Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
@@ -0,0 +1,157 @@
base_images:
assisted-installer:
name: v2.53
namespace: edge-infrastructure
tag: assisted-installer
assisted-installer-agent:
name: v2.53
namespace: edge-infrastructure
tag: assisted-installer-agent
assisted-installer-controller:
name: v2.53
namespace: edge-infrastructure
tag: assisted-installer-controller
assisted-service:
name: v2.53
namespace: edge-infrastructure
tag: assisted-service
assisted-test-infra:
name: backplane-5.0
namespace: edge-infrastructure
tag: assisted-test-infra
assisted-test-infra-internal:
name: backplane-5.0
namespace: edge-infrastructure
tag: assisted-test-infra-internal
dev-scripts:
name: test
namespace: ocp-kni
tag: dev-scripts
build_root:
from_repository: true
images:
items:
- dockerfile_path: Dockerfile.image-service
to: assisted-image-service
- dockerfile_path: Dockerfile.image-service-build
to: assisted-image-service-build
promotion:
to:
- name: v2.53
namespace: edge-infrastructure
releases:
latest:
candidate:
product: ocp
stream: nightly
version: "4.22"
latest-multi:
candidate:
architecture: multi
product: ocp
stream: nightly
version: "4.22"
resources:
'*':
requests:
cpu: 100m
memory: 200Mi
tests:
- as: mirror-vcsref-image
postsubmit: true
steps:
dependencies:
SOURCE_IMAGE_REF: assisted-image-service
env:
RELEASE_TAG_PREFIX: hotfix
test:
- ref: assisted-baremetal-images-publish
- as: lint
commands: |
export GOCACHE=/tmp/
export GOLANGCI_LINT_CACHE=/tmp/.cache
export GOPROXY=https://proxy.golang.org
make lint
container:
clone: true
from: assisted-image-service-build
skip_if_only_changed: \.md$|^(?:.*/)?(?:\.gitignore|.tekton/.*|OWNERS|OWNERS_ALIASES|LICENSE)$
- as: test
commands: |
export GOCACHE=/tmp/gocache
export GOMODCACHE=/tmp/gomodcache
export CODECOV_TOKEN=$(cat /tmp/secret/codecov-token)
make test
container:
clone: true
from: assisted-image-service-build
secret:
mount_path: /tmp/secret
name: assisted-image-service-codecov-token
skip_if_only_changed: \.md$|^(?:.*/)?(?:\.gitignore|.tekton/.*|OWNERS|OWNERS_ALIASES|LICENSE)$
- as: e2e-metal-assisted
capabilities:
- intranet
skip_if_only_changed: \.md$|^(?:.*/)?(?:\.gitignore|.tekton/.*|OWNERS|OWNERS_ALIASES|LICENSE)$
steps:
cluster_profile: packet-assisted
env:
ASSISTED_CONFIG: |
SERVICE_BASE_REF=v2.53
OPENSHIFT_VERSION=4.22
workflow: assisted-ofcir-baremetal
- always_run: false
as: e2e-metal-assisted-deploy-nodes
capabilities:
- intranet
optional: true
steps:
cluster_profile: packet-assisted
env:
ASSISTED_CONFIG: |
SERVICE_BASE_REF=v2.53
MAKEFILE_TARGET="deploy_nodes"
OPENSHIFT_VERSION=4.22
workflow: assisted-ofcir-baremetal
- always_run: false
as: e2e-metal-assisted-day2-arm-workers
optional: true
steps:
cluster_profile: packet-assisted
env:
ASSISTED_CONFIG: |
SERVICE_BASE_REF=v2.53
TEST_FUNC=test_deploy_day2_nodes_cloud
AGENT_DOCKER_IMAGE=quay.io/redhat-user-workloads/assisted-installer-tenant/assisted-installer-application-ds-main/assisted-installer-agent-ds-main:latest
CONTROLLER_IMAGE=quay.io/redhat-user-workloads/assisted-installer-tenant/assisted-installer-application-ds-main/assisted-installer-controller-ds-main:latest
INSTALLER_IMAGE=quay.io/redhat-user-workloads/assisted-installer-tenant/assisted-installer-application-ds-main/assisted-installer-ds-main:latest
Comment on lines +125 to +127
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Pin the day2 ARM worker images to immutable refs (not :latest).

Line 125–127 use mutable :latest tags, so this job can silently test code outside v2.53 and produce non-reproducible results. Please pin to the intended v2.53 tag or digest.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@ci-operator/config/openshift/assisted-image-service/openshift-assisted-image-service-v2.53.yaml`
around lines 125 - 127, The three image variables AGENT_DOCKER_IMAGE,
CONTROLLER_IMAGE, and INSTALLER_IMAGE are using mutable :latest tags; change
each to an immutable reference (either the v2.53 tag or an image digest) so the
job is reproducible—replace the :latest suffix with the explicit v2.53 tag (or
`@sha256`:<digest>) for each variable and verify the registry path and tag/digest
match the intended v2.53 artifacts for ARM worker images.

DAY2_CPU_ARCHITECTURE=arm64
OPENSHIFT_VERSION=4.22-multi
workflow: assisted-ofcir-baremetal-heterogeneous
- always_run: false
as: e2e-oci-assisted
optional: true
steps:
cluster_profile: oci-assisted
env:
ASSISTED_CONFIG: |
SERVICE_BASE_REF=v2.53
OPENSHIFT_VERSION=4.22
workflow: assisted-oci
- always_run: false
as: e2e-metal-assisted-external
capabilities:
- intranet
optional: true
steps:
cluster_profile: packet-assisted
env:
ASSISTED_CONFIG: |
SERVICE_BASE_REF=v2.53
PLATFORM=external
OPENSHIFT_VERSION=4.22
workflow: assisted-ofcir-baremetal
zz_generated_metadata:
branch: v2.53
org: openshift
repo: assisted-image-service
Loading