Skip to content

Commit 16b2f23

Browse files
ckhordiasmaclaude
ckhordiasma
and
claude
authored
[RHOAIENG-66501] add package version metadata into env vars (#26129)
* switch image to olm-runner, which includes cosign * add rhoai_version input and decouple version from branch name Add workflow_dispatch input to both bundle workflows so RHOAI version can be provided explicitly. When omitted, it's derived from the branch name (must match rhoai-X.Y or rhoai-X.Y-ea.Z). This allows running the workflows from non-release branches for testing. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * add workflow run URL to automated commit messages Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * add dry_run input to push results to a dummy branch When dry_run is checked, results are pushed to BRANCH-dry-run instead of the actual branch, allowing safe testing without modifying release branches. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * enable SBOM metadata extraction in bundle workflows Add registry auth (registry.redhat.io, registry.stage.redhat.io, quay.io/aipcc) and pass -mc flag to bundle processor so it extracts package versions from image SBOMs. Add metadata-config.yaml targeting vllm package across all VLLM image variants. Depends on: red-hat-data-services/RHOAI-Konflux-Automation#37 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 parent e284f3b commit 16b2f23

3 files changed

Lines changed: 117 additions & 41 deletions

File tree

‎.github/workflows/process-operator-bundle.yaml‎

Lines changed: 54 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,16 @@ name: Process Operator Bundle
22
run-name: Process Operator Bundle
33
on:
44
workflow_dispatch:
5+
inputs:
6+
rhoai_version:
7+
description: 'RHOAI version to process (e.g. rhoai-3.5, rhoai-3.5-ea.2). Branch name used if omitted.'
8+
required: false
9+
type: string
10+
dry_run:
11+
description: 'Push results to BRANCH-dry-run instead of the actual branch.'
12+
required: false
13+
type: boolean
14+
default: false
515
push:
616
paths:
717
- bundle/additional-images-patch.yaml
@@ -29,13 +39,24 @@ jobs:
2939
if: ${{ github.ref_name != 'main' }}
3040
runs-on: ubuntu-latest
3141
container:
32-
image: quay.io/rhoai/rhoai-task-toolset:latest
42+
# defined here: https://github.com/red-hat-data-services/devops-images/tree/main/builds
43+
image: quay.io/rhoai-devops/olm-runner:latest
3344
steps:
34-
- name: Get Current branch name
45+
- name: Resolve branch and RHOAI version
3546
shell: bash
36-
run: echo "branch=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}" >> $GITHUB_OUTPUT
47+
run: |
48+
BRANCH="${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}"
49+
echo "branch=$BRANCH" >> $GITHUB_OUTPUT
50+
51+
VERSION_SOURCE="${{ inputs.rhoai_version || github.head_ref || github.ref_name }}"
52+
VERSION_SOURCE="${VERSION_SOURCE#rhoai-}"
53+
if ! [[ "$VERSION_SOURCE" =~ ^([0-9]+\.[0-9]+(-ea\.[0-9]+)?)$ ]]; then
54+
echo "::error::Cannot resolve RHOAI version from '$VERSION_SOURCE'. Provide rhoai_version input (e.g. rhoai-3.5)."
55+
exit 1
56+
fi
57+
echo "rhoai_version=${BASH_REMATCH[1]}" >> $GITHUB_OUTPUT
3758
id: get_branch
38-
- name: Git checkout RBC release
59+
- name: Git checkout
3960
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
4061
with:
4162
ref: ${{ steps.get_branch.outputs.branch }}
@@ -48,24 +69,24 @@ jobs:
4869
path: utils
4970
- name: Install dependencies
5071
run: |
51-
os="$(uname -s | tr '[:upper:]' '[:lower:]')"
52-
arch="$(uname -m | sed 's/x86_64/amd64/')"
53-
yq_version="v4.44.3"
54-
yq_filename="yq-$yq_version"
55-
echo "-> Downloading yq" >&2
56-
curl -sSfLo "$yq_filename" "https://github.com/mikefarah/yq/releases/download/$yq_version/yq_${os}_${arch}"
57-
chmod +x $yq_filename
58-
ln -s $yq_filename yq
59-
cp $yq_filename /usr/local/bin/yq
60-
61-
echo "-> Installing findutils" >&2
62-
microdnf install -y findutils
63-
6472
pip install --default-timeout=100 -r utils/utils/processors/requirements.txt
6573
74+
- name: Login to container registries
75+
env:
76+
REGISTRY_REDHAT_IO_USERNAME: ${{ secrets.REGISTRY_REDHAT_IO_USERNAME }}
77+
REGISTRY_REDHAT_IO_PASSWORD: ${{ secrets.REGISTRY_REDHAT_IO_PASSWORD }}
78+
REGISTRY_STAGE_REDHAT_IO_USERNAME: ${{ secrets.REGISTRY_STAGE_REDHAT_IO_USERNAME }}
79+
REGISTRY_STAGE_REDHAT_IO_PASSWORD: ${{ secrets.REGISTRY_STAGE_REDHAT_IO_PASSWORD }}
80+
AIPCC_QUAY_RO_USERNAME: ${{ secrets.AIPCC_QUAY_RO_USERNAME }}
81+
AIPCC_QUAY_RO_TOKEN: ${{ secrets.AIPCC_QUAY_RO_TOKEN }}
82+
run: |
83+
cosign login registry.redhat.io -u "${REGISTRY_REDHAT_IO_USERNAME}" -p "${REGISTRY_REDHAT_IO_PASSWORD}"
84+
cosign login registry.stage.redhat.io -u "${REGISTRY_STAGE_REDHAT_IO_USERNAME}" -p "${REGISTRY_STAGE_REDHAT_IO_PASSWORD}"
85+
cosign login quay.io -u "${AIPCC_QUAY_RO_USERNAME}" -p "${AIPCC_QUAY_RO_TOKEN}"
6686
- name: Process Operator Bundle
6787
env:
6888
BRANCH: ${{ steps.get_branch.outputs.branch }}
89+
RHOAI_VERSION: ${{ steps.get_branch.outputs.rhoai_version }}
6990
OC_TOKEN: ${{ secrets.KONFLUX_INTERNAL_OC_TOKEN }}
7091
CLUSTER: p02
7192
RHOAI_QUAY_API_TOKEN: ${{ secrets.RHOAI_QUAY_API_TOKEN }}
@@ -78,8 +99,7 @@ jobs:
7899
run: |
79100
#Declare basic variables
80101
OPENSHIFT_VERSION=v4.13
81-
RHOAI_VERSION=v${BRANCH/rhoai-/}
82-
COMPONENT_SUFFIX=${RHOAI_VERSION//./-}
102+
COMPONENT_SUFFIX=v${RHOAI_VERSION//./-}
83103
OPERATOR_BUNDLE_COMPONENT_NAME=odh-operator-bundle-${COMPONENT_SUFFIX}
84104
XKS_HELM_CHART_COMPONENT_NAME=rhai-on-xks-chart-${COMPONENT_SUFFIX}
85105
OPENSHIFT_HELM_CHART_COMPONENT_NAME=rhai-on-openshift-chart-${COMPONENT_SUFFIX}
@@ -112,14 +132,21 @@ jobs:
112132
OPENSHIFT_HELM_VALUES_YAML_PATH=${HELM_RAW_INPUTS_DIR}/rhai-on-openshift-chart/values.yaml
113133
OPENSHIFT_HELM_PUSH_PIPELINE_PATH=${BRANCH}/.tekton/${OPENSHIFT_HELM_CHART_COMPONENT_NAME}-push.yaml
114134
135+
#Declare SBOM metadata config path
136+
METADATA_CONFIG_PATH=${BRANCH}/bundle/metadata-config.yaml
137+
METADATA_CONFIG_FLAG=""
138+
if [ -f "${METADATA_CONFIG_PATH}" ]; then
139+
METADATA_CONFIG_FLAG="-mc ${METADATA_CONFIG_PATH}"
140+
fi
141+
115142
#Invoke Bundle processor to patch the catalog
116143
python3 utils/utils/processors/bundle-processor.py \
117144
-op bundle-patch \
118145
-b ${BUILD_CONFIG_PATH} \
119146
-c ${BUNDLE_CSV_PATH} \
120147
-p ${PATCH_YAML_PATH} \
121148
-o ${OUTPUT_FILE_PATH} \
122-
-v ${BRANCH} \
149+
-v rhoai-${RHOAI_VERSION} \
123150
-a ${ANNOTATION_YAML_PATH} \
124151
-xhp ${XKS_HELM_PATCH_YAML_PATH} \
125152
-xhv ${XKS_HELM_VALUES_YAML_PATH} \
@@ -128,7 +155,8 @@ jobs:
128155
-ohv ${OPENSHIFT_HELM_VALUES_YAML_PATH} \
129156
-ohpp ${OPENSHIFT_HELM_PUSH_PIPELINE_PATH} \
130157
-y ${BUNDLE_PUSH_PIPELINE_PATH} \
131-
-x enable
158+
-x enable \
159+
${METADATA_CONFIG_FLAG}
132160
133161
# Sync processed content back to bundle and helm directories
134162
# Convention: root-level files are permanent configs, subdirectories are synced content
@@ -157,4 +185,8 @@ jobs:
157185
git config user.name "Openshift-AI DevOps"
158186
git config user.email "openshift-ai-devops@redhat.com"
159187
git add -A
160-
git diff --staged --quiet || (git commit -m "Updating the bundle-csv and helm chart values with latest images" && git push origin ${{ steps.get_branch.outputs.branch }})
188+
PUSH_BRANCH="${{ inputs.dry_run == true && format('{0}-dry-run-bundle', steps.get_branch.outputs.branch) || steps.get_branch.outputs.branch }}"
189+
FORCE_FLAG="${{ inputs.dry_run == true && '--force' || '' }}"
190+
git diff --staged --quiet || (git commit -m "Updating the bundle-csv and helm chart values with latest images
191+
192+
${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" && git push ${FORCE_FLAG} origin HEAD:${PUSH_BRANCH})

‎.github/workflows/trigger-nightly-bundle-build.yaml‎

Lines changed: 54 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,16 @@ name: Trigger Nightly Bundle Build
22
run-name: Trigger Nightly Bundle Build
33
on:
44
workflow_dispatch:
5+
inputs:
6+
rhoai_version:
7+
description: 'RHOAI version to process (e.g. rhoai-3.5, rhoai-3.5-ea.2). Branch name used if omitted.'
8+
required: false
9+
type: string
10+
dry_run:
11+
description: 'Push results to BRANCH-dry-run instead of the actual branch.'
12+
required: false
13+
type: boolean
14+
default: false
515
push:
616
paths:
717
- schedule/bundle-github-trigger.txt
@@ -22,13 +32,24 @@ jobs:
2232
if: ${{ github.ref_name != 'main' }}
2333
runs-on: ubuntu-latest
2434
container:
25-
image: quay.io/rhoai/rhoai-task-toolset:latest
35+
# defined here: https://github.com/red-hat-data-services/devops-images/tree/main/builds
36+
image: quay.io/rhoai-devops/olm-runner:latest
2637
steps:
27-
- name: Get Current branch name
38+
- name: Resolve branch and RHOAI version
2839
shell: bash
29-
run: echo "branch=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}" >> $GITHUB_OUTPUT
40+
run: |
41+
BRANCH="${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}"
42+
echo "branch=$BRANCH" >> $GITHUB_OUTPUT
43+
44+
VERSION_SOURCE="${{ inputs.rhoai_version || github.head_ref || github.ref_name }}"
45+
VERSION_SOURCE="${VERSION_SOURCE#rhoai-}"
46+
if ! [[ "$VERSION_SOURCE" =~ ^([0-9]+\.[0-9]+(-ea\.[0-9]+)?)$ ]]; then
47+
echo "::error::Cannot resolve RHOAI version from '$VERSION_SOURCE'. Provide rhoai_version input (e.g. rhoai-3.5)."
48+
exit 1
49+
fi
50+
echo "rhoai_version=${BASH_REMATCH[1]}" >> $GITHUB_OUTPUT
3051
id: get_branch
31-
- name: Git checkout RBC release
52+
- name: Git checkout
3253
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
3354
with:
3455
ref: ${{ steps.get_branch.outputs.branch }}
@@ -41,21 +62,24 @@ jobs:
4162
path: utils
4263
- name: Install dependencies
4364
run: |
44-
os="$(uname -s | tr '[:upper:]' '[:lower:]')"
45-
arch="$(uname -m | sed 's/x86_64/amd64/')"
46-
yq_version="v4.44.3"
47-
yq_filename="yq-$yq_version"
48-
echo "-> Downloading yq" >&2
49-
curl -sSfLo "$yq_filename" "https://github.com/mikefarah/yq/releases/download/$yq_version/yq_${os}_${arch}"
50-
chmod +x $yq_filename
51-
ln -s $yq_filename yq
52-
cp $yq_filename /usr/local/bin/yq
53-
5465
pip install --default-timeout=100 -r utils/utils/processors/requirements.txt
5566
67+
- name: Login to container registries
68+
env:
69+
REGISTRY_REDHAT_IO_USERNAME: ${{ secrets.REGISTRY_REDHAT_IO_USERNAME }}
70+
REGISTRY_REDHAT_IO_PASSWORD: ${{ secrets.REGISTRY_REDHAT_IO_PASSWORD }}
71+
REGISTRY_STAGE_REDHAT_IO_USERNAME: ${{ secrets.REGISTRY_STAGE_REDHAT_IO_USERNAME }}
72+
REGISTRY_STAGE_REDHAT_IO_PASSWORD: ${{ secrets.REGISTRY_STAGE_REDHAT_IO_PASSWORD }}
73+
AIPCC_QUAY_RO_USERNAME: ${{ secrets.AIPCC_QUAY_RO_USERNAME }}
74+
AIPCC_QUAY_RO_TOKEN: ${{ secrets.AIPCC_QUAY_RO_TOKEN }}
75+
run: |
76+
cosign login registry.redhat.io -u "${REGISTRY_REDHAT_IO_USERNAME}" -p "${REGISTRY_REDHAT_IO_PASSWORD}"
77+
cosign login registry.stage.redhat.io -u "${REGISTRY_STAGE_REDHAT_IO_USERNAME}" -p "${REGISTRY_STAGE_REDHAT_IO_PASSWORD}"
78+
cosign login quay.io -u "${AIPCC_QUAY_RO_USERNAME}" -p "${AIPCC_QUAY_RO_TOKEN}"
5679
- name: Process Operator Bundle
5780
env:
5881
BRANCH: ${{ steps.get_branch.outputs.branch }}
82+
RHOAI_VERSION: ${{ steps.get_branch.outputs.rhoai_version }}
5983
OC_TOKEN: ${{ secrets.KONFLUX_INTERNAL_OC_TOKEN }}
6084
CLUSTER: p02
6185
RHOAI_QUAY_API_TOKEN: ${{ secrets.RHOAI_QUAY_API_TOKEN }}
@@ -68,8 +92,7 @@ jobs:
6892
run: |
6993
#Declare basic variables
7094
OPENSHIFT_VERSION=v4.13
71-
RHOAI_VERSION=v${BRANCH/rhoai-/}
72-
COMPONENT_SUFFIX=${RHOAI_VERSION//./-}
95+
COMPONENT_SUFFIX=v${RHOAI_VERSION//./-}
7396
OPERATOR_BUNDLE_COMPONENT_NAME=odh-operator-bundle-${COMPONENT_SUFFIX}
7497
XKS_HELM_CHART_COMPONENT_NAME=rhai-on-xks-chart-${COMPONENT_SUFFIX}
7598
OPENSHIFT_HELM_CHART_COMPONENT_NAME=rhai-on-openshift-chart-${COMPONENT_SUFFIX}
@@ -102,14 +125,21 @@ jobs:
102125
OPENSHIFT_HELM_VALUES_YAML_PATH=${HELM_RAW_INPUTS_DIR}/rhai-on-openshift-chart/values.yaml
103126
OPENSHIFT_HELM_PUSH_PIPELINE_PATH=${BRANCH}/.tekton/${OPENSHIFT_HELM_CHART_COMPONENT_NAME}-push.yaml
104127
128+
#Declare SBOM metadata config path
129+
METADATA_CONFIG_PATH=${BRANCH}/bundle/metadata-config.yaml
130+
METADATA_CONFIG_FLAG=""
131+
if [ -f "${METADATA_CONFIG_PATH}" ]; then
132+
METADATA_CONFIG_FLAG="-mc ${METADATA_CONFIG_PATH}"
133+
fi
134+
105135
#Invoke Bundle processor to patch the catalog
106136
python3 utils/utils/processors/bundle-processor.py \
107137
-op bundle-patch \
108138
-b ${BUILD_CONFIG_PATH} \
109139
-c ${BUNDLE_CSV_PATH} \
110140
-p ${PATCH_YAML_PATH} \
111141
-o ${OUTPUT_FILE_PATH} \
112-
-v ${BRANCH} \
142+
-v rhoai-${RHOAI_VERSION} \
113143
-a ${ANNOTATION_YAML_PATH} \
114144
-xhp ${XKS_HELM_PATCH_YAML_PATH} \
115145
-xhv ${XKS_HELM_VALUES_YAML_PATH} \
@@ -119,7 +149,8 @@ jobs:
119149
-ohpp ${OPENSHIFT_HELM_PUSH_PIPELINE_PATH} \
120150
-y ${BUNDLE_PUSH_PIPELINE_PATH} \
121151
-x disable \
122-
-t nightly
152+
-t nightly \
153+
${METADATA_CONFIG_FLAG}
123154
124155
cp -r ${RAW_INPUTS_DIR}/* ${BRANCH}/bundle
125156
cp -r ${HELM_RAW_INPUTS_DIR}/* ${BRANCH}/helm/
@@ -144,4 +175,8 @@ jobs:
144175
git config user.name "Openshift-AI DevOps"
145176
git config user.email "openshift-ai-devops@redhat.com"
146177
git add -A
147-
git diff --staged --quiet || (git commit -m "Updating the bundle-csv and helm chart values with latest images" && git push origin ${{ steps.get_branch.outputs.branch }})
178+
PUSH_BRANCH="${{ inputs.dry_run == true && format('{0}-dry-run-nightly-bundle', steps.get_branch.outputs.branch) || steps.get_branch.outputs.branch }}"
179+
FORCE_FLAG="${{ inputs.dry_run == true && '--force' || '' }}"
180+
git diff --staged --quiet || (git commit -m "Updating the bundle-csv and helm chart values with latest images
181+
182+
${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" && git push ${FORCE_FLAG} origin HEAD:${PUSH_BRANCH})

‎bundle/metadata-config.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
sbom-metadata:
2+
- env_vars:
3+
- "RELATED_IMAGE_RHAII_VLLM_CUDA_IMAGE"
4+
- "RELATED_IMAGE_RHAII_VLLM_ROCM_IMAGE"
5+
- "RELATED_IMAGE_RHAII_VLLM_SPYRE_IMAGE"
6+
- "RELATED_IMAGE_RHAII_VLLM_CPU_IMAGE"
7+
- "RELATED_IMAGE_RHAII_VLLM_GAUDI_IMAGE"
8+
package: "vllm"
9+
suffix: "_UPSTREAM_VERSION"

0 commit comments

Comments
 (0)