ci(konflux): dedicated ephemeral merge-queue image builds - #161
Merged
Conversation
The merge-group image resolution in the E2E gate waited for hypershell-<component>-main-on-push checks and inspected the bare <merge_sha> image tag. #155 configured the GitHub merge queue to build through the Konflux *pull-request* pipelines instead: a push to gh-readonly-queue/main/... runs hypershell-<component>-main-on-pull-request and pushes on-pr-<merge_sha>. The on-push pipelines require target_branch == "main" and never fire on a merge-queue branch, so the -on-push check never appears; "Wait for component image builds" ran out its 900s discovery window / 25m job ceiling and blocked the gate. - Wait for the -on-pull-request checks in the merge-group steps. - Add a dedicated merge_group plan case that maps each rebuilt component to on-pr-<merge_sha> and keeps unchanged components on baseline. The old *) case tagged all three images with one ref, so an unchanged component (control-plane in #158) would resolve to a non-existent on-pr image even after the wait was fixed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: Kyle Squizzato <kysquizz@redhat.com>
|
Warning Review limit reached
Next review available in: 49 minutes Limit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?Wait for the limit to reset, then comment An organization admin can change what happens after included review limits in Billing. How do review limits work?CodeRabbit enforces per-developer PR review limits within each organization. For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Repository: openshift-online/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (8)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
The e2e "Wait for component image builds" gate timed out in the GitHub merge queue because it waited on Konflux checks that never fired: the on-push pipelines require target_branch == "main" and merge_group builds push to gh-readonly-queue/main/... instead. #155 addressed this by extending the pull-request pipelines to also fire on merge-queue pushes, but that reused the on-pr-<sha> tag/check and blurred the line between an already-tested PR image and a freshly rebuilt merge-queue image. Instead, give merge-queue builds their own dedicated, ephemeral pipelines so they are never confused with PR images: - Add .tekton/hypershell-<component>-main-merge-queue.yaml for all three components. Each fires only on a push whose target_branch starts with gh-readonly-queue/main/, pushes an ephemeral on-merge-queue-<merge_sha> tag (image-expires-after: 5d), sets auto-release=false, and produces the distinct check hypershell-<component>-main-on-merge-queue. - Revert #155's merge-queue trigger out of the pull-request pipelines: back to pull_request-only, cancel-in-progress=true, no auto-release label, retaining the on-pr-<head_sha> tag. - e2e.yml: the merge_group wait steps now block on the -on-merge-queue checks (keyed on github.sha, the merge commit), and the plan maps changed components to on-merge-queue-<merge_sha> images while unchanged components fall back to baseline. e2e always runs as the merge gate; browser trace verification stays skipped on merge_group. - Document the merge-queue gate and the distinct/ephemeral image contract in specs/platform/e2e-testing.spec.md. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: Kyle Squizzato <kysquizz@redhat.com>
squizzi
changed the title
The e2e plan step and the merge-queue detect step decided which
components have a Konflux image to wait for by grepping only the
component source trees (components/<comp>/ and packages/gateway-management-ui/).
That is an incomplete mirror of each component's Konflux CEL trigger,
which also fires on the pipeline definition file itself
(.tekton/hypershell-<comp>-main-{pull-request,merge-queue}.yaml) and,
for control-plane, the root Dockerfile.
A PR that changes only a component's pull-request pipeline file (like
this one) therefore triggered the on-pr build in Konflux, but the plan
step saw "no source components changed", fell back to main's on-push
images, and never waited for -- or used -- the on-pr images the PR
actually produced.
Make the detection greps in both the pull_request plan case and the
merge_group detect step exact mirrors of the corresponding CEL triggers,
including the pipeline file self-reference and the control-plane
Dockerfile clause. Document the rule in the e2e-testing spec (new
"Component Pipeline Definition Changed" scenario) and tighten the
"Infrastructure-Only Changes" scenario to exclude pipeline/Dockerfile
changes.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Kyle Squizzato <kysquizz@redhat.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Fixes the
Wait for component image buildsstep (theresolve-imagesjob in the E2E gate) timing out on the GitHub merge queue and blocking merges.Why it broke
The merge-group wait steps in
e2e.ymlwaited for Konflux checks that never fired. The on-push pipelines requiretarget_branch == "main", but the merge queue pushes togh-readonly-queue/main/..., so the-on-pushchecks never appear.wait-on-check-actionran out its discovery window and the job hit its timeout ceiling.Approach
The first attempt reused the pull-request pipelines for merge-queue pushes, but that reused the
on-pr-<sha>tag/check and blurred the line between an already-tested PR image and a freshly rebuilt merge-queue image.Instead, merge-queue builds now get their own dedicated, ephemeral pipelines so they are never confused with PR images.
Changes
.tekton/hypershell-<component>-main-merge-queue.yamlfor all three components (api-server, control-plane, web-console). Each:pushwhosetarget_branchstarts withgh-readonly-queue/main/on-merge-queue-<merge_sha>tag (image-expires-after: 5d)release.appstudio.openshift.io/auto-release: "false"hypershell-<component>-main-on-merge-queuehypershell-<component>-mainKonflux Component (no UI/Application changes needed)pull_request-only,cancel-in-progress: "true", noauto-releaselabel, retaining theon-pr-<head_sha>tag.e2e.yml:-on-merge-queuechecks, keyed ongithub.sha(the merge commit)detect-merge-queuediffsmerge_group.base_sha...github.shato decide which components the batch rebuiltmerge_groupplan case maps rebuilt components toon-merge-queue-<merge_sha>and unchanged components to the baseline imagemerge_group(covered at PR time, re-verified on push tomain)specs/platform/e2e-testing.spec.md: document the merge-queue gate and the distinct/ephemeral image contract.Test plan
make checkpasses..tekton/*.yamlande2e.ymlvalidated as YAML.on-merge-queue-<revision>output image,auto-release: false,image-expires-after: 5d, and distinct check name.🤖 Generated with Claude Code