ROX-28879: Backport image checks, get 4.6 fit for release by msugakov · Pull Request #14942 · stackrox/stackrox

msugakov · 2025-04-09T16:11:10Z

Description

Cherry-picked 7ea6887 (ROX-28879: Update ScannerV2&Collector Konflux image checks #14827) and de70e47 (ROX-29479: Check Konflux image existence in release- repos #15463) to release-4.6.
As part of 4.6 backporting:
- Revised collector-slim handling around Konflux pipelines for 4.6.
- Bumped scanner and collector versions to the ones already with Konflux backports.
- Assigned component and service account suffixes.

It's best to review this change by commits.

User-facing documentation

CHANGELOG is updated OR update is not needed
documentation PR is created and is linked above OR is not needed

Testing and quality

the change is production ready: the change is GA or otherwise the functionality is gated by a feature flag
CI results are inspected

Automated testing

No change.

How I validated my change

Only looking at CI.

sourcery-ai · 2025-04-09T16:11:47Z

Reviewer's Guide by Sourcery

This pull request introduces a new GitHub Actions workflow (check-collector-and-scanner-images-exist) to verify that the Collector and Scanner images built on both GitHub Actions and Konflux exist in the rhacs-eng repository on Quay.io. It also ensures that this check is performed after the misc-checks, style-check, and golangci-lint jobs have completed successfully.

No diagrams generated as the changes look simple and do not need a visual representation.

File-Level Changes

Change	Details	Files
Added a new GitHub Actions workflow to verify the existence of Collector and Scanner images built on both GitHub Actions (GHA) and Konflux.	The workflow checks for the existence of images in the `rhacs-eng` repository on Quay.io. It retrieves the image tag from the `COLLECTOR_VERSION` or `SCANNER_VERSION` file using a Makefile target. It uses the `stackrox/actions/release/wait-for-image` action to wait for both the GHA-built image (without the `-fast` suffix) and the Konflux-built image (with the `-fast` suffix) to become available. The workflow matrix tests the following images: `collector`, `collector-slim`, `scanner`, `scanner-slim`, `scanner-db`, and `scanner-db-slim`.	`.github/workflows/style.yaml`
The `misc-checks`, `style-check`, and `golangci-lint` jobs are now required before the `check-collector-and-scanner-images-exist` job.	The `check-collector-and-scanner-images-exist` job is added to the list of jobs that must complete successfully before the pull request can be merged.	`.github/workflows/style.yaml`

Tips and commands

Interacting with Sourcery

Trigger a new review: Comment @sourcery-ai review on the pull request.
Continue discussions: Reply directly to Sourcery's review comments.
Generate a GitHub issue from a review comment: Ask Sourcery to create an
issue from a review comment by replying to it. You can also reply to a
review comment with @sourcery-ai issue to create an issue from it.
Generate a pull request title: Write @sourcery-ai anywhere in the pull
request title to generate a title at any time. You can also comment
@sourcery-ai title on the pull request to (re-)generate the title at any time.
Generate a pull request summary: Write @sourcery-ai summary anywhere in
the pull request body to generate a PR summary at any time exactly where you
want it. You can also comment @sourcery-ai summary on the pull request to
(re-)generate the summary at any time.
Generate reviewer's guide: Comment @sourcery-ai guide on the pull
request to (re-)generate the reviewer's guide at any time.
Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
pull request to resolve all Sourcery comments. Useful if you've already
addressed all the comments and don't want to see them anymore.
Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
request to dismiss all existing Sourcery reviews. Especially useful if you
want to start fresh with a new review - don't forget to comment
@sourcery-ai review to trigger a new review!
Generate a plan of action for an issue: Comment @sourcery-ai plan on
an issue to generate a plan of action for it.

Customizing Your Experience

Access your dashboard to:

Enable or disable review features such as the Sourcery-generated pull request
summary, the reviewer's guide, and others.
Change the review language.
Add, remove or edit custom review instructions.
Adjust other review settings.

Getting Help

Contact our support team for questions or feedback.
Visit our documentation for detailed guides and information.
Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

rhacs-bot · 2025-04-09T16:42:04Z

Images are ready for the commit at 326322e.

To use with deploy scripts, first export MAIN_IMAGE_TAG=4.6.7-12-g326322eafc.

dcaravel · 2025-05-07T19:14:38Z

@msugakov If any change in this PR needs to be included in the 4.6.6 release - please ensure the PR is approved and applicable tests pass by Monday to make the cut.

red-hat-konflux · 2025-07-01T14:19:48Z

Caution

There are some errors in your PipelineRun template.

PipelineRun	Error
quay-proxy	`no kind "ImageDigestMirrorSet" is registered for version "config.openshift.io/v1" in scheme "k8s.io/client-go/kubernetes/scheme/register.go:83"`

To the same effect as `git cherry-pick 7ea6887`. Did not add `collector-slim` to the check list because there's no GHA built image `quay.io/rhacs-eng/collector-slim:<original-collector-version>` and there's no Konflux build image `quay.io/rhacs-eng/release-collector-slim:<original-collector-version>`

`git cherry-pick de70e47`

because both exist in 4.6.

Interestingly, the Snapshot was still getting created fine despite such component not existing.

to the ones where backporting is done.

msugakov · 2025-07-01T15:44:36Z

/cancel

codecov · 2025-07-01T16:40:49Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 48.42%. Comparing base (ad64910) to head (326322e).
Report is 1 commits behind head on release-4.6.

Additional details and impacted files

@@               Coverage Diff               @@
##           release-4.6   #14942      +/-   ##
===============================================
- Coverage        48.42%   48.42%   -0.01%     
===============================================
  Files             2470     2470              
  Lines           178528   178528              
===============================================
- Hits             86457    86453       -4     
- Misses           85117    85120       +3     
- Partials          6954     6955       +1

Flag	Coverage Δ
go-unit-tests	`48.42% <ø> (-0.01%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

msugakov · 2025-07-01T20:58:08Z

/retest

msugakov · 2025-07-02T12:11:19Z

/test ocp-4-12-scanner-v4-tests

msugakov · 2025-07-02T15:11:14Z

/retest main-on-push

msugakov · 2025-07-02T15:11:21Z

/retest scanner-v4-on-push

msugakov · 2025-07-02T15:11:26Z

/retest roxctl-on-push

msugakov · 2025-07-02T15:11:33Z

/retest scanner-v4-db-on-push

msugakov · 2025-07-02T15:11:39Z

/retest central-db-on-push

msugakov · 2025-07-02T15:11:53Z

/retest operator-bundle-on-push

msugakov · 2025-07-02T15:12:00Z

/retest retag-scanner

msugakov · 2025-07-02T15:12:02Z

/retest retag-scanner-db

msugakov · 2025-07-02T15:12:07Z

/retest retag-scanner-slim

msugakov · 2025-07-02T15:39:39Z

/retest roxctl-on-push

msugakov · 2025-07-02T16:59:24Z

/retest operator-bundle-on-push

msugakov · 2025-07-02T17:52:19Z

Snapshot creation in the operator-bundle pipeline needs this https://gitlab.cee.redhat.com/releng/konflux-release-data/-/merge_requests/7793

msugakov · 2025-07-03T16:12:30Z

/retest operator-bundle-on-push

msugakov requested a review from tommartensen April 9, 2025 16:11

github-actions bot added area/ci backport PR to backport changes from master to release branch labels Apr 9, 2025

msugakov force-pushed the misha/ROX-28879-backport-image-presence-checks-4.6 branch from 727d4c8 to f61175a Compare April 9, 2025 16:12

msugakov marked this pull request as draft April 9, 2025 16:13

openshift-ci bot added the do-not-merge/work-in-progress label Apr 9, 2025

msugakov removed the request for review from tommartensen April 9, 2025 16:15

msugakov force-pushed the misha/ROX-28879-backport-image-presence-checks-4.6 branch from f61175a to cccafc3 Compare July 1, 2025 14:19

msugakov added the konflux-build Run Konflux in PR. Push commit to trigger it. label Jul 1, 2025

msugakov force-pushed the misha/ROX-28879-backport-image-presence-checks-4.6 branch from dd735d4 to 187ac2e Compare July 1, 2025 15:34

github-actions bot added the ci-all-qa-tests Tells CI to run all API tests (not just BAT). label Jul 1, 2025

msugakov and others added 6 commits July 1, 2025 17:43

ROX-29479: Check Konflux image existence in release- repos (#15463)

9959cfe

`git cherry-pick de70e47`

Remove collector slim/full todo irrelevant for 4.6

cb378b9

because both exist in 4.6.

Exclude collector-slim "component" from ACS-style snapshot

c1c9a91

Interestingly, the Snapshot was still getting created fine despite such component not existing.

Bump SCANNER_ and COLLECTOR_ VERSION-s

f1c88d0

to the ones where backporting is done.

Assign app, component and SA -4-6 suffixes

326322e

msugakov force-pushed the misha/ROX-28879-backport-image-presence-checks-4.6 branch from 187ac2e to 326322e Compare July 1, 2025 15:45

msugakov changed the title ~~ROX-28879: Update ScannerV2&Collector Konflux image checks/4.6~~ ROX-28879: Backport image checks, get 4.6 fit for release Jul 1, 2025

msugakov marked this pull request as ready for review July 1, 2025 21:10

msugakov requested review from a team as code owners July 1, 2025 21:10

openshift-ci bot removed the do-not-merge/work-in-progress label Jul 1, 2025

stackrox deleted a comment from openshift-ci bot Jul 2, 2025

stackrox deleted a comment from openshift-ci bot Jul 3, 2025

msugakov requested a review from tommartensen July 3, 2025 16:31

tommartensen approved these changes Jul 8, 2025

View reviewed changes

msugakov merged commit dcb534f into release-4.6 Jul 8, 2025
130 of 150 checks passed

msugakov deleted the misha/ROX-28879-backport-image-presence-checks-4.6 branch July 8, 2025 10:00

Conversation

msugakov commented Apr 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

User-facing documentation

Testing and quality

Automated testing

How I validated my change

Uh oh!

sourcery-ai bot commented Apr 9, 2025

Reviewer's Guide by Sourcery

File-Level Changes

Interacting with Sourcery

Customizing Your Experience

Getting Help

Uh oh!

rhacs-bot commented Apr 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dcaravel commented May 7, 2025

Uh oh!

red-hat-konflux bot commented Jul 1, 2025

Uh oh!

msugakov commented Jul 1, 2025

Uh oh!

codecov bot commented Jul 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

msugakov commented Jul 1, 2025

Uh oh!

msugakov commented Jul 2, 2025

Uh oh!

msugakov commented Jul 2, 2025

Uh oh!

msugakov commented Jul 2, 2025

Uh oh!

msugakov commented Jul 2, 2025

Uh oh!

msugakov commented Jul 2, 2025

Uh oh!

msugakov commented Jul 2, 2025

Uh oh!

msugakov commented Jul 2, 2025

Uh oh!

msugakov commented Jul 2, 2025

Uh oh!

msugakov commented Jul 2, 2025

Uh oh!

msugakov commented Jul 2, 2025

Uh oh!

msugakov commented Jul 2, 2025

Uh oh!

msugakov commented Jul 2, 2025

Uh oh!

msugakov commented Jul 2, 2025

Uh oh!

msugakov commented Jul 3, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

msugakov commented Apr 9, 2025 •

edited

Loading

rhacs-bot commented Apr 9, 2025 •

edited

Loading

codecov bot commented Jul 1, 2025 •

edited

Loading