Skip to content

Commit 9d793be

Browse files
aredenba-rhcursoragent
aredenba-rh
and
cursoragent
authored
revert: retarget Konflux deploy-tag back to hp-fleet-gitops (#784)
Reverts commit 2d76a14 (fix(ci): retarget Konflux deploy-tag to fleet-apps on GitLab, #780). That change was correct at the time (2026-06-30): ArgoCD read fleet-apps then. hp-gitops-tenants PR #9 (2026-07-01) repointed ArgoCD's kartograph-stage source at hp-fleet-gitops (GitHub) instead, so the push pipelines' deploy-tag finally task needs to target hp-fleet-gitops again — as it did before #780, via the update-and-push + create-pull-request tasks (plain `git push` + a `curl`-based GitHub PR creation step using the same `.netrc` staged for git auth, since GitHub has no GitLab-style `git push -o merge_request.*` equivalent). Confirmed needed: both kartograph-api-on-push and kartograph-dev-ui-on-push failed at update-deploy-tag on the first push to main after merging #782, because it was still trying (and failing) to push to the GitLab fleet-apps repo. Requires the kartograph-hp-fleet-gitops-auth secret (GitHub PAT with repo + pull_request scope) to exist in the kartograph-tenant Konflux namespace — same requirement as before #780, when this last worked. Co-authored-by: Cursor <cursoragent@cursor.com>
1 parent ee1bd5a commit 9d793be

6 files changed

Lines changed: 284 additions & 83 deletions

‎.tekton/kartograph-agent-runtime-push.yaml‎

Lines changed: 70 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -615,9 +615,9 @@ spec:
615615
value: $(params.git-url)
616616
workspaces:
617617
- name: basic-auth
618-
workspace: fleet-apps-auth
618+
workspace: hp-fleet-gitops-auth
619619
- name: netrc
620-
workspace: fleet-apps-auth
620+
workspace: hp-fleet-gitops-auth
621621
taskSpec:
622622
params:
623623
- name: COMMIT_SHA
@@ -658,8 +658,8 @@ spec:
658658
mkdir -p "$HOME"
659659
660660
if [ ! -f "${WORKSPACE_BASIC_AUTH_PATH}/.git-credentials" ] && [ ! -f "${WORKSPACE_NETRC_PATH}/.netrc" ]; then
661-
echo "ERROR: Secret kartograph-fleet-apps-auth is missing or empty."
662-
echo "Apply .tekton/kartograph-fleet-apps-auth.secret.example.yaml in kartograph-tenant."
661+
echo "ERROR: Secret kartograph-hp-fleet-gitops-auth is missing or empty."
662+
echo "Apply .tekton/kartograph-hp-fleet-gitops-auth.secret.example.yaml in kartograph-tenant."
663663
exit 1
664664
fi
665665
@@ -677,9 +677,8 @@ spec:
677677
678678
SHORT_SHA="${COMMIT_SHA:0:12}"
679679
BRANCH="konflux/deploy-tag-${DEPLOY_COMPONENT}-${SHORT_SHA}"
680-
FLEET_APPS_REPO="https://gitlab.cee.redhat.com/hybrid-platforms-gitops/tenant-apps/fleet-apps.git"
681680
682-
git clone --depth 1 --branch main "${FLEET_APPS_REPO}" /tmp/repo
681+
git clone --depth 1 --branch main "https://github.com/openshift-online/hp-fleet-gitops" /tmp/repo
683682
cd /tmp/repo
684683
685684
FILE="apps/kartograph/overlays/stage/kustomization.yaml"
@@ -709,13 +708,70 @@ spec:
709708
710709
git checkout -b "$BRANCH"
711710
git commit -m "chore(deploy): update ${DEPLOY_COMPONENT} stage image tag to ${SHORT_SHA}"
712-
git push -u origin "$BRANCH" \
713-
-o merge_request.create \
714-
-o merge_request.target=main \
715-
-o "merge_request.title=chore(deploy): update ${DEPLOY_COMPONENT} stage image tag to ${SHORT_SHA}" \
716-
-o "merge_request.description=Auto-generated by Konflux push pipeline. Updates newTag for ${IMAGE_SELECTOR} to ${COMMIT_SHA}."
717-
echo "Merge request created for branch ${BRANCH}"
711+
git push origin "$BRANCH"
718712
713+
mkdir -p /tekton/run
714+
printf '%s\n' "$BRANCH" > /tekton/run/deploy-branch
715+
printf '%s\n' "$COMMIT_SHA" > /tekton/run/commit-sha
716+
printf '%s\n' "$DEPLOY_COMPONENT" > /tekton/run/deploy-component
717+
printf '%s\n' "$SHORT_SHA" > /tekton/run/short-sha
718+
- name: create-pull-request
719+
image: docker.io/curlimages/curl:8.12.1@sha256:94e9e444bcba979c2ea12e27ae39bee4cd10bc7041a472c4727a558e213744e6
720+
env:
721+
- name: WORKSPACE_NETRC_PATH
722+
value: /workspace/netrc
723+
script: |
724+
#!/bin/sh
725+
set -eu
726+
727+
if [ ! -f /tekton/run/deploy-branch ]; then
728+
echo "No deploy branch metadata, skipping PR creation"
729+
exit 0
730+
fi
731+
732+
BRANCH=$(cat /tekton/run/deploy-branch)
733+
COMMIT_SHA=$(cat /tekton/run/commit-sha)
734+
DEPLOY_COMPONENT=$(cat /tekton/run/deploy-component)
735+
SHORT_SHA=$(cat /tekton/run/short-sha)
736+
REPO="openshift-online/hp-fleet-gitops"
737+
738+
export HOME=/tekton/home
739+
mkdir -p "$HOME"
740+
if [ ! -f "${WORKSPACE_NETRC_PATH}/.netrc" ]; then
741+
echo "WARNING: netrc not available, PR must be created manually"
742+
echo "Branch pushed: $BRANCH"
743+
exit 0
744+
fi
745+
cp "${WORKSPACE_NETRC_PATH}/.netrc" "$HOME/.netrc"
746+
chmod 600 "$HOME/.netrc"
747+
748+
PAYLOAD=$(mktemp)
749+
chmod 600 "$PAYLOAD"
750+
printf '{"title":"chore(deploy): update %s stage image tag to %s","head":"%s","base":"main","body":"Auto-generated by Konflux push pipeline.\n\nUpdates `newTag` in stage kustomization to `%s`."}' \
751+
"$DEPLOY_COMPONENT" "$SHORT_SHA" "$BRANCH" "$COMMIT_SHA" > "$PAYLOAD"
752+
753+
PR_RESPONSE=$(curl -sS --netrc \
754+
-H "Content-Type: application/json" \
755+
-d @"$PAYLOAD" \
756+
"https://api.github.com/repos/${REPO}/pulls") || true
757+
rm -f "$PAYLOAD"
758+
759+
PR_URL=$(echo "$PR_RESPONSE" | grep -o '"html_url":"[^"]*"' | head -1 | cut -d'"' -f4)
760+
echo "PR created: ${PR_URL:-none}"
761+
762+
PR_NODE_ID=$(echo "$PR_RESPONSE" | grep -o '"node_id":"[^"]*"' | head -1 | cut -d'"' -f4)
763+
if [ -n "$PR_NODE_ID" ]; then
764+
GRAPHQL_PAYLOAD=$(mktemp)
765+
chmod 600 "$GRAPHQL_PAYLOAD"
766+
printf '{"query":"mutation { enablePullRequestAutoMerge(input: { pullRequestId: \\"%s\\", mergeMethod: SQUASH }) { pullRequest { autoMergeRequest { enabledAt } } } }"}' \
767+
"$PR_NODE_ID" > "$GRAPHQL_PAYLOAD"
768+
curl -sS --netrc \
769+
-H "Content-Type: application/json" \
770+
-d @"$GRAPHQL_PAYLOAD" \
771+
"https://api.github.com/graphql" > /dev/null 2>&1 || true
772+
rm -f "$GRAPHQL_PAYLOAD"
773+
echo "Auto-merge enabled"
774+
fi
719775
workspaces:
720776
- name: git-auth
721777
optional: true
@@ -727,7 +783,7 @@ spec:
727783
- name: git-auth
728784
secret:
729785
secretName: "{{ git_auth_secret }}"
730-
- name: fleet-apps-auth
786+
- name: hp-fleet-gitops-auth
731787
secret:
732-
secretName: kartograph-fleet-apps-auth
788+
secretName: kartograph-hp-fleet-gitops-auth
733789
status: {}

‎.tekton/kartograph-api-push.yaml‎

Lines changed: 70 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -615,9 +615,9 @@ spec:
615615
value: $(params.git-url)
616616
workspaces:
617617
- name: basic-auth
618-
workspace: fleet-apps-auth
618+
workspace: hp-fleet-gitops-auth
619619
- name: netrc
620-
workspace: fleet-apps-auth
620+
workspace: hp-fleet-gitops-auth
621621
taskSpec:
622622
params:
623623
- name: COMMIT_SHA
@@ -658,8 +658,8 @@ spec:
658658
mkdir -p "$HOME"
659659
660660
if [ ! -f "${WORKSPACE_BASIC_AUTH_PATH}/.git-credentials" ] && [ ! -f "${WORKSPACE_NETRC_PATH}/.netrc" ]; then
661-
echo "ERROR: Secret kartograph-fleet-apps-auth is missing or empty."
662-
echo "Apply .tekton/kartograph-fleet-apps-auth.secret.example.yaml in kartograph-tenant."
661+
echo "ERROR: Secret kartograph-hp-fleet-gitops-auth is missing or empty."
662+
echo "Apply .tekton/kartograph-hp-fleet-gitops-auth.secret.example.yaml in kartograph-tenant."
663663
exit 1
664664
fi
665665
@@ -677,9 +677,8 @@ spec:
677677
678678
SHORT_SHA="${COMMIT_SHA:0:12}"
679679
BRANCH="konflux/deploy-tag-${DEPLOY_COMPONENT}-${SHORT_SHA}"
680-
FLEET_APPS_REPO="https://gitlab.cee.redhat.com/hybrid-platforms-gitops/tenant-apps/fleet-apps.git"
681680
682-
git clone --depth 1 --branch main "${FLEET_APPS_REPO}" /tmp/repo
681+
git clone --depth 1 --branch main "https://github.com/openshift-online/hp-fleet-gitops" /tmp/repo
683682
cd /tmp/repo
684683
685684
FILE="apps/kartograph/overlays/stage/kustomization.yaml"
@@ -701,13 +700,70 @@ spec:
701700
702701
git checkout -b "$BRANCH"
703702
git commit -m "chore(deploy): update ${DEPLOY_COMPONENT} stage image tag to ${SHORT_SHA}"
704-
git push -u origin "$BRANCH" \
705-
-o merge_request.create \
706-
-o merge_request.target=main \
707-
-o "merge_request.title=chore(deploy): update ${DEPLOY_COMPONENT} stage image tag to ${SHORT_SHA}" \
708-
-o "merge_request.description=Auto-generated by Konflux push pipeline. Updates newTag for ${IMAGE_SELECTOR} to ${COMMIT_SHA}."
709-
echo "Merge request created for branch ${BRANCH}"
703+
git push origin "$BRANCH"
710704
705+
mkdir -p /tekton/run
706+
printf '%s\n' "$BRANCH" > /tekton/run/deploy-branch
707+
printf '%s\n' "$COMMIT_SHA" > /tekton/run/commit-sha
708+
printf '%s\n' "$DEPLOY_COMPONENT" > /tekton/run/deploy-component
709+
printf '%s\n' "$SHORT_SHA" > /tekton/run/short-sha
710+
- name: create-pull-request
711+
image: docker.io/curlimages/curl:8.12.1@sha256:94e9e444bcba979c2ea12e27ae39bee4cd10bc7041a472c4727a558e213744e6
712+
env:
713+
- name: WORKSPACE_NETRC_PATH
714+
value: /workspace/netrc
715+
script: |
716+
#!/bin/sh
717+
set -eu
718+
719+
if [ ! -f /tekton/run/deploy-branch ]; then
720+
echo "No deploy branch metadata, skipping PR creation"
721+
exit 0
722+
fi
723+
724+
BRANCH=$(cat /tekton/run/deploy-branch)
725+
COMMIT_SHA=$(cat /tekton/run/commit-sha)
726+
DEPLOY_COMPONENT=$(cat /tekton/run/deploy-component)
727+
SHORT_SHA=$(cat /tekton/run/short-sha)
728+
REPO="openshift-online/hp-fleet-gitops"
729+
730+
export HOME=/tekton/home
731+
mkdir -p "$HOME"
732+
if [ ! -f "${WORKSPACE_NETRC_PATH}/.netrc" ]; then
733+
echo "WARNING: netrc not available, PR must be created manually"
734+
echo "Branch pushed: $BRANCH"
735+
exit 0
736+
fi
737+
cp "${WORKSPACE_NETRC_PATH}/.netrc" "$HOME/.netrc"
738+
chmod 600 "$HOME/.netrc"
739+
740+
PAYLOAD=$(mktemp)
741+
chmod 600 "$PAYLOAD"
742+
printf '{"title":"chore(deploy): update %s stage image tag to %s","head":"%s","base":"main","body":"Auto-generated by Konflux push pipeline.\n\nUpdates `newTag` in stage kustomization to `%s`."}' \
743+
"$DEPLOY_COMPONENT" "$SHORT_SHA" "$BRANCH" "$COMMIT_SHA" > "$PAYLOAD"
744+
745+
PR_RESPONSE=$(curl -sS --netrc \
746+
-H "Content-Type: application/json" \
747+
-d @"$PAYLOAD" \
748+
"https://api.github.com/repos/${REPO}/pulls") || true
749+
rm -f "$PAYLOAD"
750+
751+
PR_URL=$(echo "$PR_RESPONSE" | grep -o '"html_url":"[^"]*"' | head -1 | cut -d'"' -f4)
752+
echo "PR created: ${PR_URL:-none}"
753+
754+
PR_NODE_ID=$(echo "$PR_RESPONSE" | grep -o '"node_id":"[^"]*"' | head -1 | cut -d'"' -f4)
755+
if [ -n "$PR_NODE_ID" ]; then
756+
GRAPHQL_PAYLOAD=$(mktemp)
757+
chmod 600 "$GRAPHQL_PAYLOAD"
758+
printf '{"query":"mutation { enablePullRequestAutoMerge(input: { pullRequestId: \\"%s\\", mergeMethod: SQUASH }) { pullRequest { autoMergeRequest { enabledAt } } } }"}' \
759+
"$PR_NODE_ID" > "$GRAPHQL_PAYLOAD"
760+
curl -sS --netrc \
761+
-H "Content-Type: application/json" \
762+
-d @"$GRAPHQL_PAYLOAD" \
763+
"https://api.github.com/graphql" > /dev/null 2>&1 || true
764+
rm -f "$GRAPHQL_PAYLOAD"
765+
echo "Auto-merge enabled"
766+
fi
711767
workspaces:
712768
- name: git-auth
713769
optional: true
@@ -719,7 +775,7 @@ spec:
719775
- name: git-auth
720776
secret:
721777
secretName: "{{ git_auth_secret }}"
722-
- name: fleet-apps-auth
778+
- name: hp-fleet-gitops-auth
723779
secret:
724-
secretName: kartograph-fleet-apps-auth
780+
secretName: kartograph-hp-fleet-gitops-auth
725781
status: {}

‎.tekton/kartograph-dev-ui-push.yaml‎

Lines changed: 70 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -615,9 +615,9 @@ spec:
615615
value: $(params.git-url)
616616
workspaces:
617617
- name: basic-auth
618-
workspace: fleet-apps-auth
618+
workspace: hp-fleet-gitops-auth
619619
- name: netrc
620-
workspace: fleet-apps-auth
620+
workspace: hp-fleet-gitops-auth
621621
taskSpec:
622622
params:
623623
- name: COMMIT_SHA
@@ -658,8 +658,8 @@ spec:
658658
mkdir -p "$HOME"
659659
660660
if [ ! -f "${WORKSPACE_BASIC_AUTH_PATH}/.git-credentials" ] && [ ! -f "${WORKSPACE_NETRC_PATH}/.netrc" ]; then
661-
echo "ERROR: Secret kartograph-fleet-apps-auth is missing or empty."
662-
echo "Apply .tekton/kartograph-fleet-apps-auth.secret.example.yaml in kartograph-tenant."
661+
echo "ERROR: Secret kartograph-hp-fleet-gitops-auth is missing or empty."
662+
echo "Apply .tekton/kartograph-hp-fleet-gitops-auth.secret.example.yaml in kartograph-tenant."
663663
exit 1
664664
fi
665665
@@ -677,9 +677,8 @@ spec:
677677
678678
SHORT_SHA="${COMMIT_SHA:0:12}"
679679
BRANCH="konflux/deploy-tag-${DEPLOY_COMPONENT}-${SHORT_SHA}"
680-
FLEET_APPS_REPO="https://gitlab.cee.redhat.com/hybrid-platforms-gitops/tenant-apps/fleet-apps.git"
681680
682-
git clone --depth 1 --branch main "${FLEET_APPS_REPO}" /tmp/repo
681+
git clone --depth 1 --branch main "https://github.com/openshift-online/hp-fleet-gitops" /tmp/repo
683682
cd /tmp/repo
684683
685684
FILE="apps/kartograph/overlays/stage/kustomization.yaml"
@@ -701,13 +700,70 @@ spec:
701700
702701
git checkout -b "$BRANCH"
703702
git commit -m "chore(deploy): update ${DEPLOY_COMPONENT} stage image tag to ${SHORT_SHA}"
704-
git push -u origin "$BRANCH" \
705-
-o merge_request.create \
706-
-o merge_request.target=main \
707-
-o "merge_request.title=chore(deploy): update ${DEPLOY_COMPONENT} stage image tag to ${SHORT_SHA}" \
708-
-o "merge_request.description=Auto-generated by Konflux push pipeline. Updates newTag for ${IMAGE_SELECTOR} to ${COMMIT_SHA}."
709-
echo "Merge request created for branch ${BRANCH}"
703+
git push origin "$BRANCH"
710704
705+
mkdir -p /tekton/run
706+
printf '%s\n' "$BRANCH" > /tekton/run/deploy-branch
707+
printf '%s\n' "$COMMIT_SHA" > /tekton/run/commit-sha
708+
printf '%s\n' "$DEPLOY_COMPONENT" > /tekton/run/deploy-component
709+
printf '%s\n' "$SHORT_SHA" > /tekton/run/short-sha
710+
- name: create-pull-request
711+
image: docker.io/curlimages/curl:8.12.1@sha256:94e9e444bcba979c2ea12e27ae39bee4cd10bc7041a472c4727a558e213744e6
712+
env:
713+
- name: WORKSPACE_NETRC_PATH
714+
value: /workspace/netrc
715+
script: |
716+
#!/bin/sh
717+
set -eu
718+
719+
if [ ! -f /tekton/run/deploy-branch ]; then
720+
echo "No deploy branch metadata, skipping PR creation"
721+
exit 0
722+
fi
723+
724+
BRANCH=$(cat /tekton/run/deploy-branch)
725+
COMMIT_SHA=$(cat /tekton/run/commit-sha)
726+
DEPLOY_COMPONENT=$(cat /tekton/run/deploy-component)
727+
SHORT_SHA=$(cat /tekton/run/short-sha)
728+
REPO="openshift-online/hp-fleet-gitops"
729+
730+
export HOME=/tekton/home
731+
mkdir -p "$HOME"
732+
if [ ! -f "${WORKSPACE_NETRC_PATH}/.netrc" ]; then
733+
echo "WARNING: netrc not available, PR must be created manually"
734+
echo "Branch pushed: $BRANCH"
735+
exit 0
736+
fi
737+
cp "${WORKSPACE_NETRC_PATH}/.netrc" "$HOME/.netrc"
738+
chmod 600 "$HOME/.netrc"
739+
740+
PAYLOAD=$(mktemp)
741+
chmod 600 "$PAYLOAD"
742+
printf '{"title":"chore(deploy): update %s stage image tag to %s","head":"%s","base":"main","body":"Auto-generated by Konflux push pipeline.\n\nUpdates `newTag` in stage kustomization to `%s`."}' \
743+
"$DEPLOY_COMPONENT" "$SHORT_SHA" "$BRANCH" "$COMMIT_SHA" > "$PAYLOAD"
744+
745+
PR_RESPONSE=$(curl -sS --netrc \
746+
-H "Content-Type: application/json" \
747+
-d @"$PAYLOAD" \
748+
"https://api.github.com/repos/${REPO}/pulls") || true
749+
rm -f "$PAYLOAD"
750+
751+
PR_URL=$(echo "$PR_RESPONSE" | grep -o '"html_url":"[^"]*"' | head -1 | cut -d'"' -f4)
752+
echo "PR created: ${PR_URL:-none}"
753+
754+
PR_NODE_ID=$(echo "$PR_RESPONSE" | grep -o '"node_id":"[^"]*"' | head -1 | cut -d'"' -f4)
755+
if [ -n "$PR_NODE_ID" ]; then
756+
GRAPHQL_PAYLOAD=$(mktemp)
757+
chmod 600 "$GRAPHQL_PAYLOAD"
758+
printf '{"query":"mutation { enablePullRequestAutoMerge(input: { pullRequestId: \\"%s\\", mergeMethod: SQUASH }) { pullRequest { autoMergeRequest { enabledAt } } } }"}' \
759+
"$PR_NODE_ID" > "$GRAPHQL_PAYLOAD"
760+
curl -sS --netrc \
761+
-H "Content-Type: application/json" \
762+
-d @"$GRAPHQL_PAYLOAD" \
763+
"https://api.github.com/graphql" > /dev/null 2>&1 || true
764+
rm -f "$GRAPHQL_PAYLOAD"
765+
echo "Auto-merge enabled"
766+
fi
711767
workspaces:
712768
- name: git-auth
713769
optional: true
@@ -719,7 +775,7 @@ spec:
719775
- name: git-auth
720776
secret:
721777
secretName: "{{ git_auth_secret }}"
722-
- name: fleet-apps-auth
778+
- name: hp-fleet-gitops-auth
723779
secret:
724-
secretName: kartograph-fleet-apps-auth
780+
secretName: kartograph-hp-fleet-gitops-auth
725781
status: {}

‎.tekton/kartograph-fleet-apps-auth.secret.example.yaml‎

Lines changed: 0 additions & 24 deletions
This file was deleted.

0 commit comments

Comments
 (0)