Make bump-version.sh hermetic and manually update bundle files#207
Make bump-version.sh hermetic and manually update bundle files#207AnnaZivkovic wants to merge 2 commits into
Conversation
Changes: - Remove all tool installations (yq, operator-sdk, kustomize, controller-gen, gpgme) - Use sed only for all file updates - Manually update bundle files instead of running 'make bundle' - Enable HERMETIC=true in pipeline - Pin run-script-oci-ta task to trusted digest (sha256:0e13a74c...) This fixes EC violations: - hermetic_task.hermetic - tasks.pinned_task_refs - trusted_task.trusted Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository: openshift/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (1)
WalkthroughThe PR integrates a refactored version-bumping script into the Tekton build pipeline. The ChangesBuild pipeline version scripting refactor
Sequence Diagram(s)sequenceDiagram
participant Pipeline
participant RunScriptTask
participant ScriptRunnerImage
participant BuildContainer
participant Snyk
Pipeline->>RunScriptTask: schedule run-script (hermetic)
RunScriptTask->>ScriptRunnerImage: execute ./hack/bump-version.sh
RunScriptTask->>Pipeline: publish SCRIPT_ARTIFACT + SCRIPT_RUNNER_IMAGE_REFERENCE
Pipeline->>BuildContainer: pass SCRIPT_ARTIFACT and ADDITIONAL_BASE_IMAGES
Pipeline->>Snyk: pass SCRIPT_ARTIFACT as source for scan
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Suggested reviewers
🚥 Pre-merge checks | ✅ 12✅ Passed checks (12 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.tekton/single-arch-build-pipeline.yaml:
- Around line 190-191: Replace the mutable tag value for the environment
variable SCRIPT_RUNNER_IMAGE with an immutable image reference pinned by digest:
run podman inspect registry.access.redhat.com/ubi9/go-toolset:1.25 --format
'{{.Digest}}' (or use equivalent registry API) to obtain the image digest, then
update SCRIPT_RUNNER_IMAGE's value to
registry.access.redhat.com/ubi9/go-toolset@sha256:<DIGEST>; ensure the pinned
reference matches what is recorded in ADDITIONAL_BASE_IMAGES so the run-script
task becomes hermetic.
In `@hack/bump-version.sh`:
- Around line 17-19: The script reads and then rewrites the Makefile's VERSION
causing compound suffixes; change the BASE_VERSION extraction (the BASE_VERSION
assignment that uses grep/awk) to strip any existing -<sha> suffix (e.g., remove
anything from the first '-' onward or match only the semver part) so you always
start from the pure base version before appending a new suffix; apply the same
sanitization wherever BASE_VERSION is re-read or used later (refer to the
BASE_VERSION variable and the grep/awk extraction around that block and the
similar logic at the later BASE_VERSION uses on lines referenced 87-88).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 3104aa8c-970f-4d61-9937-48fdf12c730e
📒 Files selected for processing (2)
.tekton/single-arch-build-pipeline.yamlhack/bump-version.sh
| - name: SCRIPT_RUNNER_IMAGE | ||
| value: registry.access.redhat.com/ubi9/go-toolset:1.25 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# First, let's read the file to see the current state
cat -n .tekton/single-arch-build-pipeline.yaml | sed -n '180,200p'Repository: openshift/multiarch-tuning-operator
Length of output: 881
🏁 Script executed:
# Check for SCRIPT_RUNNER_IMAGE usage throughout the codebase
rg "SCRIPT_RUNNER_IMAGE" -nRepository: openshift/multiarch-tuning-operator
Length of output: 61
🏁 Script executed:
# Look for patterns of image references and how they're typically handled
rg "value: registry\." -n .tekton/ -A 1 -B 1 | head -50Repository: openshift/multiarch-tuning-operator
Length of output: 556
🏁 Script executed:
# Check if there's documentation on hermetic builds or image pinning
fd -t f -name "*.md" | xargs rg -l "hermetic|digest|image.*pin" 2>/dev/null | head -5Repository: openshift/multiarch-tuning-operator
Length of output: 529
🏁 Script executed:
# Search for SCRIPT_RUNNER_IMAGE_REFERENCE usage
rg "SCRIPT_RUNNER_IMAGE_REFERENCE" -nRepository: openshift/multiarch-tuning-operator
Length of output: 61
🏁 Script executed:
# Look for the run-script task definition and how it handles SCRIPT_RUNNER_IMAGE
rg "run-script" -n .tekton/ -B 5 -A 10Repository: openshift/multiarch-tuning-operator
Length of output: 12349
🏁 Script executed:
# Check how the downstream build task uses the image reference
rg "ADDITIONAL_BASE_IMAGES" -n .tekton/ -B 3 -A 3Repository: openshift/multiarch-tuning-operator
Length of output: 668
🏁 Script executed:
# Look for other uses of digest pinning (sha256:) in the codebase
rg "`@sha256`:" -n .tekton/Repository: openshift/multiarch-tuning-operator
Length of output: 10040
🏁 Script executed:
# Check if there's documentation about hermetic builds
cat -n README.md 2>/dev/null | head -50 || echo "No README in root"
rg -l "hermetic" . --type mdRepository: openshift/multiarch-tuning-operator
Length of output: 2982
🏁 Script executed:
# Check if there are other examples of mutable tags in runner images across .tekton files
rg "value: .*:" .tekton/ | grep -v "`@sha256`" | grep -v "params\." | grep -v "tasks\." | grep -v "results\." | head -20Repository: openshift/multiarch-tuning-operator
Length of output: 1683
🏁 Script executed:
# Look for any documentation on image pinning or hermetic builds
find . -name "*.md" -o -name "*.txt" | xargs grep -l "image.*pin\|hermetic.*image" 2>/dev/null | head -5Repository: openshift/multiarch-tuning-operator
Length of output: 61
🏁 Script executed:
# Check git history to see if SCRIPT_RUNNER_IMAGE was recently added or changed
git log --oneline -20 -- .tekton/single-arch-build-pipeline.yaml 2>/dev/null | head -10Repository: openshift/multiarch-tuning-operator
Length of output: 151
🏁 Script executed:
# Check if there are comments or discussions around this image in the file
cat -n .tekton/single-arch-build-pipeline.yaml | grep -B 5 -A 5 "SCRIPT_RUNNER_IMAGE"Repository: openshift/multiarch-tuning-operator
Length of output: 969
🏁 Script executed:
# Let's check if there's a .git directory and can see the actual commit details
git show f2582a50 --stat 2>/dev/null | head -20Repository: openshift/multiarch-tuning-operator
Length of output: 791
🏁 Script executed:
# Search for any issue or PR references related to hermetic builds or image pinning
rg "hermetic|SCRIPT_RUNNER_IMAGE" -i . --type md 2>/dev/null | head -10Repository: openshift/multiarch-tuning-operator
Length of output: 264
🏁 Script executed:
# Check if UBI 9 go-toolset:1.25 specifically is documented or if there's a known digest
web_search
UBI 9 go-toolset 1.25 registry.access.redhat.com image digestRepository: openshift/multiarch-tuning-operator
Length of output: 172
🌐 Web query:
UBI 9 go-toolset 1.25 registry.access.redhat.com image digest sha256
💡 Result:
The registry.access.redhat.com/ubi9/go-toolset container image is a frequently updated, rolling-release image provided by Red Hat [1][2]. Because it is updated regularly to include the latest security patches and Go toolchain versions, there is no single, static SHA256 digest for the image [3][4][5]. To obtain the current, specific SHA256 digest for the ubi9/go-toolset image, you should query the Red Hat Container Registry directly using a tool like skopeo or podman. You can retrieve the digest for the latest version by running the following command: podman inspect registry.access.redhat.com/ubi9/go-toolset --format '{{.Digest}}' Alternatively, if you have skopeo installed, you can inspect the remote image without pulling it: skopeo inspect docker://registry.access.redhat.com/ubi9/go-toolset | grep Digest These commands will return the current, immutable digest for the image tag currently available in the registry [6]. For production environments, it is recommended to use this specific digest in your Dockerfiles or container manifests to ensure build reproducibility [3][4]. You can find further information and documentation on using these images in the Red Hat Ecosystem Catalog [1][7].
Citations:
- 1: https://catalog.redhat.com/en/software/containers/ubi9/go-toolset/61e5c00b4ec9945c18787690
- 2: https://access.redhat.com/errata/RHBA-2025:22778
- 3: Update registry.access.redhat.com/ubi9/go-toolset Docker digest to 8a634d6 redhat-cop/github-actions#409
- 4: Update registry.access.redhat.com/ubi9/go-toolset Docker digest to 56fc848 redhat-cop/github-actions#451
- 5: https://multi.ocp.releases.ci.openshift.org/releasetag/4.22.0-rc.0
- 6: https://dev.to/lyraalishaikh/stop-pulling-containers-just-to-mirror-them-practical-skopeo-for-safer-image-promotion-1kf3
- 7: https://catalog.redhat.com/software/containers/ubi9/go-toolset/61e5c00b4ec9945c18787690
Pin SCRIPT_RUNNER_IMAGE by digest.
The registry.access.redhat.com/ubi9/go-toolset:1.25 tag is mutable and receives rolling updates, so the run-script task can execute different code across builds despite HERMETIC=true. While the resolved reference is recorded in ADDITIONAL_BASE_IMAGES for tracking, this does not prevent the image from being re-pulled with different content. Pinning by digest is required to achieve true hermetic behavior and is consistent with the recent commit's goal of fixing hermetic compliance violations.
Proposed fix
- - name: SCRIPT_RUNNER_IMAGE
- value: registry.access.redhat.com/ubi9/go-toolset:1.25
+ - name: SCRIPT_RUNNER_IMAGE
+ value: registry.access.redhat.com/ubi9/go-toolset@sha256:<pinned-digest>Obtain the digest using: podman inspect registry.access.redhat.com/ubi9/go-toolset:1.25 --format '{{.Digest}}'
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.tekton/single-arch-build-pipeline.yaml around lines 190 - 191, Replace the
mutable tag value for the environment variable SCRIPT_RUNNER_IMAGE with an
immutable image reference pinned by digest: run podman inspect
registry.access.redhat.com/ubi9/go-toolset:1.25 --format '{{.Digest}}' (or use
equivalent registry API) to obtain the image digest, then update
SCRIPT_RUNNER_IMAGE's value to
registry.access.redhat.com/ubi9/go-toolset@sha256:<DIGEST>; ensure the pinned
reference matches what is recorded in ADDITIONAL_BASE_IMAGES so the run-script
task becomes hermetic.
| # Read base version from Makefile | ||
| if [ -f Makefile ]; then | ||
| BASE_VERSION=$(grep -E "^VERSION \?=" Makefile | awk '{print $3}') |
There was a problem hiding this comment.
Keep Makefile's base version stable.
Makefile is now both the source of BASE_VERSION and the target for the derived BASE_VERSION-<sha> value. A second run against the same checkout will compound the suffix and produce versions like 1.3.0-abc1234-def5678, which breaks the intended format.
Proposed fix
- BASE_VERSION=$(grep -E "^VERSION \?=" Makefile | awk '{print $3}')
+ BASE_VERSION=$(grep -E "^VERSION \?=" Makefile | awk '{print $3}' | sed -E 's/-[0-9a-f]{7}$//')Also applies to: 87-88
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@hack/bump-version.sh` around lines 17 - 19, The script reads and then
rewrites the Makefile's VERSION causing compound suffixes; change the
BASE_VERSION extraction (the BASE_VERSION assignment that uses grep/awk) to
strip any existing -<sha> suffix (e.g., remove anything from the first '-'
onward or match only the semver part) so you always start from the pure base
version before appending a new suffix; apply the same sanitization wherever
BASE_VERSION is re-read or used later (refer to the BASE_VERSION variable and
the grep/awk extraction around that block and the similar logic at the later
BASE_VERSION uses on lines referenced 87-88).
The lint job was timing out at 5m0s, just slightly exceeding the 5m timeout. Increasing to 10m to provide more headroom for slower CI environments.
|
@AnnaZivkovic: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/lgtm |
openshift-ci
Bot
added
the
needs-rebase
|
PR needs rebase. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: jcpowermac The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
2 participants
Summary
This PR implements automated FBC (File-Based Catalog) updates with dynamic version generation for Konflux builds. The operator version is now automatically generated as
BASE_VERSION-COMMIT_SHA(e.g.,1.3.0-abc1234) ensuring version synchronization between the operator build and FBC catalog updates.1. Dynamic Version Generation
run-scripttask in single-arch-build-pipeline.yaml runshack/bump-version.shbefore buildingBASE_VERSION-COMMIT_SHAwhere:1.3.0)2. Hermetic Build Compliance
Problem: Enterprise Contract (EC) policies require hermetic builds (network isolation), but the original script downloaded tools (yq, operator-sdk, kustomize, controller-gen). Therefore we can not use
make bundleSummary by CodeRabbit
New Features
Improvements
Chores
CI