feat: migrate cli-yq BuildConfig to MultiArchBuildConfig#78301
feat: migrate cli-yq BuildConfig to MultiArchBuildConfig#78301Prucek wants to merge 1 commit intoopenshift:mainfrom
Conversation
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
WalkthroughThis change replaces a standard OpenShift BuildConfig for the cli-yq image with a new MultiArchBuildConfig, migrating the build configuration from the app.ci cluster to the build-clusters multiarch environment to support multi-architecture image builds for both x86_64 and aarch64 platforms. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ✅ 12✅ Passed checks (12 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: Prucek The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
openshift-merge-bot
Bot
added
the
rehearsals-ack
|
[REHEARSALNOTIFIER] Note: If this PR includes changes to step registry files ( |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In
`@clusters/build-clusters/multiarch_builds/supplemental-ci-images/cli-yq_mabc.yaml`:
- Around line 28-29: The script currently downloads yq to /tmp/yq and makes it
executable, but doesn't place it on PATH; update the download/install step to
write the binary into a directory on PATH (e.g., /usr/local/bin/yq) and set
executable permissions there so callers can run yq by name; specifically replace
references to /tmp/yq with a PATH location and ensure chmod +x is applied to
that target (and optionally verify installation with a --version check).
- Around line 28-29: The curl invocation that downloads "releases/latest" for yq
should be changed to a pinned release and an integrity check added: replace the
dynamic URL used in the curl that writes to /tmp/yq with a fixed versioned
release (keep ${ARCH} for arch-specific binary), download the corresponding
checksum (or signature) for that specific version, verify the binary against the
checksum (e.g., sha256) before chmod +x and installing, and fail the build if
verification does not match; update the comments near the curl and /tmp/yq usage
so the pinned VERSION and checksum verification steps are clear.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 309a9333-a4e4-4596-a478-fa651af6c3c7
📒 Files selected for processing (2)
clusters/app.ci/supplemental-ci-images/cli-yq.yamlclusters/build-clusters/multiarch_builds/supplemental-ci-images/cli-yq_mabc.yaml
💤 Files with no reviewable changes (1)
- clusters/app.ci/supplemental-ci-images/cli-yq.yaml
| curl -L "https://github.com/mikefarah/yq/releases/latest/download/yq_linux_${ARCH}" -o /tmp/yq && \ | ||
| chmod +x /tmp/yq |
There was a problem hiding this comment.
Install yq into PATH; /tmp/yq will not be callable as yq.
At Line 28–29, the binary is only placed in /tmp and chmodded. Consumers typically execute yq by name, so this can ship an image with no usable yq on PATH.
💡 Proposed fix
- curl -L "https://github.com/mikefarah/yq/releases/latest/download/yq_linux_${ARCH}" -o /tmp/yq && \
- chmod +x /tmp/yq
+ curl -fsSL "https://github.com/mikefarah/yq/releases/latest/download/yq_linux_${ARCH}" -o /usr/local/bin/yq && \
+ chmod 0755 /usr/local/bin/yq📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| curl -L "https://github.com/mikefarah/yq/releases/latest/download/yq_linux_${ARCH}" -o /tmp/yq && \ | |
| chmod +x /tmp/yq | |
| curl -fsSL "https://github.com/mikefarah/yq/releases/latest/download/yq_linux_${ARCH}" -o /usr/local/bin/yq && \ | |
| chmod 0755 /usr/local/bin/yq |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In
`@clusters/build-clusters/multiarch_builds/supplemental-ci-images/cli-yq_mabc.yaml`
around lines 28 - 29, The script currently downloads yq to /tmp/yq and makes it
executable, but doesn't place it on PATH; update the download/install step to
write the binary into a directory on PATH (e.g., /usr/local/bin/yq) and set
executable permissions there so callers can run yq by name; specifically replace
references to /tmp/yq with a PATH location and ensure chmod +x is applied to
that target (and optionally verify installation with a --version check).
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE="clusters/build-clusters/multiarch_builds/supplemental-ci-images/cli-yq_mabc.yaml"
echo "Inspect current download/install stanza:"
sed -n '22,32p' "$FILE"
echo
echo "Expected after fix:"
echo "- no 'releases/latest' URL"
echo "- checksum verification step present (e.g., sha256sum -c)"
echo "- fail-fast curl flags (e.g., -f)"
rg -n 'releases/latest|sha256sum -c|curl -f|curl -fsSL' "$FILE"Repository: openshift/release
Length of output: 811
Avoid floating latest binary downloads without integrity verification.
Using releases/latest at line 28 makes builds non-reproducible and increases supply-chain risk. Pin a yq version and verify the checksum before installation.
Proposed hardening
- curl -L "https://github.com/mikefarah/yq/releases/latest/download/yq_linux_${ARCH}" -o /tmp/yq && \
- chmod +x /tmp/yq
+ YQ_VERSION=v4.44.6 && \
+ curl -fsSL "https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/checksums" -o /tmp/yq.checksums && \
+ curl -fsSL "https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_${ARCH}" -o /usr/local/bin/yq && \
+ grep " yq_linux_${ARCH}$" /tmp/yq.checksums | sed 's# yq_linux_# /usr/local/bin/yq#' | sha256sum -c - && \
+ chmod 0755 /usr/local/bin/yq📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| curl -L "https://github.com/mikefarah/yq/releases/latest/download/yq_linux_${ARCH}" -o /tmp/yq && \ | |
| chmod +x /tmp/yq | |
| YQ_VERSION=v4.44.6 && \ | |
| curl -fsSL "https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/checksums" -o /tmp/yq.checksums && \ | |
| curl -fsSL "https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_${ARCH}" -o /usr/local/bin/yq && \ | |
| grep " yq_linux_${ARCH}$" /tmp/yq.checksums | sed 's# yq_linux_# /usr/local/bin/yq#' | sha256sum -c - && \ | |
| chmod 0755 /usr/local/bin/yq |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In
`@clusters/build-clusters/multiarch_builds/supplemental-ci-images/cli-yq_mabc.yaml`
around lines 28 - 29, The curl invocation that downloads "releases/latest" for
yq should be changed to a pinned release and an integrity check added: replace
the dynamic URL used in the curl that writes to /tmp/yq with a fixed versioned
release (keep ${ARCH} for arch-specific binary), download the corresponding
checksum (or signature) for that specific version, verify the binary against the
checksum (e.g., sha256) before chmod +x and installing, and fail the build if
verification does not match; update the comments near the curl and /tmp/yq usage
so the pinned VERSION and checksum verification steps are clear.
|
@Prucek: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
1 participant
Summary
cli-yqfrom aBuildConfigon app.ci to aMultiArchBuildConfiguname -mat build time for the yq binary downloadTest plan
yqandjqbinaries🤖 Generated with Claude Code
Summary by CodeRabbit
cli-yqbuild configuration to support multiple processor architectures (x86_64 and ARM64). The new multi-architecture build system automatically detects the target platform and compiles appropriate binaries, improving compatibility across different system architectures while maintaining all required dependencies.