/art-cd/image/Containerfile.rpm_lockfile_prototype git: ref: main uri: https://github.com/openshift-eng/art-tools type: GitAlso applies to: 16-16
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@art-cluster/pipelines/config/argocd/project/art-cd/common/image/rpm_lockfile_build.yaml` at line 9, spec.source.dockerfile currently contains a filesystem path (it should be literal Dockerfile text), so remove that line and rely solely on spec.strategy.dockerStrategy.dockerfilePath for pointing to the Containerfile; alternatively, if you intended inline Dockerfile content, replace spec.source.dockerfile's value with the actual Dockerfile text and remove spec.strategy.dockerStrategy.dockerfilePath. Locate the keys spec.source.dockerfile and spec.strategy.dockerStrategy.dockerfilePath in rpm_lockfile_build.yaml and apply one of the two fixes so they are not both set (dockerfilePath wins if both are present).
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@art-cluster/pipelines/config/argocd/project/art-cd/common/image/rpm_lockfile_build.yaml`:
- Around line 11-13: The manifest uses a mutable source ref ("ref: main") while
producing an immutable output tag ("rpm-lockfile-prototype:v0.22.0"), which
allows future changes on main to overwrite that tag; change the source ref to a
release commit or branch that corresponds to v0.22.0 (e.g., the git tag/commit
SHA for v0.22.0) or else make the output tag mutable (e.g., include
build-specific suffix or use a float tag) so that rpm-lockfile-prototype:v0.22.0
is not silently overwritten; update the "ref" field (currently "main") to the
pinned release reference or modify the output tag string to a mutable form.
---
Duplicate comments:
In
`@art-cluster/pipelines/config/argocd/project/art-cd/common/image/rpm_lockfile_build.yaml`:
- Line 9: spec.source.dockerfile currently contains a filesystem path (it should
be literal Dockerfile text), so remove that line and rely solely on
spec.strategy.dockerStrategy.dockerfilePath for pointing to the Containerfile;
alternatively, if you intended inline Dockerfile content, replace
spec.source.dockerfile's value with the actual Dockerfile text and remove
spec.strategy.dockerStrategy.dockerfilePath. Locate the keys
spec.source.dockerfile and spec.strategy.dockerStrategy.dockerfilePath in
rpm_lockfile_build.yaml and apply one of the two fixes so they are not both set
(dockerfilePath wins if both are present).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: 2cf86b34-c89c-4fec-abff-0b7407d4c2cb
📒 Files selected for processing (4)
art-cluster/pipelines/config/argocd/project/art-cd/common/image/rpm_lockfile_build.yamlart-cluster/pipelines/config/argocd/project/art-cd/common/image/rpm_lockfile_image.yamlart-cluster/pipelines/config/argocd/project/art-cd/common/image/rpm_lockfile_pull_access.yamlart-cluster/pipelines/data/project/art-cd/image/Containerfile.rpm_lockfile_prototype
106e7b3 to
73035aa
Compare
fgallott
changed the title
|
@fgallott: This pull request references ART-21305 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
Add ImageStream, BuildConfig, and ServiceAccount+RoleBinding to build and serve the rpm-lockfile-prototype container image from art-cluster. - Containerfile: Fedora base with python3-dnf, skopeo, RH IT CA certs - BuildConfig outputs to ImageStreamTag rpm-lockfile-prototype:v0.23.0 - ServiceAccount rpm-lockfile-image-puller for Jenkins pull access After deployment, generate a pull token: oc create token rpm-lockfile-image-puller -n art-cd --duration=8760h rh-pre-commit.version: 2.4.0 rh-pre-commit.check-secrets: ENABLED
73035aa to
15e257b
Compare
|
@fgallott: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
| output: | ||
| to: | ||
| kind: ImageStreamTag | ||
| name: rpm-lockfile-prototype:v0.25.0 |
There was a problem hiding this comment.
We also have ARG GIT_REF=tags/v0.25.0 in the Containerfile, and presumably also a similar tag on the consumption side. Could we have that tag as a single config, that gets passed as arg and as tag?
|
/lgtm |
openshift-ci
Bot
added
the
do-not-merge/hold
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: joepvd The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
|
mmm BuildConfig doesn't support variable interpolation in output.to.name, so it's not that easy to do /unhold |
openshift-ci
Bot
removed
the
do-not-merge/hold
8d315ea
into
openshift-eng:main
Switch from building the rpm-lockfile-prototype container locally to pulling the pre-built image from the art-cluster internal registry. The image is now built and served via BuildConfig in art-cd (PR openshift-eng#3035). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED
4 participants
Summary
Add art-cluster infrastructure to build and serve the
rpm-lockfile-prototypecontainer image from theart-cdnamespace.rpm-lockfile-prototyperpm-lockfile-image-puller) for Jenkins pull accessart-cluster/pipelines/data/project/art-cd/image/Containerfile.rpm_lockfile_prototypeThis is part of the effort to containerize rpm-lockfile-prototype execution (see #3031), removing the dependency on host-installed python3-dnf.
Post-merge steps
After ArgoCD deploys these resources to
art-cd:oc create token rpm-lockfile-image-puller -n art-cd --duration=8760h
podman login default-route-openshift-image-registry.apps.artc2023.pc3z.p1.openshiftapps.com
-u rpm-lockfile-image-puller -p
Summary by CodeRabbit
BuildConfigforrpm-lockfile-prototypeto build and publish a versioned image to anImageStreamTag.ImageStreamforrpm-lockfile-prototypeand introduced a new container build definition that installs required tooling and the prototype tool.rpm-lockfile-image-puller(service account + role binding) to allow controlled image pulls.