test(ci): pin RHDH 1.10 RC image (1.10-128) in showcase value files

[gustavolira]

Summary

Force the release-1.10 e2e jobs to deploy the RHDH 1.10 RC image quay.io/rhdh/rhdh-hub-rhel9:1.10-128 (digest sha256:943af223a509add22de5c2da2803d363f0219eabaa96df945bb11c85f851b920).

Changes

1. .ci/pipelines/env_variables.sh — force IMAGE_REGISTRY / IMAGE_REPO / TAG_NAME to the RC image. This is the change that actually takes effect, because helm::get_image_params() (.ci/pipelines/lib/helm.sh) injects --set upstream.backstage.image.{registry,repository,tag} from these vars, and --set overrides value files. Marked TEMPORARY — revert after RC testing.
2. .ci/pipelines/value_files/values_showcase.yaml and values_showcase-rbac.yaml — also pin upstream.backstage.image to the RC image, for documentation/consistency (effective only when CI does not pass image --set flags).

Notes

• Commits carry [skip-build] so Prow skips rebuilding the image and the e2e jobs run against the pre-built RC image.
• This is a temporary RC-validation change targeting release-1.10; the env_variables.sh override block should be reverted once validation is complete.

🤖 Generated with Claude Code

[rhdh-qodo-merge]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0)

1. Pinned image never applied 🐞 Bug ☼ Reliability

Description

The new pinned upstream.backstage.image.{registry,repository,tag} values in the showcase value
files are overridden in CI because helm::install always appends --set upstream.backstage.image.*
from helm::get_image_params(). Since env_variables.sh assigns defaults for
IMAGE_REGISTRY/IMAGE_REPO, the pinned image can be silently replaced, causing release-1.10 tests
to run a different image than the value files specify.

Code

.ci/pipelines/value_files/values_showcase.yaml[R136-140]

Relevance

⭐ Low

Team treats --set/env as source of truth; PRs removed image pins from values to avoid drift.

PR-#4457
PR-#4463

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The values files set the pinned image, but the CI Helm path always passes `--set
upstream.backstage.image.*` from env-derived variables, which take precedence over value files.
Additionally, env_variables.sh provides defaults for IMAGE_REGISTRY/IMAGE_REPO, so the
override path is active even when jobs don't explicitly provide these vars.

.ci/pipelines/value_files/values_showcase.yaml[135-141]
.ci/pipelines/value_files/values_showcase-rbac.yaml[151-157]
.ci/pipelines/lib/helm.sh[218-229]
.ci/pipelines/lib/helm.sh[256-262]
.ci/pipelines/env_variables.sh[44-48]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Showcase value files now pin `upstream.backstage.image.*`, but CI Helm installs always override these fields via `--set upstream.backstage.image.{registry,repository,tag}=...` from environment variables. Because `IMAGE_REGISTRY`/`IMAGE_REPO` are defaulted in `env_variables.sh`, the override happens even when jobs don't explicitly set image params, so the pin in the values files is effectively ignored.

## Issue Context
`helm::install` appends `$(helm::get_image_params)` unconditionally, and `helm::get_image_params` always emits all three `--set` flags. `env_variables.sh` defaults `IMAGE_REGISTRY` and `IMAGE_REPO`, making the override path always active.

## Fix Focus Areas
- .ci/pipelines/lib/helm.sh[218-262]
- .ci/pipelines/env_variables.sh[44-48]

### Concrete fix options (pick one)
1) **Add an explicit opt-out flag** (recommended):
  - Introduce e.g. `USE_VALUES_IMAGE=true` (or `SKIP_IMAGE_SET_FLAGS=true`).
  - In `helm::get_image_params`, return empty when the flag is set.
  - Set the flag in the specific release-1.10 jobs that should use the pinned values.

2) **Only emit `--set` flags when explicitly provided**:
  - Stop defaulting `IMAGE_REGISTRY`/`IMAGE_REPO` in `env_variables.sh` (or only default them when a separate `FORCE_IMAGE_PARAMS=true` is enabled).
  - In `helm::get_image_params`, only append `--set ...` for variables that are non-empty.

3) **If the intention is to override everywhere**, then remove the pin from the values files (since it is misleading) and instead set the desired defaults via env or job configuration.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

[github-actions]

The container image build and publish workflows were skipped (either due to [skip-build] tag or no relevant changes with existing image).

[rhdh-qodo-merge]

Review Summary by Qodo

Pin RHDH 1.10 RC image in showcase Helm value files

🧪 Tests

Walkthroughs

Description

• Pin RHDH 1.10 RC image (1.10-128) in showcase value files
• Update both showcase and showcase-rbac Helm value files
• Set explicit image registry, repository, and tag values
• Add clarifying comments about CI override behavior

Diagram

flowchart LR
  A["Showcase Value Files"] -->|"Pin image to"| B["quay.io/rhdh/rhdh-hub-rhel9:1.10-128"]
  B -->|"For release-1.10"| C["E2E Testing"]
  D["CI --set flags"] -.->|"May override"| B

Loading

File Changes

1. .ci/pipelines/value_files/values_showcase.yaml ⚙️ Configuration changes +5/-1

Pin RHDH 1.10 RC image in showcase values

• Replace generic image comment with pinned RHDH 1.10 RC image reference
• Set registry: quay.io, repository: rhdh/rhdh-hub-rhel9, tag: "1.10-128"
• Add clarifying comment about potential CI override via --set flags

.ci/pipelines/value_files/values_showcase.yaml

---

2. .ci/pipelines/value_files/values_showcase-rbac.yaml ⚙️ Configuration changes +5/-1

Pin RHDH 1.10 RC image in showcase-rbac values

• Replace generic image comment with pinned RHDH 1.10 RC image reference
• Set registry: quay.io, repository: rhdh/rhdh-hub-rhel9, tag: "1.10-128"
• Add clarifying comment about potential CI override via --set flags

.ci/pipelines/value_files/values_showcase-rbac.yaml

---

[github-actions]

The container image build and publish workflows were skipped (either due to [skip-build] tag or no relevant changes with existing image).

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[gustavolira]

/test ?

[gustavolira]

/test e2e-ocp-helm-nightly

[openshift-ci]

@gustavolira: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-ocp-helm-nightly	aa5dbf0	link	false	/test e2e-ocp-helm-nightly

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.