From 02a8157fb906de9923edb086e089150afeebd369 Mon Sep 17 00:00:00 2001 From: Josh Branham Date: Mon, 14 Sep 2026 16:27:26 -0600 Subject: [PATCH 1/2] Add auto-release pipeline for tag pushes --- .tekton/image-push.yaml | 2 +- .tekton/image-tag-push.yaml | 68 +++++++++++++++++++++++++++++++++++++ CLAUDE.md | 8 +++-- README.md | 36 +++++--------------- config/Dockerfile | 3 ++ 5 files changed, 86 insertions(+), 31 deletions(-) create mode 100644 .tekton/image-tag-push.yaml diff --git a/.tekton/image-push.yaml b/.tekton/image-push.yaml index 6c03fc69..6b67eda4 100644 --- a/.tekton/image-push.yaml +++ b/.tekton/image-push.yaml @@ -15,11 +15,11 @@ metadata: "boilerplate/***".pathChanged() || "test/***".pathChanged() ) - creationTimestamp: labels: appstudio.openshift.io/application: boilerplate-master appstudio.openshift.io/component: image pipelines.appstudio.openshift.io/type: build + release.appstudio.openshift.io/auto-release: "false" name: image-on-push namespace: boilerplate-cicada-tenant spec: diff --git a/.tekton/image-tag-push.yaml b/.tekton/image-tag-push.yaml new file mode 100644 index 00000000..ae881e74 --- /dev/null +++ b/.tekton/image-tag-push.yaml @@ -0,0 +1,68 @@ +apiVersion: tekton.dev/v1 +kind: PipelineRun +metadata: + annotations: + build.appstudio.openshift.io/repo: https://github.com/openshift/boilerplate?rev={{revision}} + build.appstudio.redhat.com/commit_sha: '{{revision}}' + build.appstudio.redhat.com/target_branch: '{{target_branch}}' + pipelinesascode.tekton.dev/max-keep-runs: '3' + pipelinesascode.tekton.dev/on-event: "[push]" + pipelinesascode.tekton.dev/on-target-branch: "[refs/tags/image-v*]" + creationTimestamp: + labels: + appstudio.openshift.io/application: boilerplate-master + appstudio.openshift.io/component: image + pipelines.appstudio.openshift.io/type: build + name: image-on-tag-push + namespace: boilerplate-cicada-tenant +spec: + params: + - name: git-url + value: '{{source_url}}' + - name: revision + value: '{{revision}}' + - name: output-image + value: quay.io/redhat-user-workloads/boilerplate-cicada-tenant/boilerplate-master/image:{{revision}} + - name: dockerfile + value: config/Dockerfile + - name: build-source-image + value: 'true' + - name: build-args + value: + - "VERSION={{ git_tag }}" + taskRunSpecs: + - computeResources: + limits: + memory: 4Gi + pipelineTaskName: build-container + - computeResources: + limits: + memory: 4Gi + pipelineTaskName: ecosystem-cert-preflight-checks + taskRunTemplate: + serviceAccountName: build-pipeline-image + workspaces: + - name: workspace + volumeClaimTemplate: + metadata: + creationTimestamp: + spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 1Gi + status: {} + - name: git-auth + secret: + secretName: '{{ git_auth_secret }}' + pipelineRef: + resolver: git + params: + - name: url + value: https://github.com/openshift/boilerplate + - name: revision + value: "{{revision}}" + - name: pathInRepo + value: pipelines/docker-build-oci-ta/pipeline.yaml +status: {} diff --git a/CLAUDE.md b/CLAUDE.md index ffa47c23..2c3eb2ab 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -77,8 +77,10 @@ The repository supports both Docker and Podman. The `CONTAINER_ENGINE` variable ### Release Process For changes to the build image (`config/Dockerfile`): 1. Create semver tag: `image-v{X}.{Y}.{Z}` -2. Update Konflux `ReleasePlanAdmission` resource -3. Create `Release` resource in Konflux +2. Push the tag to GitHub. The tag-only Pipelines-as-Code build passes the tag + into the image's `version` label. +3. Konflux creates the `Release` automatically after the tagged snapshot passes + its required tests; no RPA edit or manual `Release` resource is needed. 4. Update Prow mirroring configuration ## Environment Variables @@ -97,4 +99,4 @@ This repository integrates with: - **GitHub** - Source control and issue tracking - **Subscriber repositories** - Consuming projects that use boilerplate conventions -The subscriber system allows automated updates to be proposed across multiple consuming repositories simultaneously using the `subscriber propose update` command. \ No newline at end of file +The subscriber system allows automated updates to be proposed across multiple consuming repositories simultaneously using the `subscriber propose update` command. diff --git a/README.md b/README.md index edd5ae2f..9bf2643c 100644 --- a/README.md +++ b/README.md @@ -392,38 +392,20 @@ for an example. git push upstream image-v1.2.3 ``` -2. Update the `ReleasePlanAdmission` resource [here](https://gitlab.cee.redhat.com/releng/konflux-release-data/-/blob/main/config/stone-prd-rh01.pg1f.p1/service/ReleasePlanAdmission/boilerplate-cicada/boilerplate.yaml?ref_type=heads#L18-23) with your new tag. See this [MR](https://gitlab.cee.redhat.com/releng/konflux-release-data/-/merge_requests/6282) for an example. +2. The tag-only Pipelines-as-Code build matches `refs/tags/image-v*`, passes the + tag into the image's `version` label, and uses that label for the published + image tag. No `ReleasePlanAdmission` update is needed for each release. 3. If needed, login to the Konflux cluster for Boilerplate ```shell oc login --web https://api.stone-prd-rh01.pg1f.p1.openshiftapps.com:6443/ ``` -4. Once the above MR merges, wait a bit, then validate the changes have synced to Konflux. You should see your updates in the tags output below: +4. The tagged snapshot is eligible for automatic release. After required tests + pass, the `boilerplate-releaseplan` creates a `kind: Release` automatically. + You can watch the resulting Releases with: ```shell - oc get releaseplanadmissions -n rhtap-releng-tenant boilerplate -o json | jq .spec.data.mapping.defaults.tags + oc get releases -n boilerplate-cicada-tenant -w ``` - > **⚠️ IMPORTANT:** Do not move on until the above releaseplanadmission matches your changes! -5. Find the resulting snapshot that contains the newly built artifact. Grab the commit that corresponds to the tag you pushed to filter by. - ```shell - oc get snapshots -n boilerplate-cicada-tenant -l pac.test.appstudio.openshift.io/sha=$COMMIT - ``` -6. Once the `ReleasePlanAdmission` changes are live in the Konflux cluster, create your `Release`: - - Setup variables needed for the `Release` (note the `v` is prefixing the version): - ```shell - export BOILERPLATE_VERSION=vX.Y.Z - export BOILERPLATE_SNAPSHOT=$snapshotname - ``` - - Create the `Release`: - ```shell - echo "apiVersion: appstudio.redhat.com/v1alpha1 - kind: Release - metadata: - name: image-${BOILERPLATE_VERSION} - namespace: boilerplate-cicada-tenant - spec: - releasePlan: boilerplate-releaseplan - snapshot: ${BOILERPLATE_SNAPSHOT}" | oc apply -f - - ``` -7. You can watch the release pipeline in the Konflux UI [here](https://konflux-ui.apps.stone-prd-rh01.pg1f.p1.openshiftapps.com/ns/boilerplate-cicada-tenant/applications/boilerplate-master/releases). -8. Once the release is complete, open a PR adding the new image tag to Prow mirroring. + The release pipeline is also visible in the Konflux UI [here](https://konflux-ui.apps.stone-prd-rh01.pg1f.p1.openshiftapps.com/ns/boilerplate-cicada-tenant/applications/boilerplate-master/releases). +5. Once the release is complete, open a PR adding the new image tag to Prow mirroring. - See this [PR](https://github.com/openshift/release/pull/64991) for an example. - Reach out in #forum-ocp-testplatform and ask for them to review it. diff --git a/config/Dockerfile b/config/Dockerfile index 0f14fb60..68806945 100644 --- a/config/Dockerfile +++ b/config/Dockerfile @@ -21,6 +21,9 @@ RUN curl -L -o kubectl-package ${KUBECTL_PACKAGE_LOCATION} && \ FROM registry.access.redhat.com/ubi9:9.8-1788939089@sha256:206b65b8ee0f04b992818c9a51b29081b14974630d4850bc358097d0c44ea156 +ARG VERSION="" +LABEL version="${VERSION}" + RUN dnf -y install openssh-clients jq skopeo python3-pyyaml git go-toolset rsync && \ dnf clean all && \ dnf -y autoremove && \ From 902bcc9bf309afb1397da73ab4d079d6b8119230 Mon Sep 17 00:00:00 2001 From: Josh Branham Date: Mon, 14 Sep 2026 17:44:46 -0600 Subject: [PATCH 2/2] Document major version RPA update --- CLAUDE.md | 7 +++++-- README.md | 5 +++++ 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/CLAUDE.md b/CLAUDE.md index 2c3eb2ab..9548f194 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -79,9 +79,12 @@ For changes to the build image (`config/Dockerfile`): 1. Create semver tag: `image-v{X}.{Y}.{Z}` 2. Push the tag to GitHub. The tag-only Pipelines-as-Code build passes the tag into the image's `version` label. -3. Konflux creates the `Release` automatically after the tagged snapshot passes +3. If the major version changes, update `product_version` in the Boilerplate + ReleasePlanAdmission from the old major to the new major. Patch and minor + releases do not require that RPA update. +4. Konflux creates the `Release` automatically after the tagged snapshot passes its required tests; no RPA edit or manual `Release` resource is needed. -4. Update Prow mirroring configuration +5. Update Prow mirroring configuration ## Environment Variables diff --git a/README.md b/README.md index 9bf2643c..4132b111 100644 --- a/README.md +++ b/README.md @@ -380,6 +380,11 @@ from a tag through Konflux. To build a new image from a tag: principles when deciding what `{X}.{Y}.{Z}` should be. See https://github.com/openshift/boilerplate/pull/180 for an example. + If this is a major-version bump, update the Boilerplate + `ReleasePlanAdmission`'s `product_version` to the new major version (for + example, change `8` to `9`). Patch and minor releases do not require an RPA + update. + Publishing the Git tag starts the image release but does not make the image immediately available. Until the release finishes, `boilerplate/update` will continue using the newest previously published image tag.