ROSAENG-67043: Add auto-release pipeline for tag pushes

.tekton/image-push.yaml

@@ -15,11 +15,11 @@ metadata:
         "boilerplate/***".pathChanged() ||
         "test/***".pathChanged()
       )
-  creationTimestamp:
   labels:
     appstudio.openshift.io/application: boilerplate-master
     appstudio.openshift.io/component: image
     pipelines.appstudio.openshift.io/type: build
+    release.appstudio.openshift.io/auto-release: "false"
   name: image-on-push
   namespace: boilerplate-cicada-tenant
 spec:

.tekton/image-tag-push.yaml

@@ -0,0 +1,68 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/openshift/boilerplate?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/max-keep-runs: '3'
+    pipelinesascode.tekton.dev/on-event: "[push]"
+    pipelinesascode.tekton.dev/on-target-branch: "[refs/tags/image-v*]"
+  creationTimestamp:
+  labels:
+    appstudio.openshift.io/application: boilerplate-master
+    appstudio.openshift.io/component: image
+    pipelines.appstudio.openshift.io/type: build
+  name: image-on-tag-push
+  namespace: boilerplate-cicada-tenant
+spec:
+  params:
+    - name: git-url
+      value: '{{source_url}}'
+    - name: revision
+      value: '{{revision}}'
+    - name: output-image
+      value: quay.io/redhat-user-workloads/boilerplate-cicada-tenant/boilerplate-master/image:{{revision}}
+    - name: dockerfile
+      value: config/Dockerfile
+    - name: build-source-image
+      value: 'true'
+    - name: build-args
+      value:
+        - "VERSION={{ git_tag }}"
+  taskRunSpecs:
+    - computeResources:
+        limits:
+          memory: 4Gi
+      pipelineTaskName: build-container
+    - computeResources:
+        limits:
+          memory: 4Gi
+      pipelineTaskName: ecosystem-cert-preflight-checks
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-image
+  workspaces:
+    - name: workspace
+      volumeClaimTemplate:
+        metadata:
+          creationTimestamp:
+        spec:
+          accessModes:
+            - ReadWriteOnce
+          resources:
+            requests:
+              storage: 1Gi
+        status: {}
+    - name: git-auth
+      secret:
+        secretName: '{{ git_auth_secret }}'
+  pipelineRef:
+    resolver: git
+    params:
+      - name: url
+        value: https://github.com/openshift/boilerplate
+      - name: revision
+        value: "{{revision}}"
+      - name: pathInRepo
+        value: pipelines/docker-build-oci-ta/pipeline.yaml
+status: {}

CLAUDE.md

@@ -77,9 +77,14 @@ The repository supports both Docker and Podman. The `CONTAINER_ENGINE` variable
 ### Release Process
 For changes to the build image (`config/Dockerfile`):
 1. Create semver tag: `image-v{X}.{Y}.{Z}`
-2. Update Konflux `ReleasePlanAdmission` resource
-3. Create `Release` resource in Konflux
-4. Update Prow mirroring configuration
+2. Push the tag to GitHub. The tag-only Pipelines-as-Code build passes the tag
+   into the image's `version` label.
+3. If the major version changes, update `product_version` in the Boilerplate
+   ReleasePlanAdmission from the old major to the new major. Patch and minor
+   releases do not require that RPA update.
+4. Konflux creates the `Release` automatically after the tagged snapshot passes
+   its required tests; no RPA edit or manual `Release` resource is needed.
+5. Update Prow mirroring configuration
 
 ## Environment Variables
 
@@ -97,4 +102,4 @@ This repository integrates with:
 - **GitHub** - Source control and issue tracking
 - **Subscriber repositories** - Consuming projects that use boilerplate conventions
 
-The subscriber system allows automated updates to be proposed across multiple consuming repositories simultaneously using the `subscriber propose update` command.
+The subscriber system allows automated updates to be proposed across multiple consuming repositories simultaneously using the `subscriber propose update` command.

README.md

@@ -380,6 +380,11 @@ from a tag through Konflux. To build a new image from a tag:
 principles when deciding what `{X}.{Y}.{Z}` should be. See https://github.com/openshift/boilerplate/pull/180
 for an example.
 
+   If this is a major-version bump, update the Boilerplate
+   `ReleasePlanAdmission`'s `product_version` to the new major version (for
+   example, change `8` to `9`). Patch and minor releases do not require an RPA
+   update.
+
    Publishing the Git tag starts the image release but does not make the image
    immediately available. Until the release finishes, `boilerplate/update`
    will continue using the newest previously published image tag.
@@ -392,38 +397,20 @@ for an example.
     git push upstream image-v1.2.3
     ```
 
-2. Update the `ReleasePlanAdmission` resource [here](https://gitlab.cee.redhat.com/releng/konflux-release-data/-/blob/main/config/stone-prd-rh01.pg1f.p1/service/ReleasePlanAdmission/boilerplate-cicada/boilerplate.yaml?ref_type=heads#L18-23) with your new tag. See this [MR](https://gitlab.cee.redhat.com/releng/konflux-release-data/-/merge_requests/6282) for an example.
+2. The tag-only Pipelines-as-Code build matches `refs/tags/image-v*`, passes the
+   tag into the image's `version` label, and uses that label for the published
+   image tag. No `ReleasePlanAdmission` update is needed for each release.
 3. If needed, login to the Konflux cluster for Boilerplate
 ```shell
 oc login --web https://api.stone-prd-rh01.pg1f.p1.openshiftapps.com:6443/
 ```
-4. Once the above MR merges, wait a bit, then validate the changes have synced to Konflux. You should see your updates in the tags output below:
-    ```shell
-   oc get releaseplanadmissions -n rhtap-releng-tenant boilerplate -o json | jq .spec.data.mapping.defaults.tags
-    ```
-    > **⚠️ IMPORTANT:** Do not move on until the above releaseplanadmission matches your changes!
-5. Find the resulting snapshot that contains the newly built artifact. Grab the commit that corresponds to the tag you pushed to filter by.
-    ```shell
-    oc get snapshots -n boilerplate-cicada-tenant -l pac.test.appstudio.openshift.io/sha=$COMMIT
-    ```
-6. Once the `ReleasePlanAdmission` changes are live in the Konflux cluster, create your `Release`:
-    - Setup variables needed for the `Release` (note the `v` is prefixing the version):
-     ```shell
-    export BOILERPLATE_VERSION=vX.Y.Z
-    export BOILERPLATE_SNAPSHOT=$snapshotname
-     ```
-    - Create the `Release`:
+4. The tagged snapshot is eligible for automatic release. After required tests
+   pass, the `boilerplate-releaseplan` creates a `kind: Release` automatically.
+   You can watch the resulting Releases with:
     ```shell
-    echo "apiVersion: appstudio.redhat.com/v1alpha1
-    kind: Release
-    metadata:
-     name: image-${BOILERPLATE_VERSION}
-     namespace: boilerplate-cicada-tenant
-    spec:
-     releasePlan: boilerplate-releaseplan
-     snapshot: ${BOILERPLATE_SNAPSHOT}" | oc apply -f -
+    oc get releases -n boilerplate-cicada-tenant -w
     ```
-7. You can watch the release pipeline in the Konflux UI [here](https://konflux-ui.apps.stone-prd-rh01.pg1f.p1.openshiftapps.com/ns/boilerplate-cicada-tenant/applications/boilerplate-master/releases).
-8. Once the release is complete, open a PR adding the new image tag to Prow mirroring.
+   The release pipeline is also visible in the Konflux UI [here](https://konflux-ui.apps.stone-prd-rh01.pg1f.p1.openshiftapps.com/ns/boilerplate-cicada-tenant/applications/boilerplate-master/releases).
+5. Once the release is complete, open a PR adding the new image tag to Prow mirroring.
    - See this [PR](https://github.com/openshift/release/pull/64991) for an example.
    - Reach out in #forum-ocp-testplatform and ask for them to review it.

config/Dockerfile

@@ -21,6 +21,9 @@ RUN curl -L -o kubectl-package ${KUBECTL_PACKAGE_LOCATION} && \
 
 FROM registry.access.redhat.com/ubi9:9.8-1788939089@sha256:206b65b8ee0f04b992818c9a51b29081b14974630d4850bc358097d0c44ea156
 
+ARG VERSION=""
+LABEL version="${VERSION}"
+
 RUN dnf -y install openssh-clients jq skopeo python3-pyyaml git go-toolset rsync && \
     dnf clean all && \
     dnf -y autoremove && \