OCPEDGE-2815: tekton: add production and staging final pipelines - #2884
Open
jeff-roche wants to merge 10 commits into
Open
OCPEDGE-2815: tekton: add production and staging final pipelines#2884jeff-roche wants to merge 10 commits into
jeff-roche wants to merge 10 commits into
Conversation
openshift-ci
Bot
added
the
size/XL
|
Warning Review limit reached
Next review available in: 18 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (11)
WalkthroughAdds Konflux final pipelines for operator version bumps and catalog candidate updates, hardens catalog digest resolution, removes the obsolete catalog build pipeline, and documents Konflux release automation and build workflows. ChangesKonflux release automation
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)Catalog candidate updatesequenceDiagram
participant FinalPipeline
participant Registry
participant GitHubAPI
participant PullRequest
FinalPipeline->>Registry: Regenerate catalog templates
FinalPipeline->>GitHubAPI: Create signed catalog commit
GitHubAPI->>PullRequest: Create or reuse pull request
FinalPipeline->>PullRequest: Apply labels
Operator version bumpsequenceDiagram
participant FinalPipeline
participant ReleaseBranch
participant GitHubAPI
participant PullRequest
FinalPipeline->>ReleaseBranch: Read and validate operator version
FinalPipeline->>GitHubAPI: Create signed version commit
GitHubAPI->>PullRequest: Create or reuse pull request
FinalPipeline->>PullRequest: Apply labels
Suggested reviewers: 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✨ Finishing Touches 💡 1⚔️ Resolve merge conflicts 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
jeff-roche
changed the title
|
@jeff-roche: This pull request references OCPEDGE-2815 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the spike to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci-robot
added
the
jira/valid-reference
Contributor
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: jeff-roche The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
Contributor
Author
|
These pipelines depend on https://redhat.atlassian.net/browse/DPP-21582 which will install the app I created to this repo so that we can add some credentials to konflux for the version bump and catalog regen automations |
Contributor
Author
|
/hold for DPP app install approval since this relies on that. |
openshift-ci
Bot
added
the
do-not-merge/hold
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 10
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.tekton/catalog-candidate-update-staging-final-pipeline.yaml:
- Around line 70-75: Remove the obsolete components-namespace-pull secret
dependency from the pipeline: delete its volume definition, corresponding volume
mount, and any authentication merge referencing it. Keep the
registry-redhat-io-docker configuration and public Quay repository usage
unchanged.
- Around line 182-202: Update the GitHub API workflow around GITHUB_TOKEN
creation and the PR/ref/label operations through the completion output to use
curl --fail-with-body, so HTTP failures stop the pipeline instead of being
treated as successful responses. Validate required response fields, including a
non-empty token and valid PR URL/identifier, before publishing CHANGED=true or
reporting success; preserve the existing successful flow when all API responses
are valid.
- Around line 216-226: Add a signed-off-by trailer to the generated commit by
extending the GraphQL `message` object in the `CreateCommitOnBranch` mutation
with the required body field, while preserving the existing headline and commit
inputs.
- Around line 89-99: Update the tool installation steps around the skopeo and yq
downloads to avoid mutable or unverified artifacts: use a pinned tool image or
fixed release URLs, pin yq to an explicit version instead of querying latest,
and verify each downloaded binary against its published SHA256 checksum before
chmod or use. Keep the existing TOOL_DIR installation flow intact.
- Around line 66-76: Add a shared emptyDir volume for /workspace/tools in the
pipeline pod, then mount it at that path in both the install-tools and
update-and-pr steps so installed binaries are available across containers.
In @.tekton/operator-version-bump-production-final-pipeline.yaml:
- Around line 150-161: Update the branch handling around PR_BRANCH so it first
checks for the matching automation-created PR and verifies the existing branch
belongs to that PR before resetting it. If the branch exists without a matching
PR, fail the pipeline instead of force-resetting it; retain branch creation only
when no branch exists.
- Around line 134-148: Validate NEXT_VERSION after resolving the requested or
auto-incremented value and before writing the result, modifying NEW_CONTENT, or
constructing PR_BRANCH. Require a well-formed semantic version and ensure it is
strictly greater than CURRENT_VERSION; reject malformed, equal, or lower values
with a clear configuration error and stop the task. Use the existing version
components or an appropriate comparison method, and ensure the validated value
is safe for the sed expression and branch name.
- Around line 212-223: Update the PR creation and labeling curl calls in the
pipeline to use fail-on-HTTP-error behavior, then validate that the parsed
PR_URL/html_url and PR_NUMBER/number are non-empty and not null before applying
labels or writing results.PR_URL. Ensure any invalid API response causes the
step to fail rather than continuing with a missing PR reference.
- Around line 165-182: Update the GraphQL payload in the commit-creation block
to extend message beyond headline with a body describing the operator version
bump and a Signed-off-by trailer, using the contributor identity expected by
CONTRIBUTING.md. Keep the existing headline, branch, expectedHeadOid, and
fileChanges fields unchanged.
In `@release/hack/generate_catalog_template.sh`:
- Around line 4-6: Make the tag discovery and digest lookup commands in the
catalog template generation script fail explicitly when either registry query
fails. Validate the result of skopeo list-tags and the later digest lookup
before generating or writing any template updates, and stop execution rather
than allowing empty tag data or an empty “@” reference to be emitted.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: fdea3ba7-23d6-47a3-9d57-1f3c40cc007e
📒 Files selected for processing (3)
.tekton/catalog-candidate-update-staging-final-pipeline.yaml.tekton/operator-version-bump-production-final-pipeline.yamlrelease/hack/generate_catalog_template.sh
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@release/hack/generate_catalog_template.sh`:
- Around line 59-61: Limit the retry loop around skopeo inspect in the
digest-generation flow to a finite number of attempts, incrementing and checking
a retry counter while preserving the existing delay between attempts. After the
maximum is reached, exit with a clear failure instead of continuing
indefinitely.
- Around line 2-14: Update the digests associative-array lookup in the script to
safely handle versions that have no populated key under set -u, using a
default-aware existence/value check before comparing or consuming the entry.
Also make TARGET_VERSIONS access tolerate being unset when running locally,
while preserving the existing behavior when it is provided.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 2e78631e-0a54-45dd-a6f0-6ef6f75e7a84
📒 Files selected for processing (3)
.tekton/catalog-candidate-update-staging-final-pipeline.yaml.tekton/operator-version-bump-production-final-pipeline.yamlrelease/hack/generate_catalog_template.sh
🚧 Files skipped from review as they are similar to previous changes (2)
- .tekton/operator-version-bump-production-final-pipeline.yaml
- .tekton/catalog-candidate-update-staging-final-pipeline.yaml
openshift-ci
Bot
added
size/XXL
There was a problem hiding this comment.
Actionable comments posted: 8
🧹 Nitpick comments (1)
release/hack/generate_catalog_template.sh (1)
45-45: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueUse pattern matching for literal substring searches.
Using quotes on the right-hand side of
=~forces a literal match and triggers ShellCheck warnings (SC2076). Standard glob pattern matching (!= *...*) is more idiomatic for checking if an item exists in a space-separated string.♻️ Proposed refactor
- if [[ -n "${TARGET_VERSIONS[*]+set}" ]] && ! [[ " ${TARGET_VERSIONS[*]} " =~ " ${maxVersion} " ]]; then + if [[ -n "${TARGET_VERSIONS[*]+set}" ]] && [[ " ${TARGET_VERSIONS[*]} " != *" ${maxVersion} "* ]]; then🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@release/hack/generate_catalog_template.sh` at line 45, Update the TARGET_VERSIONS membership condition near maxVersion to use unquoted glob pattern matching with != and *...* instead of the quoted =~ regular-expression check, while preserving the existing unset/empty handling and space-delimited membership behavior.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/decisions/0013-konflux-final-pipelines-for-release-automation.md`:
- Around line 2-3: Synchronize ADR 0013’s lifecycle status across both
references: update the frontmatter status in
docs/decisions/0013-konflux-final-pipelines-for-release-automation.md at lines
2-3 and apply the identical intended status to its decision-log entry in
docs/decisions/index.md at line 23.
In `@docs/konflux/file-based-catalog.md`:
- Line 5: Update the introductory sentence in the file-based catalog
documentation to capitalize “Konflux,” hyphenate “operator-specific,” and
correct “repositor” to “repository,” without changing the surrounding wording.
- Line 144: Correct the spelling in the sentence describing the custom build
pipeline by changing “catlaogs” to “catalogs.”
- Around line 36-38: Update the lifecycle documentation around “New Bundle SHA
(no version change)” and the referenced version/template update section to
reflect the final pipelines: remove Mintmaker’s staging-update responsibility
and manual version/template PR instructions, state that the production pipeline
handles version bumps, and document that the staging final pipeline runs make
catalog-template and creates or updates the persistent PR.
In `@docs/konflux/README.md`:
- Line 1: Update the README title heading to hyphenate the compound adjective,
using “Konflux-Based Build and Release Management.”
- Around line 228-232: Update the wording in the konflux.make documentation to
hyphenate “top-level” before “LVM Operator `Makefile`,” without changing the
surrounding content.
- Around line 191-195: Update the container-build.args documentation in
docs/konflux/README.md lines 191-195 to remove the offline-registry claim and
describe public Quay lookups with staging pullspec output. Apply the
corresponding clarification in docs/konflux/file-based-catalog.md lines 191-195:
candidate tags and digests come from the public Quay tenant, while generated
references retain staging registry paths.
In `@docs/konflux/release-management.md`:
- Line 73: Correct the typo in the catalog release description by changing
“offical” to “official,” leaving the surrounding text unchanged.
---
Nitpick comments:
In `@release/hack/generate_catalog_template.sh`:
- Line 45: Update the TARGET_VERSIONS membership condition near maxVersion to
use unquoted glob pattern matching with != and *...* instead of the quoted =~
regular-expression check, while preserving the existing unset/empty handling and
space-delimited membership behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: d427a2b0-2604-4153-84f5-6238ae52a405
📒 Files selected for processing (8)
.tekton/catalog-build-pipeline.yamldocs/decisions/0013-konflux-final-pipelines-for-release-automation.mddocs/decisions/index.mddocs/konflux/README.mddocs/konflux/file-based-catalog.mddocs/konflux/operator-bundle-lifecycle.mddocs/konflux/release-management.mdrelease/hack/generate_catalog_template.sh
💤 Files with no reviewable changes (1)
- .tekton/catalog-build-pipeline.yaml
Comment on lines
+191
to
+195
| ### `container-build.args` | ||
|
|
||
| The single source of truth for version metadata, consumed by all Dockerfiles | ||
| via buildah's `--build-arg-file`: | ||
|
|
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Correct the documented registry contract.
docs/konflux/README.md#L191-L195: Remove the “offline” claim and document public Quay lookup plus staging pullspec output.docs/konflux/file-based-catalog.md#L191-L195: Explain that candidate tags/digests come from the public Quay tenant while generated references retain staging paths.
📍 Affects 2 files
docs/konflux/README.md#L191-L195(this comment)docs/konflux/file-based-catalog.md#L191-L195
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/konflux/README.md` around lines 191 - 195, Update the
container-build.args documentation in docs/konflux/README.md lines 191-195 to
remove the offline-registry claim and describe public Quay lookups with staging
pullspec output. Apply the corresponding clarification in
docs/konflux/file-based-catalog.md lines 191-195: candidate tags and digests
come from the public Quay tenant, while generated references retain staging
registry paths.
jeff-roche
force-pushed
the
konflux-final-pipelines
branch
from
July 20, 2026 20:31
d1bf894 to
719fe41
Compare
openshift-ci
Bot
removed
the
needs-rebase
| 2. Run `RELEASE_SNAPSHOT="<snapshot>" make release` on the `release-management` branch to generate the `Release` YAML | ||
| 3. Populate Jira/CVE information (pass `JIRA_XML=/path/to/export.xml` to auto-parse) | ||
| 4. Update the release notes description in the generated YAML | ||
| 5. Open a PR — requires docs and QE approval |
Contributor
There was a problem hiding this comment.
Right now i see PR's getting created first atleast for z-streams, QE tests get triggered via presbumits, if all good, qe adds QE approval and request for doc approval. If something fails review via CI doctor and qe applies the label.
openshift-ci
Bot
added
the
needs-rebase
Use quay.io/redhat-user-workloads/logical-volume-manag-tenant/lvm-operator-bundle for tag listing and candidate digest resolution instead of registry.stage.redhat.io, avoiding the need for a staging registry pull secret in automation. The staging registry path is still used when writing the candidate template's output image references. Assisted-by: Claude <noreply@anthropic.com> Signed-off-by: Jeff Roche <jeroche@redhat.com>
Add two Konflux final pipelines to keep OLM catalog templates current across the release lifecycle: - operator-version-bump-production-final-pipeline: runs after a successful operator production release. Bumps OPERATOR_VERSION in release/container-build.args and opens a PR. Does not touch catalog templates; merging the PR triggers the normal build cascade (operator rebuild, then bundle rebuild) that eventually reaches the bundle's staging release. - catalog-candidate-update-staging-final-pipeline: runs after the lvm-operator-bundle component releases to staging. Regenerates both catalog templates via generate_catalog_template.sh and opens or updates a persistent PR if anything changed; skips cleanly otherwise. Both pipelines authenticate as a GitHub App and create commits via the GitHub GraphQL createCommitOnBranch mutation so they are signed/verified by GitHub without needing a separate signing key. PRs are labeled approved/lgtm and titled with the NO-JIRA: prefix to match existing automation conventions in this repo. Assisted-by: Claude <noreply@anthropic.com> Signed-off-by: Jeff Roche <jeroche@redhat.com>
Both final pipelines used curl -sS without -f, so a failed GitHub App token exchange, ref/PR/label call could leave the pipeline reporting success with a null or missing PR reference. Add -f to the mutating GitHub API calls and validate token/PR responses before continuing. Also: - Guard the operator-version-bump pipeline's next-version param: reject malformed or non-increasing values before they reach the file, sed expression, and branch name. - Look up the automation's PR before deciding whether an existing bump-operator-version-* branch is safe to force-reset, instead of resetting whatever happens to already exist at that name. - Add a commit body and Signed-off-by trailer to both pipelines' generated commits per CONTRIBUTING.md's commit conventions. - Add errexit to generate_catalog_template.sh so a failed skopeo list-tags/inspect call stops the script instead of producing an empty or malformed catalog template; convert the released-digest retry loop to an until-loop so it keeps retrying correctly under errexit. Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Assisted-by: Claude <noreply@anthropic.com> Signed-off-by: Jeff Roche <jeroche@redhat.com>
Add comprehensive documentation for the Konflux CI/CD system covering build pipelines, release management, the file-based catalog lifecycle, and operator bundle builds. Assisted-by: Claude <noreply@anthropic.com>
Signed-off-by: Jeff Roche <jeroche@redhat.com>
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/konflux/README.md`:
- Around line 61-83: Update the `.tekton/` inventory in the README to include
both new final pipeline files, classifying them as pipeline definitions. Revise
the resource counts and category descriptions to reflect the added pipeline
definitions and total resources, while keeping the existing PipelineRun and
supporting-configuration entries accurate.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: 61058131-2107-43c2-9cd0-c5a6a77009e2
📒 Files selected for processing (10)
.tekton/catalog-build-pipeline.yaml.tekton/catalog-candidate-update-staging-final-pipeline.yaml.tekton/operator-version-bump-production-final-pipeline.yamldocs/decisions/0013-konflux-final-pipelines-for-release-automation.mddocs/decisions/index.mddocs/konflux/README.mddocs/konflux/file-based-catalog.mddocs/konflux/operator-bundle-lifecycle.mddocs/konflux/release-management.mdrelease/hack/generate_catalog_template.sh
💤 Files with no reviewable changes (1)
- .tekton/catalog-build-pipeline.yaml
🚧 Files skipped from review as they are similar to previous changes (6)
- docs/decisions/index.md
- docs/konflux/operator-bundle-lifecycle.md
- .tekton/catalog-candidate-update-staging-final-pipeline.yaml
- docs/konflux/release-management.md
- docs/decisions/0013-konflux-final-pipelines-for-release-automation.md
- .tekton/operator-version-bump-production-final-pipeline.yaml
…og version management Signed-off-by: Jeff Roche <jeroche@redhat.com>
Limit the skopeo inspect retry loop to MAX_RETRIES (5) attempts instead of looping indefinitely on persistent failures. Use default-aware parameter expansion (+set) for digests associative array lookups and TARGET_VERSIONS access so the script is safe under set -u and tolerates running locally without TARGET_VERSIONS defined. Assisted-by: Claude <noreply@anthropic.com>
Corrects stale lifecycle docs (Mintmaker nudge, manual version-bump/ catalog-template steps) to reflect the new final pipelines, fixes the ADR-0013 status mismatch, corrects several typos/wording issues, and switches the TARGET_VERSIONS membership check to a glob pattern.
Co-authored-by: Kasturi Narra <knarra@redhat.com>
jeff-roche
force-pushed
the
konflux-final-pipelines
branch
from
July 29, 2026 14:08
a3a3601 to
1057601
Compare
openshift-ci
Bot
removed
the
needs-rebase
- Correct file-based-catalog.md registry contract: candidate bundle tags/digests come from the public Konflux Quay tenant, not private - Add the two final pipeline files to the README .tekton/ inventory and update pipeline definition counts/description accordingly - Add Kasturi Narra as a decision-maker on ADR-0013
jeff-roche
force-pushed
the
konflux-final-pipelines
branch
from
July 29, 2026 14:34
1057601 to
e12c276
Compare
Contributor
|
@jeff-roche: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds two Konflux final pipelines to keep OLM catalog templates current across the release lifecycle, and a small supporting change to
generate_catalog_template.sh:operator-version-bump-production-final-pipeline— runs after a successful operator production release. BumpsOPERATOR_VERSIONinrelease/container-build.argsand opens a PR. Does not touch catalog templates directly; merging the PR triggers the normal build cascade (operator rebuild, then bundle rebuild) that eventually reaches the bundle's staging release.catalog-candidate-update-staging-final-pipeline— runs after thelvm-operator-bundlecomponent releases to staging. Regenerates both catalog templates viagenerate_catalog_template.shand opens/updates a persistent PR if anything changed; skips cleanly if there's nothing new.release/hack/generate_catalog_template.sh— candidate bundle tag listing and digest resolution now goes through the publicquay.io/redhat-user-workloads/...tenant workload repo instead ofregistry.stage.redhat.io, avoiding the need for a staging registry pull secret in automation. Output image references still use the staging registry path.Design notes
createCommitOnBranchmutation rather thangit push, so commits are signed/verified by GitHub without a separate signing key.approved/lgtmand titled with theNO-JIRA:prefix, matching this repo's existing mintmaker automation conventions.registry-redhat-io-dockerandcomponents-namespace-pullpull secrets to authenticateskopeoagainst bothregistry.redhat.ioand the private Quay tenant repo in the same run.Post-implementation steps (tracked in OCPEDGE-2815)
Provisioning the
github-app-credentialssecret and wiring both pipelines into their respective Konflux ReleasePlans is tracked separately, since that infrastructure lives outside this repo.AI-Assisted Contribution
This PR was developed collaboratively with Claude Code. The two
.tekton/pipeline YAMLs were AI-generated based on human-directed design discussion (trigger model, auth approach, idempotency, PR-reuse strategy, signed-commit requirement). Thegenerate_catalog_template.shchange was authored directly by the human contributor. All changes have been human-reviewed.Testing
Both pipelines depend on live Konflux infrastructure (ReleasePlans, secrets) that hasn't been provisioned yet, so they haven't been run end-to-end. What was validated locally:
.tekton/conventions in this reposhellcheck(no real issues — only expected false positives from Tekton's$(results.x.path)/$(params.x)templating syntax, which shellcheck reads as literal command substitution)$(...)command substitution) and a missingContent-Type: application/jsonheader on several REST callsA manual test plan for each pipeline (post-secret-provisioning) is documented in a follow-up doc tracked internally.
Summary by CodeRabbit