Skip to content

Commit b5fcac7

Browse files
Molter73red-hat-konflux[bot]msugakovtommartensen
authored
Backport konflux changes to 3.20 (stackrox 4.6) (#2176)
* chore(deps): update konflux references (#1896) * build: Switch `git-url` from `repo_url` to `source_url` (#1903) * chore(deps): update konflux references (#1905) Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com> Co-authored-by: red-hat-konflux[bot] <126015336+red-hat-konflux[bot]@users.noreply.github.com> * chore(deps): update konflux references (#1907) * chore(deps): update quay.io/redhat-appstudio/build-trusted-artifacts:latest docker digest to 81c4864 (#1882) * chore(deps): update konflux references (#1921) * Always build multiarch tests for the konflux workflows (#1974) Since konflux always builds multiarch images and we always try to test them, we should force the test container to build in multiarch mode. If we don't, then we get test failures on the konflux integration tests for PRs due to the tester image not existing. * chore: Update Renovate config (#1979) * chore(deps): update konflux references (master) (#1976) * chore(deps): update quay.io/redhat-appstudio/build-trusted-artifacts:latest docker digest to 52f1391 (master) (#1982) * chore(deps): update konflux references (master) (#1984) * chore(deps): update konflux references (master) (#1985) * ROX-27350: Switch `determine-image-tag` to trusted task (#1992) * ROX-27485: Add comment not to delete source-location LABEL from Konflux Dockerfiles (#2002) * Add comment not to delete source-location LABEL from Konflux Dockerfiles * Update collector/container/konflux.Dockerfile Co-authored-by: Misha Sugakov <[email protected]> --------- Co-authored-by: Misha Sugakov <[email protected]> * chore: Kill `Java` mentions from Konflux pipelines (#2006) * ROX-24530: let Konflux images expire after 13w (#2007) * chore(deps): update konflux references (master) (#1988) * chore(deps): update quay.io/rhacs-eng/konflux-tasks:latest docker digest to 098fb3f (master) (#2003) * ROX-27384: Use the updated `determine-image-tag` task (#2001) * chore(deps): update quay.io/rhacs-eng/konflux-tasks:latest docker digest to 433e2a1 (master) (#2009) * chore(deps): update konflux references (master) (#2008) * chore(deps): update konflux references (master) (#2015) * chore(deps): update quay.io/rhacs-eng/konflux-tasks:latest docker digest to a2477a5 (#2020) * chore(deps): update konflux references (#2022) * Ensure ctest fails if no unit tests are found (#2027) * chore(deps): update konflux references (#2026) * chore(deps): update konflux references (#2037) * chore(deps): update konflux references to 752230a (#2040) * ROX-27831: set image expiration based on event type and target branch (#2035) * ROX-27831: set image expiration based on event type and target branch * update task digest and name * fix task digest * chore(deps): update konflux references to b78123a (#2045) * chore(deps): update konflux references to a3f3a4d (#2047) * chore(deps): update konflux references to 5bc6129 (#2049) * ROX-27905: Exclude sample rpmbdbs from Konflux SBOMs (#2052) * chore(deps): update konflux references (#2053) * chore: Mark more places to be reviewed by `rhtap-maintainers` (#2054) * Fix QA tag missing collector version in konflux tests (#2057) The QA tag being used for konflux tests on PRs is malformed, leading to weird errors. This should fix it. When running on a PR that bumps the QA_TAG, the test containers include the collector tag as a suffix in order to prevent collisions with other PRs that might be bumping the version, so they would look something like this: 2.0.3-3.21.x-26-g5a61d712ab-fast However, on konflux, the collector tag was not being properly set and the tags looked like this: 2.0.3- * chore(deps): update konflux references (#2060) * ROX-27856: Post Konflux metrics to BigQuery (#2071) * chore(deps): update konflux references (#2062) * ROX-20234: Add rpms prefetch, set build to hermetic (#2109) Co-authored-by: Tom Martensen <[email protected]> * chore(deps): update quay.io/rhacs-eng/konflux-tasks:latest docker digest to 3d1fbc3 (#2117) * chore(deps): update konflux references (#2088) * chore(deps): update quay.io/rhacs-eng/konflux-tasks:latest docker digest to fa86065 (#2119) Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com> Co-authored-by: red-hat-konflux[bot] <126015336+red-hat-konflux[bot]@users.noreply.github.com> * chore(deps): update konflux references (#2118) Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com> Co-authored-by: red-hat-konflux[bot] <126015336+red-hat-konflux[bot]@users.noreply.github.com> * ROX-29078: switch to per component service account (#2120) * ROX-29078: switch to per component service account * move SA def to PipelineRun * ROX-28568: Add required tasks sast-shell-check and sast-unicode-check to Konflux pipelines (#2115) * ROX-26148: Announce ./rpms.* files ownership (#2127) * chore(deps): update konflux references (#2121) * chore: Bump memory limit in TA download (#2129) * chore(deps): rpm updates (#2128) * chore(deps): rpm updates [security] (#2131) * chore(deps): update quay.io/rhacs-eng/konflux-tasks:latest docker digest to f1362c6 (#2122) * build(fix): Bump TA steps memory from 4 to 6Gi (#2134) * chore(deps): update quay.io/rhacs-eng/konflux-tasks:latest docker digest to b4f8de3 (#2136) Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com> Co-authored-by: red-hat-konflux[bot] <126015336+red-hat-konflux[bot]@users.noreply.github.com> * ROX-29479: Use custom repos for Konflux built product (#2139) * ROX-28973: update image tagging and expiration in Konflux (#2141) * chore(deps): rpm updates [security] (#2143) * chore(deps): update quay.io/rhacs-eng/konflux-tasks:latest docker digest to f251565 (#2148) * chore(deps): update konflux references (#2133) * chore(deps): [security] (#2153) * ROX-29602: Use updated `determine-image-tag` task (#2154) * chore(deps): update konflux references (#2156) * chore(deps): update all dependencies (#2155) * chore(deps): update quay.io/rhacs-eng/konflux-tasks:latest docker digest to d5c4939 (#2152) * build: Fix Konflux builds (#2166) * Stop installing jq to the builder image (#1925) --------- Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com> Co-authored-by: red-hat-konflux[bot] <126015336+red-hat-konflux[bot]@users.noreply.github.com> Co-authored-by: Misha Sugakov <[email protected]> Co-authored-by: Tom Martensen <[email protected]>
1 parent d2def04 commit b5fcac7

20 files changed

+13950
-551
lines changed

‎.github/CODEOWNERS

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,8 @@
88
RELEASED_VERSIONS @stackrox/collector-team
99
RELEASED_VERSIONS.unsupported @stackrox/collector-team
1010

11-
# The RHTAP maintainers for ACS review all changes related to the RHTAP pipelines, such as new pipelines,
12-
# parameter changes or automated task updates.
13-
/.tekton/ @stackrox/rhtap-maintainers
14-
/.konflux/ @stackrox/rhtap-maintainers
11+
# The RHTAP maintainers for ACS review all changes related to the Konflux (f.k.a. RHTAP) pipelines, such as new
12+
# pipelines, parameter changes or automated task updates as well as Dockerfile updates.
13+
**/konflux.*Dockerfile @stackrox/rhtap-maintainers
14+
/.tekton/ @stackrox/rhtap-maintainers
15+
rpms.* @stackrox/rhtap-maintainers

‎.github/renovate.json5

Lines changed: 42 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,37 +2,73 @@
22
// This configures Konflux Renovate bot, the thing that keeps our pipelines use up-to-date tasks.
33

44
// After making changes to this file, you can validate it by running something like this in the root of the repo:
5-
// $ docker run --rm -it --entrypoint=/usr/local/bin/renovate-config-validator -v "$(pwd)":/mnt -w /mnt renovate/renovate --strict
5+
// $ docker run --rm -it --entrypoint=renovate-config-validator -v "$(pwd)":/mnt -w /mnt renovate/renovate --strict
6+
// Note: ignore errors about the config for `rpm`. This is to be addressed with https://issues.redhat.com/browse/CWFHEALTH-4117
67
// There are more validation options, see https://docs.renovatebot.com/config-validation/
78

89
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
910
"extends": [
10-
// This inherits the base Konflux config.
11-
// Clickable link https://github.com/konflux-ci/mintmaker/blob/main/config/renovate/renovate.json
12-
// The following was used as example (we may want to check it if the base config gets suddenly moved):
11+
// Note that the base Konflux's MintMaker config gets inherited/included automatically per
12+
// https://redhat-internal.slack.com/archives/C04PZ7H0VA8/p1745492139282819?thread_ts=1745309786.090319&cid=C04PZ7H0VA8
13+
// The config is: https://github.com/konflux-ci/mintmaker/blob/main/config/renovate/renovate.json
14+
// We found out about it here (we may want to check that location if the base config gets suddenly moved):
1315
// https://github.com/enterprise-contract/ec-cli/blob/407847910ad420850385eea1db78e2a2e49c7e25/renovate.json#L1C1-L7C2
14-
"github>konflux-ci/mintmaker//config/renovate/renovate.json"
16+
17+
// This tells Renovate to combine all updates in one PR so that we have fewer PRs to deal with.
18+
"group:all",
1519
],
1620
"timezone": "Etc/UTC",
1721
"schedule": [
1822
// Allowed syntax: https://docs.renovatebot.com/configuration-options/#schedule
1923
// The time was selected (with the help of https://time.fyi/timezones) so that Renovate isn't active during business
2024
// hours from Germany to US West Coast. This way, after we merge a PR, a new one does not pop up immediately after
2125
// that.
22-
"after 3am and before 7am"
26+
"after 3am and before 7am",
2327
],
2428
// Tell Renovate not to update PRs when outside of schedule.
2529
"updateNotScheduled": false,
30+
"tekton": {
31+
"schedule": [
32+
// Override Konflux custom schedule for this manager to our intended one.
33+
"after 3am and before 7am",
34+
],
35+
"packageRules": [
36+
// Note: the packageRules from the Konflux config (find URL in comments above) get merged with these.
37+
{
38+
"groupName": "StackRox custom Konflux Tasks",
39+
"matchPackageNames": [
40+
"/^quay.io/rhacs-eng/konflux-tasks/",
41+
],
42+
},
43+
],
44+
},
2645
"dockerfile": {
2746
"includePaths": [
2847
// Instruct Renovate not try to update Dockerfiles other than konflux.Dockerfile (or konflux.anything.Dockerfile)
2948
// to have less PR noise.
3049
"**/*konflux*.Dockerfile",
3150
],
51+
"schedule": [
52+
// Override Konflux custom schedule for this manager to our intended one.
53+
"after 3am and before 7am",
54+
],
55+
"postUpgradeTasks": {
56+
"commands": [
57+
// Refresh the rpm lockfile after updating image references in the dockerfile.
58+
"rpm-lockfile-prototype rpms.in.yaml",
59+
],
60+
},
61+
},
62+
"rpm": {
63+
"schedule": [
64+
// Override Konflux custom schedule for this manager to our intended one.
65+
"after 3am and before 7am",
66+
],
3267
},
3368
"enabledManagers": [
3469
// Restrict Renovate focus on Konflux things since we rely on GitHub's dependabot for everything else.
3570
"tekton",
3671
"dockerfile",
72+
"rpm",
3773
],
3874
}

‎.github/workflows/integration-test-containers.yml

Lines changed: 33 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,10 @@ on:
1616
type: boolean
1717
required: true
1818
description: Whether the QA containers should be rebuilt
19+
is-konflux:
20+
type: boolean
21+
default: false
22+
description: The current workflow is tied to konflux
1923
outputs:
2024
collector-tests-tag:
2125
description: The tag used for the integration test image
@@ -75,11 +79,11 @@ jobs:
7579

7680
- name: Create Ansible Vars (inc. Secrets)
7781
run: |
78-
{
79-
echo "---"
80-
echo "rhacs_eng_username: ${{ secrets.QUAY_RHACS_ENG_RW_USERNAME }}"
81-
echo "rhacs_eng_password: ${{ secrets.QUAY_RHACS_ENG_RW_PASSWORD }}"
82-
} > ${{ github.workspace }}/ansible/secrets.yml
82+
cat << EOF > ${{ github.workspace }}/ansible/secrets.yml
83+
---
84+
rhacs_eng_username: ${{ secrets.QUAY_RHACS_ENG_RW_USERNAME }}
85+
rhacs_eng_password: ${{ secrets.QUAY_RHACS_ENG_RW_PASSWORD }}
86+
EOF
8387
8488
if [[ "${RUNNER_DEBUG}" == "1" ]]; then
8589
echo "ANSIBLE_STDOUT_CALLBACK=debug" >> "${GITHUB_ENV}"
@@ -98,12 +102,32 @@ jobs:
98102
echo "COLLECTOR_TESTS_TAG=${COLLECTOR_TESTS_TAG}" >> "$GITHUB_ENV"
99103
echo "collector-tests-tag=${COLLECTOR_TESTS_TAG}" >> "$GITHUB_OUTPUT"
100104
105+
- name: Check if multiarch is needed
106+
run: |
107+
BUILD_MULTI_ARCH="false"
108+
109+
if [[ "${GITHUB_EVENT_NAME}" != "pull_request" ]]; then
110+
BUILD_MULTI_ARCH="true"
111+
fi
112+
113+
if [[ "${{ inputs.is-konflux }}" == "true" ]]; then
114+
BUILD_MULTI_ARCH="true"
115+
fi
116+
117+
if [[ "${{ contains(github.event.pull_request.labels.*.name, 'run-multiarch-builds') }}" == "true" ]]; then
118+
BUILD_MULTI_ARCH="true"
119+
fi
120+
121+
if [[ "${{ contains(github.event.pull_request.labels.*.name, 'run-cpaas-steps') }}" == "true" ]]; then
122+
BUILD_MULTI_ARCH="true"
123+
fi
124+
125+
echo "BUILD_MULTI_ARCH=${BUILD_MULTI_ARCH}" >> "$GITHUB_ENV"
126+
101127
- name: Build images
102128
run: |
103129
ansible-galaxy install -r ansible/requirements.yml
104130
105-
BUILD_MULTI_ARCH="${{ contains(github.event.pull_request.labels.*.name, 'run-multiarch-builds') || contains(github.event.pull_request.labels.*.name, 'run-cpaas-steps') || github.event_name == 'push' || github.event_name == 'schedule' }}"
106-
107131
# build_multi_arch passed in as json to ensure boolean type
108132
ansible-playbook \
109133
--connection local -i localhost, --limit localhost \
@@ -151,6 +175,8 @@ jobs:
151175

152176
- name: Set up QEMU
153177
uses: docker/setup-qemu-action@v3
178+
with:
179+
image: tonistiigi/binfmt:qemu-v9.2.2
154180

155181
- name: Set up Docker Buildx
156182
uses: docker/setup-buildx-action@v3

‎.github/workflows/k8s-integration-tests.yml

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,11 @@ name: K8S based integration tests
33
on:
44
workflow_call:
55
inputs:
6+
collector-repo:
7+
description: |
8+
Optional repository to use for the collector image
9+
type: string
10+
default: "quay.io/rhacs-eng/collector"
611
collector-tag:
712
description: |
813
Tag used for running the integration tests
@@ -22,7 +27,7 @@ on:
2227
env:
2328
ANSIBLE_CONFIG: ${{ github.workspace }}/ansible/ansible.cfg
2429
COLLECTOR_TESTS_IMAGE: quay.io/rhacs-eng/collector-tests:${{ inputs.collector-tests-tag }}
25-
COLLECTOR_IMAGE: quay.io/rhacs-eng/collector:${{ inputs.collector-tag }}
30+
COLLECTOR_IMAGE: ${{ inputs.collector-repo }}:${{ inputs.collector-tag }}
2631

2732
jobs:
2833
k8s-integration-tests:

‎.github/workflows/konflux.yml

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,8 @@ jobs:
4545
4646
- id: generate-tag
4747
run: |
48-
echo "collector-tag=$(make tag)-fast" >> "$GITHUB_OUTPUT"
48+
COLLECTOR_TAG="$(make tag)-fast"
49+
echo "collector-tag=${COLLECTOR_TAG}" >> "$GITHUB_OUTPUT"
4950
5051
COLLECTOR_QA_TAG="$(cat ${{ github.workspace }}/integration-tests/container/QA_TAG)"
5152
if [[ "${GITHUB_EVENT_NAME}" == "pull_request" && "${{ steps.filter.outputs.container }}" == "true" ]]; then
@@ -62,7 +63,7 @@ jobs:
6263
- uses: stackrox/actions/release/wait-for-image@v1
6364
with:
6465
token: ${{ secrets.QUAY_RHACS_ENG_BEARER_TOKEN }}
65-
image: rhacs-eng/collector:${{ needs.init.outputs.collector-tag }}
66+
image: rhacs-eng/release-collector:${{ needs.init.outputs.collector-tag }}
6667
limit: 9000 # 2h30m
6768

6869
integration-tests-containers:
@@ -73,6 +74,7 @@ jobs:
7374
collector-tag: ${{ needs.init.outputs.collector-tag }}
7475
collector-qa-tag: ${{ needs.init.outputs.collector-qa-tag }}
7576
rebuild-qa-containers: ${{ needs.init.outputs.rebuild-qa-containers == 'true' }}
77+
is-konflux: true
7678
secrets: inherit
7779

7880
run-konflux-tests:
@@ -82,6 +84,7 @@ jobs:
8284
- wait-for-images
8385
- integration-tests-containers
8486
with:
87+
collector-repo: quay.io/rhacs-eng/release-collector
8588
collector-tag: ${{ needs.init.outputs.collector-tag }}
8689
collector-qa-tag: ${{ needs.init.outputs.collector-qa-tag }}
8790
collector-tests-tag: ${{ needs.integration-tests-containers.outputs.collector-tests-tag }}
@@ -93,6 +96,7 @@ jobs:
9396
k8s-integration-tests:
9497
uses: ./.github/workflows/k8s-integration-tests.yml
9598
with:
99+
collector-repo: quay.io/rhacs-eng/release-collector
96100
collector-tag: ${{ needs.init.outputs.collector-tag }}
97101
collector-qa-tag: ${{ needs.init.outputs.collector-qa-tag }}
98102
collector-tests-tag: ${{ needs.integration-tests-containers.outputs.collector-tests-tag }}

‎.github/workflows/main.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@ jobs:
8989
9090
- name: Run unit tests
9191
run: |
92-
ctest -V --test-dir cmake-build
92+
ctest --no-tests=error -V --test-dir cmake-build
9393
9494
integration-tests:
9595
uses: ./.github/workflows/integration-tests.yml

‎.konflux/README.md

Lines changed: 0 additions & 3 deletions
This file was deleted.

‎.konflux/scripts/fail-build-if-git-is-dirty.sh

Lines changed: 0 additions & 34 deletions
This file was deleted.

0 commit comments

Comments
 (0)