Skip to content

Update ci-tools-build-root image#81746

Open
danilo-gemoli wants to merge 1 commit into
openshift:mainfrom
danilo-gemoli:chore/update-ci-tools-build-root
Open

Update ci-tools-build-root image#81746
danilo-gemoli wants to merge 1 commit into
openshift:mainfrom
danilo-gemoli:chore/update-ci-tools-build-root

Conversation

@danilo-gemoli

@danilo-gemoli danilo-gemoli commented Jul 10, 2026

Copy link
Copy Markdown
Contributor

Bump image version, Golang and oc client.

Summary by CodeRabbit

Updates the ci-tools-build-root CI image to OpenShift 1.26, including newer CentOS Stream 10 and Go tooling, the oc client version 4.22.4, and the corresponding image tag.

@openshift-merge-bot openshift-merge-bot Bot added the rehearsals-ack Signifies that rehearsal jobs have been acknowledged label Jul 10, 2026
@openshift-merge-bot

Copy link
Copy Markdown
Contributor

[REHEARSALNOTIFIER]
@danilo-gemoli: no rehearsable tests are affected by this change

Note: If this PR includes changes to step registry files (ci-operator/step-registry/) and you expected jobs to be found, try rebasing your PR onto the base branch. This helps pj-rehearse accurately detect changes when the base branch has moved forward.

@coderabbitai

coderabbitai Bot commented Jul 10, 2026

Copy link
Copy Markdown
Contributor

Walkthrough

The CI tools build configuration is updated from OpenShift 1.25 to 1.26, including CentOS Stream 10 base images, version 1.26.5, the OpenShift 4.22.4 client, and the corresponding output image tag.

Changes

CI tools build update

Layer / File(s) Summary
Update CI tools build inputs
clusters/build-clusters/build-shared/supplemental-ci-images/ci-tools-build-root_mabc.yaml
Updates the successful-build image tag, Dockerfile base image and version, OpenShift client URL, and Docker strategy base image for the 1.26 build.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

Suggested labels: lgtm, approved

Suggested reviewers: kaovilai, shubham-pampattiwar, Joeavaikath, mpryc

🚥 Pre-merge checks | ✅ 15
✅ Passed checks (15 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly summarizes the main change: updating the ci-tools-build-root image.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed PR only changes a CI image YAML; no Ginkgo tests or titles were added or edited.
Test Structure And Quality ✅ Passed Only a CI image YAML changed; no Ginkgo test code, fixtures, waits, or assertions were modified.
Microshift Test Compatibility ✅ Passed Only a CI build YAML changed; no new Ginkgo e2e tests or MicroShift-sensitive APIs/features were added.
Single Node Openshift (Sno) Test Compatibility ✅ Passed PR only updates a CI build YAML; no Ginkgo e2e tests or SNO-sensitive test code were added.
Topology-Aware Scheduling Compatibility ✅ Passed Changed file is a MultiArchBuildConfig for ci-tools-build-root; it only updates build image inputs and contains no pod scheduling fields.
Ote Binary Stdout Contract ✅ Passed Only a build-image YAML changed; no OTE binary code or stdout-writing process-level setup was modified.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed Only a build-config YAML changed; no Ginkgo/e2e tests or IPv4/external-connectivity assumptions were added.
No-Weak-Crypto ✅ Passed The only changed file is a CI build YAML bumping image/base versions and oc URL; it adds no MD5/SHA1/DES/RC4/ECB/custom crypto or secret comparisons.
Container-Privileges ✅ Passed The only changed manifest updates image/version tags and base images; it adds no privileged, host* , SYS_ADMIN, or allowPrivilegeEscalation settings.
No-Sensitive-Data-In-Logs ✅ Passed Only benign echo statements were added; no passwords, tokens, PII, session IDs, or internal hostnames are logged.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@openshift-ci openshift-ci Bot requested review from Prucek and pruan-rht July 10, 2026 13:47
@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 10, 2026
@hector-vido

Copy link
Copy Markdown
Contributor

/lgtm

@openshift-ci openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Jul 10, 2026
@openshift-ci

openshift-ci Bot commented Jul 10, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: danilo-gemoli, hector-vido

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@clusters/build-clusters/build-shared/supplemental-ci-images/ci-tools-build-root_mabc.yaml`:
- Line 18: The build publishes only the versioned ci-tools-build-root:1.26 tag
while consumers use ci-tools-build-root:latest. Update the image build
configuration to also publish the latest alias, or update all existing
ci-operator consumers to reference 1.26, ensuring producer and consumer tags
remain aligned.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 97dd8add-0691-42ef-ac39-0b21c3913543

📥 Commits

Reviewing files that changed from the base of the PR and between 56e5ba4 and 77a923b.

📒 Files selected for processing (1)
  • clusters/build-clusters/build-shared/supplemental-ci-images/ci-tools-build-root_mabc.yaml

kind: ImageStreamTag
namespace: ci
name: ci-tools-build-root:1.25
name: ci-tools-build-root:1.26

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

rg -n -C2 'ci-tools-build-root:(latest|1\.26)' .

Repository: openshift/release

Length of output: 746


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== all ci-tools-build-root references =="
rg -n -C2 'ci-tools-build-root:(latest|1\.26)|ci-tools-build-root' clusters ci-operator core-services services tools || true

echo
echo "== file under review =="
cat -n clusters/build-clusters/build-shared/supplemental-ci-images/ci-tools-build-root_mabc.yaml | sed -n '1,120p'

echo
echo "== any ImageStreamTag / retag / promotion references =="
rg -n -C3 'ImageStreamTag|tag:' clusters/build-clusters/build-shared/supplemental-ci-images ci-operator core-services services tools || true

Repository: openshift/release

Length of output: 50374


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== file under review =="
cat -n clusters/build-clusters/build-shared/supplemental-ci-images/ci-tools-build-root_mabc.yaml | sed -n '1,220p'

echo
echo "== nearby ci-tools-build-root manifests =="
fd -a 'ci-tools-build-root*.yaml' clusters/build-clusters/build-shared/supplemental-ci-images

echo
echo "== focused references to the image stream and tags =="
rg -n -C3 'ci-tools-build-root|ImageStreamTag|retag|promote|latest|1\.26' \
  clusters/build-clusters/build-shared/supplemental-ci-images \
  ci-operator/config/redhat-chaos/prow-scripts/redhat-chaos-prow-scripts-main__4.21-nightly-upgrade.yaml

Repository: openshift/release

Length of output: 19626


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== ci-tools-build-root definitions =="
rg -n -C4 'ci-tools-build-root' clusters core-services ci-operator services tools | head -n 300

echo
echo "== image stream/tag aliases around ci-tools-build-root =="
rg -n -C4 'kind: ImageStream|kind: ImageStreamTag|name: ci-tools-build-root|tag: latest|tag: 1\.26' clusters core-services ci-operator services tools | head -n 300

Repository: openshift/release

Length of output: 50373


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== files that define ci-tools-build-root =="
fd -a 'ci-tools-build-root*.yaml' clusters core-services ci-operator services tools || true

echo
echo "== exact ci-tools-build-root image stream/tag definitions =="
rg -n -C4 'name: ci-tools-build-root|ci-tools-build-root:latest|ci-tools-build-root:1\.26' \
  clusters core-services ci-operator services tools \
  --glob '*.yaml' --glob '*.yml' --max-count 80 || true

echo
echo "== any retag/promotion logic mentioning ci-tools-build-root =="
rg -n -C3 'ci-tools-build-root.*(latest|1\.26)|tag.*latest|ImageStreamTag' \
  clusters core-services ci-operator services tools \
  --glob '*.yaml' --glob '*.yml' --max-count 120 || true

Repository: openshift/release

Length of output: 50374


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== direct ci-tools-build-root definitions in the repo =="
rg -n --max-count 50 'ci-tools-build-root' clusters/build-clusters core-services ci-operator services tools \
  --glob '*.yaml' --glob '*.yml' || true

echo
echo "== any explicit latest/1.26 retagging for ci-tools-build-root =="
rg -n --max-count 50 'ci-tools-build-root:1\.26|ci-tools-build-root:latest|name:\s*ci-tools-build-root|tag:\s*(latest|1\.26)' \
  clusters/build-clusters core-services ci-operator services tools \
  --glob '*.yaml' --glob '*.yml' || true

Repository: openshift/release

Length of output: 50374


Keep the build-root tag aligned with existing consumers. This build publishes ci-tools-build-root:1.26, while the current ci-operator configs still pull ci-tools-build-root:latest. Add a latest alias or update those consumers so they pick up the new build.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@clusters/build-clusters/build-shared/supplemental-ci-images/ci-tools-build-root_mabc.yaml`
at line 18, The build publishes only the versioned ci-tools-build-root:1.26 tag
while consumers use ci-tools-build-root:latest. Update the image build
configuration to also publish the latest alias, or update all existing
ci-operator consumers to reference 1.26, ensuring producer and consumer tags
remain aligned.

@danilo-gemoli

Copy link
Copy Markdown
Contributor Author

/override ci/prow/cluster-manifest-verifier

@openshift-ci

openshift-ci Bot commented Jul 10, 2026

Copy link
Copy Markdown
Contributor

@danilo-gemoli: Overrode contexts on behalf of danilo-gemoli: ci/prow/cluster-manifest-verifier

Details

In response to this:

/override ci/prow/cluster-manifest-verifier

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

/retest-required

Remaining retests: 0 against base HEAD b7b2f4e and 2 for PR HEAD 77a923b in total

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

/retest-required

Remaining retests: 0 against base HEAD b6aaa20 and 1 for PR HEAD 77a923b in total

@openshift-ci

openshift-ci Bot commented Jul 10, 2026

Copy link
Copy Markdown
Contributor

@danilo-gemoli: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. lgtm Indicates that a PR is ready to be merged. rehearsals-ack Signifies that rehearsal jobs have been acknowledged

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants