Skip to content

ROX-34386: Backport changes from release branch #171

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mtodor wants to merge 2 commits into
base: main
Choose a base branch
from
+197 −18
Open

ROX-34386: Backport changes from release branch #171

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
149f62a
Backport add image labels
mtodor Jul 22, 2026
67654a9
Backport split main and release pipeline to remove image expire
mtodor Jul 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 7 additions & 3 deletions .tekton/acs-mcp-server-pull-request.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,8 +18,8 @@ metadata:
target_branch == "main" ||
target_branch.startsWith("release-") ||
(
has(body.pull_request) &&
has(body.pull_request.labels) &&
has(body.pull_request) &&
has(body.pull_request.labels) &&
body.pull_request.labels.exists(l, l.name == "konflux-build")
)
)
Expand All @@ -39,7 +39,7 @@ spec:
- name: output-image-repo
value: quay.io/redhat-user-workloads/agentic-cluster-security-suite-tenant/acs-mcp-server
- name: image-expires-after
value: 5d
value: "5d"
- name: dockerfile
value: konflux.Dockerfile
- name: hermetic
Expand All @@ -54,6 +54,10 @@ spec:
value: '0'
- name: clone-fetch-tags
value: 'true'
- name: extra-labels
value:
# X.Y in the cpe label must be adjusted for every version stream.
- "cpe=cpe:/a:redhat:agentic_cluster_security_suite:X.Y::el9"
Comment on lines +57 to +60

@coderabbitai coderabbitai Bot Jul 24, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Do not publish the literal X.Y CPE version.

The component pipeline forwards these values into image labels, so every affected image reports X.Y rather than a real version stream. This also contradicts the PR objective to exclude version-specific CPE changes from this backport.

  • .tekton/acs-mcp-server-pull-request.yaml#L57-L60: remove the placeholder extra-labels block.
  • .tekton/acs-mcp-server-push-main.yaml#L68-L71: remove the placeholder extra-labels block.
  • .tekton/acs-mcp-server-push-release.yaml#L66-L69: remove the placeholder extra-labels block.
📍 Affects 3 files
  • .tekton/acs-mcp-server-pull-request.yaml#L57-L60 (this comment)
  • .tekton/acs-mcp-server-push-main.yaml#L68-L71
  • .tekton/acs-mcp-server-push-release.yaml#L66-L69
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.tekton/acs-mcp-server-pull-request.yaml around lines 57 - 60, Remove the
placeholder extra-labels block from .tekton/acs-mcp-server-pull-request.yaml
lines 57-60, .tekton/acs-mcp-server-push-main.yaml lines 68-71, and
.tekton/acs-mcp-server-push-release.yaml lines 66-69 so no pipeline publishes
the literal X.Y CPE version.


pipelineRef:
name: basic-component-pipeline
Expand Down
29 changes: 15 additions & 14 deletions .tekton/acs-mcp-server-push.yaml → .tekton/acs-mcp-server-push-main.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,30 +9,27 @@ metadata:
pipelinesascode.tekton.dev/max-keep-runs: "10"
pipelinesascode.tekton.dev/on-label: "[]"
# For push trigger:
# - trigger on commit push on main or release branch.
# - trigger on tag pushes.
# - trigger on commit push on main.
# For PR triggers:
# - body.action != "ready_for_review" prevents double-triggering when a draft PR is marked ready for review.
# - trigger only for PRs on release branches.
# - support triggering by label: "konflux-build"
# - trigger only for PRs on main branch with label: "konflux-build"
pipelinesascode.tekton.dev/on-cel-expression: |
(
event == "push" && target_branch.matches("^(main|release-.*|refs/tags/.*)$")
event == "push" &&
target_branch.matches("^main$")
) || (
event == "pull_request" && body.action != "ready_for_review" && (
target_branch.startsWith("release-") ||
(
has(body.pull_request) &&
has(body.pull_request.labels) &&
body.pull_request.labels.exists(l, l.name == "konflux-build")
)
)
event == "pull_request" &&
target_branch.matches("^main$") &&
body.action != "ready_for_review" &&
has(body.pull_request) &&
has(body.pull_request.labels) &&
body.pull_request.labels.exists(l, l.name == "konflux-build")
)
Comment on lines +21 to 27

@coderabbitai coderabbitai Bot Jul 24, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚀 Performance & Scalability | 🟠 Major | ⚡ Quick win

Remove PR triggers from the push PipelineRuns.

A labeled PR targeting main or release-* also matches the dedicated PR PipelineRun, so both pipelines build and push the same revision concurrently.

  • .tekton/acs-mcp-server-push-main.yaml#L21-L27: remove the pull_request branch; retain the main push trigger.
  • .tekton/acs-mcp-server-push-release.yaml#L21-L27: remove the pull_request branch; retain release and tag push triggers.
📍 Affects 2 files
  • .tekton/acs-mcp-server-push-main.yaml#L21-L27 (this comment)
  • .tekton/acs-mcp-server-push-release.yaml#L21-L27
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.tekton/acs-mcp-server-push-main.yaml around lines 21 - 27, Remove the
pull_request trigger branch from the push trigger conditions in
.tekton/acs-mcp-server-push-main.yaml lines 21-27, retaining only the main push
trigger. Apply the same change in .tekton/acs-mcp-server-push-release.yaml lines
21-27, retaining the release and tag push triggers.

labels:
appstudio.openshift.io/application: agentic-cluster-security-suite
appstudio.openshift.io/component: acs-mcp-server
pipelines.appstudio.openshift.io/type: build
name: acs-mcp-server-on-push
name: acs-mcp-server-on-push-main
namespace: agentic-cluster-security-suite-tenant
spec:
params:
Expand Down Expand Up @@ -68,6 +65,10 @@ spec:
- linux/arm64
- linux/ppc64le
- linux/s390x
- name: extra-labels
value:
# X.Y in the cpe label must be adjusted for every version stream.
- "cpe=cpe:/a:redhat:agentic_cluster_security_suite:X.Y::el9"

pipelineRef:
name: basic-component-pipeline
Expand Down
85 changes: 85 additions & 0 deletions .tekton/acs-mcp-server-push-release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,85 @@
apiVersion: tekton.dev/v1
kind: PipelineRun
metadata:
annotations:
build.appstudio.openshift.io/repo: https://github.com/stackrox/stackrox-mcp?rev={{revision}}
build.appstudio.redhat.com/commit_sha: '{{revision}}'
build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}'
build.appstudio.redhat.com/target_branch: '{{target_branch}}'
pipelinesascode.tekton.dev/max-keep-runs: "10"
pipelinesascode.tekton.dev/on-label: "[]"
# For push trigger:
# - trigger on commit push on release branches.
# - trigger on tag pushes.
# For PR triggers:
# - body.action != "ready_for_review" prevents double-triggering when a draft PR is marked ready for review.
# - trigger only for PRs on release branches with label: "konflux-build"
pipelinesascode.tekton.dev/on-cel-expression: |
(
event == "push" && target_branch.matches("^(release-.*|refs/tags/.*)$")
) || (
event == "pull_request" &&
target_branch.startsWith("release-") &&
body.action != "ready_for_review" &&
has(body.pull_request) &&
has(body.pull_request.labels) &&
body.pull_request.labels.exists(l, l.name == "konflux-build")
)
labels:
appstudio.openshift.io/application: agentic-cluster-security-suite
appstudio.openshift.io/component: acs-mcp-server
pipelines.appstudio.openshift.io/type: build
name: acs-mcp-server-on-push-release
namespace: agentic-cluster-security-suite-tenant
spec:
params:
- name: git-url
value: '{{source_url}}'
- name: revision
value: '{{revision}}'
- name: output-image-repo
value: quay.io/redhat-user-workloads/agentic-cluster-security-suite-tenant/acs-mcp-server
- name: dockerfile
value: konflux.Dockerfile
- name: hermetic
value: 'true'
- name: prefetch-input
value: |
[
{ "type": "gomod", "path": "." },
{ "type": "rpm", "path": "." }
]
- name: build-source-image
value: 'true'
- name: build-image-index
value: 'true'
- name: clone-depth
value: '0'
- name: clone-fetch-tags
value: 'true'
- name: build-platforms
value:
- linux/amd64
- linux/arm64
- linux/ppc64le
- linux/s390x
- name: extra-labels
value:
# X.Y in the cpe label must be adjusted for every version stream.
- "cpe=cpe:/a:redhat:agentic_cluster_security_suite:X.Y::el9"

pipelineRef:
name: basic-component-pipeline

taskRunTemplate:
serviceAccountName: build-pipeline-acs-mcp-server

timeouts:
tasks: 1h
finally: 10m
pipeline: 1h10m

workspaces:
- name: git-auth
secret:
secretName: '{{ git_auth_secret }}'
73 changes: 72 additions & 1 deletion .tekton/basic-component-pipeline.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -170,6 +170,73 @@ spec:
workspaces:
- name: basic-auth
workspace: git-auth

- name: determine-version
params:
- name: SOURCE_ARTIFACT
value: $(tasks.clone-repository.results.SOURCE_ARTIFACT)
runAfter:
- clone-repository
taskSpec:
params:
- name: SOURCE_ARTIFACT
type: string
- name: TRUSTED_ARTIFACT_IMAGE
type: string
default: "quay.io/redhat-appstudio/build-trusted-artifacts:latest@sha256:9b180776a41d9a22a1c51539f1647c60defbbd55b44bbebdd4130e33512d8b0d"
- name: UBI_MINIMAL_IMAGE
type: string
default: "registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:2e8edce823a48e51858f1fad3ff4cbf6875ce8a3f86b9eecf298bc2050c8652a"
results:
- name: VERSION
description: Version string derived from git tags.
volumes:
- name: workdir
emptyDir: {}
stepTemplate:
volumeMounts:
- mountPath: /var/workdir
name: workdir
computeResources:
requests:
cpu: 100m
memory: 256Mi
limits:
memory: 512Mi
Comment on lines +200 to +205

@coderabbitai coderabbitai Bot Jul 24, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

Add a CPU limit to the new task steps.

requests.cpu only reserves capacity; it does not cap usage. stepTemplate applies to both new containers, so add a suitable limits.cpu alongside the memory limit.

Proposed fix 
 limits:
+  cpu: 500m
   memory: 512Mi

As per path instructions, .tekton/** requires “Resource limits set on task containers.”

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
computeResources:
requests:
cpu: 100m
memory: 256Mi
limits:
memory: 512Mi
computeResources:
requests:
cpu: 100m
memory: 256Mi
limits:
cpu: 500m
memory: 512Mi
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.tekton/basic-component-pipeline.yaml around lines 200 - 205, Add a suitable
limits.cpu value under computeResources.limits in the shared stepTemplate for
the new task steps, alongside the existing memory limit, so both containers
receive CPU limits while preserving the current CPU request.

Source: Path instructions

steps:
- name: use-trusted-artifact
image: $(params.TRUSTED_ARTIFACT_IMAGE)
args:
- use
- $(params.SOURCE_ARTIFACT)=/var/workdir/source
- name: determine-version
image: $(params.UBI_MINIMAL_IMAGE)
workingDir: /var/workdir/source
script: |
#!/usr/bin/env bash
set -euo pipefail
microdnf install -y git-core
VERSION=$(git describe --tags --always)
echo "Determined version: ${VERSION}" >&2
echo -n "${VERSION}" | tee "$(results.VERSION.path)"

- name: generate-labels
params:
- name: label-templates
value:
- release=$ACTUAL_DATE_EPOCH
runAfter:
- clone-repository
taskRef:
params:
- name: name
value: generate-labels
- name: bundle
value: quay.io/konflux-ci/tekton-catalog/task-generate-labels:0.1@sha256:d4ae1177fc2df0c07089bc30406ce75761cb7de21f361b254bf4dce8a5537e48
- name: kind
value: task
resolver: bundles

- name: prefetch-dependencies
params:
- name: input
Expand Down Expand Up @@ -223,6 +290,7 @@ spec:
- name: BUILD_ARGS
value:
- $(params.build-args[*])
- VERSION=$(tasks.determine-version.results.VERSION)
- name: BUILD_ARGS_FILE
value: $(params.build-args-file)
- name: PRIVILEGED_NESTED
Expand All @@ -232,7 +300,9 @@ spec:
- name: BUILDAH_FORMAT
value: $(params.buildah-format)
- name: LABELS
value: ["$(params.extra-labels[*])"]
value:
- $(tasks.generate-labels.results.labels[*])
- $(params.extra-labels[*])
- name: BUILD_TIMESTAMP
value: "$(tasks.clone-repository.results.commit-timestamp)"
- name: IMAGE_APPEND_PLATFORM
Expand Down Expand Up @@ -488,6 +558,7 @@ spec:
- name: BUILD_ARGS
value:
- $(params.build-args[*])
- VERSION=$(tasks.determine-version.results.VERSION)
- name: BUILD_ARGS_FILE
value: $(params.build-args-file)
- name: SOURCE_ARTIFACT
Expand Down
18 changes: 18 additions & 0 deletions konflux.Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,24 @@ RUN dnf install -y \
# Stage 4: Runtime - Minimal runtime image
FROM ubi-micro-base

# Build arguments for labels
ARG VERSION=dev

# Define labels
LABEL \
com.redhat.component="agentic-cluster-security-suite-acs-mcp-server-container" \
com.redhat.license_terms="https://www.redhat.com/agreements" \
description="The ACS MCP Server" \
io.k8s.description="The ACS MCP Server" \
io.k8s.display-name="acs-mcp-server" \
io.openshift.tags="acs-mcp-server" \
maintainer="Red Hat, Inc." \
name="agentic-cluster-security-suite-tech-preview/acs-mcp-server-rhel9" \
source-location="https://github.com/stackrox/stackrox-mcp" \
summary="The ACS MCP Server" \
version="${VERSION}" \
release="1"

# Set default environment variables
ENV LOG_LEVEL=INFO

Expand Down
Loading