ROX-30858: optimize image retagging with buildx imagetools by janisz · Pull Request #19710 · stackrox/stackrox

janisz · 2026-03-31T12:01:58Z

Description

Replace pull-tag-push workflow with docker buildx imagetools create for scanner, collector, and fact image retagging. This eliminates unnecessary image pulls and pushes by copying manifests directly in the registry.

See: https://stackoverflow.com/questions/26763427/add-remote-tag-to-a-docker-image/70526615#70526615

Benefits:

Eliminates GBs of network transfer (6 images × pull + push)
Near-instantaneous manifest copy vs pull+push
Supports all architectures from source images
Runs in parallel with build-and-push-main job

User-facing documentation

CHANGELOG.md is updated OR update is not needed
documentation PR is created and is linked above OR is not needed

Testing and quality

the change is production ready: the change is GA, or otherwise the functionality is gated by a feature flag
CI results are inspected

Automated testing

How I validated my change

CI

sourcery-ai

Hey - I've found 1 issue, and left some high level feedback:

The new push_matching_collector_scanner_images function assumes BUILD_TAG, SCANNER_VERSION, COLLECTOR_VERSION, and FACT_VERSION environment/files are present; if this script is reused outside the GitHub workflow, consider adding validation/error messages for missing env vars/files to fail fast with a clear cause.
Since push_matching_collector_scanner_images now shells out to docker buildx imagetools, it may be worth guarding the call with a check that docker buildx is available (or emitting a clear error) for non-GitHub CI or local runs where Buildx might not be configured.
You removed the arch parameter and now retag images without the -arch suffix; double-check whether any downstream consumers or scripts still expect :<tag>-amd64 (or similar) tags, and if so, consider keeping a compatibility path or updating those references in the same change.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- The new `push_matching_collector_scanner_images` function assumes `BUILD_TAG`, `SCANNER_VERSION`, `COLLECTOR_VERSION`, and `FACT_VERSION` environment/files are present; if this script is reused outside the GitHub workflow, consider adding validation/error messages for missing env vars/files to fail fast with a clear cause.
- Since `push_matching_collector_scanner_images` now shells out to `docker buildx imagetools`, it may be worth guarding the call with a check that `docker buildx` is available (or emitting a clear error) for non-GitHub CI or local runs where Buildx might not be configured.
- You removed the arch parameter and now retag images without the `-arch` suffix; double-check whether any downstream consumers or scripts still expect `:<tag>-amd64` (or similar) tags, and if so, consider keeping a compatibility path or updating those references in the same change.

## Individual Comments

### Comment 1
<location path=".github/workflows/build.yaml" line_range="565-566" />
<code_context>
+      ROX_PRODUCT_BRANDING: ${{ matrix.name }}
+      BUILD_TAG: ${{ needs.define-job-matrix.outputs.build-tag }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.commit || github.event.pull_request.head.sha }}
</code_context>
<issue_to_address>
**issue (bug_risk):** actions/checkout@v6 does not currently exist and will cause the job to fail

`actions/checkout` only exposes up to `v4` today, so `@v6` will fail at workflow runtime. Unless you have an internal `v6`, this should be updated to a valid major version (e.g. `@v4`) so the workflow runs successfully.
</issue_to_address>

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

.github/workflows/build.yaml

coderabbitai · 2026-03-31T12:07:31Z

📝 Walkthrough

Summary by CodeRabbit

Chores
- Reorganized CI to add a dedicated job for pushing matching collector/scanner images and include it in failure notifications.
- Unified multi-arch image handling so images are managed and tagged consistently across architectures.
- Removed redundant local image retag/push steps and a separate retag helper, simplified commands, and cleaned up unnecessary prune operations.
- Added credential wiring for registry pushes.

Walkthrough

Added a dedicated GitHub Actions job that runs per branding to push matching collector/scanner/fact images; consolidated image retag/push into the CI library using Docker Buildx imagetools and removed the separate pull-retag-push helper and amd64-only manifest logic.

Changes

Cohort / File(s)	Summary
GitHub Actions workflow `.github/workflows/build.yaml`	Added new `push-matching-collector-scanner` job (iterates `ROX_PRODUCT_BRANDING`), moved the "Push matching collector and scanner images" step from `build-and-push-main` into this job, simplified the step conditional, removed `docker system prune`, added Quay credential env vars, and adjusted invocation to pass only branding.
CI library script `scripts/ci/lib.sh`	Changed `push_matching_collector_scanner_images` signature to accept only `<brand>`, removed amd64-only manifest push loop, replaced `pull-retag-push.sh` usage with `docker buildx imagetools create` in `_retag`, and switched target tag computation to use a single `${main_tag}` (removed arch suffix handling).
Removed helper script `scripts/ci/pull-retag-push.sh`	Deleted script that previously pulled, retagged, pushed, and cleaned images; its functionality was consolidated into the CI library via Buildx imagetools.
CI workflow dependency `.github/workflows/build.yaml` (needs graph)	Updated job dependencies so `push-matching-collector-scanner` is included in `needs` for `slack-on-build-failure`.

Sequence Diagram(s)

sequenceDiagram
  participant GH as GitHub Actions
  participant Runner as Runner
  participant CIlib as scripts/ci/lib.sh
  participant Buildx as Docker Buildx
  participant Quay as Quay Registry (rhacs / stackrox)

  GH->>Runner: start push-matching-collector-scanner job (per branding)
  Runner->>CIlib: invoke push_matching_collector_scanner_images(<brand>)
  CIlib->>Buildx: docker buildx imagetools create -t <target> <source>
  Buildx->>Quay: push created manifest/tag to target registry
  Quay-->>Buildx: ack
  Buildx-->>CIlib: result
  CIlib-->>Runner: finish
  Runner-->>GH: job completed

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	❓ Inconclusive	The description provides clear rationale and benefits, but the 'How I validated my change' section contains only 'CI' which is overly vague and insufficient.	Expand 'How I validated my change' to explain which CI tests validate the retagging logic and how the manifest-copying approach was verified to work correctly.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically describes the main change: optimizing image retagging by replacing pull-retag-push with docker buildx imagetools.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch ROX-30858/optimize-image-retagging

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@scripts/ci/lib.sh`:
- Around line 527-534: The BUILD_TAG environment variable can be empty causing
main_tag="${BUILD_TAG}" to produce empty tags and fail later; add a validation
check after assigning main_tag (or before use) to ensure BUILD_TAG/main_tag is
set and non-empty (trim whitespace if needed) and if not, print a clear error
mentioning BUILD_TAG and exit non‑zero so downstream retag operations do not run
(update the block around main_tag and its usages to perform this guard).

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: b30e2bd2-3b06-45e0-a7fd-7526b893f51b

📥 Commits

Reviewing files that changed from the base of the PR and between 7072ab4 and d0b9689.

📒 Files selected for processing (3)

.github/workflows/build.yaml
scripts/ci/lib.sh
scripts/ci/pull-retag-push.sh

💤 Files with no reviewable changes (1)

scripts/ci/pull-retag-push.sh

scripts/ci/lib.sh

rhacs-bot · 2026-03-31T12:18:20Z

Images are ready for the commit at 2e14309.

To use with deploy scripts, first export MAIN_IMAGE_TAG=4.11.x-504-g2e14309368.

rhacs-bot · 2026-03-31T12:18:20Z

Images are ready for the commit at c7f8205.

To use with deploy scripts, first export MAIN_IMAGE_TAG=4.11.x-493-gd0b9689bb6.

codecov · 2026-03-31T12:54:56Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 49.58%. Comparing base (69c8f9f) to head (4174680).
⚠️ Report is 2 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master   #19710   +/-   ##
=======================================
  Coverage   49.58%   49.58%           
=======================================
  Files        2756     2756           
  Lines      207951   207951           
=======================================
+ Hits       103112   103118    +6     
+ Misses      97177    97172    -5     
+ Partials     7662     7661    -1

Flag	Coverage Δ
go-unit-tests	`49.58% <ø> (+<0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

scripts/ci/lib.sh

davdhacs

Excellent.
Konflux is not affected by this because it uses .tekton/retag-pipeline.yaml(with https://github.com/stackrox/konflux-tasks) and doesn't use the changed lib.sh or the removed retag script.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/build.yaml:
- Around line 582-617: The new publish job push-matching-collector-scanner
creates a race because downstream jobs (e.g., scan-images-with-roxctl and
push-main-manifests) still run before matching images are published; update the
workflow to wait for it by adding push-matching-collector-scanner to the needs:
list of any jobs that currently depend on BUILD_TAG images (notably
scan-images-with-roxctl and push-main-manifests), or alternatively introduce a
small fan-in job that has needs: [push-main-manifests,
push-matching-collector-scanner] and move the PR “images are ready” comment to
that fan-in job so scans and the comment only run after both publish paths
complete.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: ab89a4e5-11d0-48bd-938f-d476573732d6

📥 Commits

Reviewing files that changed from the base of the PR and between d0b9689 and 2e14309.

📒 Files selected for processing (3)

.github/workflows/build.yaml
scripts/ci/lib.sh
scripts/ci/pull-retag-push.sh

💤 Files with no reviewable changes (1)

scripts/ci/pull-retag-push.sh

.github/workflows/build.yaml

rhacs-bot · 2026-03-31T18:05:06Z

/retest

rhacs-bot · 2026-03-31T19:30:23Z

Images are ready for the commit at 4174680.

To use with deploy scripts, first export MAIN_IMAGE_TAG=4.11.x-514-g4174680829.

Replace pull-tag-push workflow with docker buildx imagetools create for scanner, collector, and fact image retagging. This eliminates unnecessary image pulls and pushes by copying manifests directly in the registry. Changes: - Extract image retagging to separate job that runs once per branding instead of per-architecture - Use docker buildx imagetools create for registry-to-registry manifest copying without local pulls - Remove pull-retag-push.sh script (inlined into lib.sh) - Copy full multi-arch manifests instead of amd64-only - Remove scanner/collector/fact from manifest creation step (buildx creates multi-arch manifests directly) Benefits: - Eliminates GBs of network transfer (6 images × pull + push) - Near-instantaneous manifest copy vs pull+push - Supports all architectures from source images - Runs in parallel with build-and-push-main job ROX-30858 Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Signed-off-by: Tomasz Janiszewski <tomek@redhat.com> # Conflicts: # .github/workflows/build.yaml

Signed-off-by: Tomasz Janiszewski <tomek@redhat.com>

janisz requested a review from a team as a code owner March 31, 2026 12:01

github-actions bot added area/ci ai-review coderabbit-review labels Mar 31, 2026

sourcery-ai bot reviewed Mar 31, 2026

View reviewed changes

.github/workflows/build.yaml Show resolved Hide resolved

coderabbitai bot reviewed Mar 31, 2026

View reviewed changes

scripts/ci/lib.sh Outdated Show resolved Hide resolved

janisz force-pushed the ROX-30858/optimize-image-retagging branch from d0b9689 to c7f8205 Compare March 31, 2026 12:11

janisz requested a review from davdhacs March 31, 2026 13:16

janisz commented Mar 31, 2026

View reviewed changes

scripts/ci/lib.sh Show resolved Hide resolved

davdhacs approved these changes Mar 31, 2026

View reviewed changes

janisz force-pushed the ROX-30858/optimize-image-retagging branch from 124a23d to 2e14309 Compare March 31, 2026 16:48

janisz added auto-merge Auto-merge minor and patch version bumps auto-retest PRs with this label will be automatically retested if prow checks fails labels Mar 31, 2026

coderabbitai bot reviewed Mar 31, 2026

View reviewed changes

.github/workflows/build.yaml Show resolved Hide resolved

rhacs-bot enabled auto-merge (squash) March 31, 2026 20:53

janisz and others added 3 commits April 1, 2026 08:40

notify

af0a158

Signed-off-by: Tomasz Janiszewski <tomek@redhat.com> # Conflicts: # .github/workflows/build.yaml

scan images

4174680

Signed-off-by: Tomasz Janiszewski <tomek@redhat.com>

janisz force-pushed the ROX-30858/optimize-image-retagging branch from 2e14309 to 4174680 Compare April 1, 2026 06:45

janisz disabled auto-merge April 1, 2026 06:45

janisz enabled auto-merge (squash) April 1, 2026 07:23

janisz merged commit 4742225 into master Apr 1, 2026
110 of 115 checks passed

janisz deleted the ROX-30858/optimize-image-retagging branch April 1, 2026 08:57

Conversation

janisz commented Mar 31, 2026

Description

User-facing documentation

Testing and quality

Automated testing

How I validated my change

Uh oh!

sourcery-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

coderabbitai bot commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Walkthrough

Changes

Sequence Diagram(s)

Estimated code review effort

❌ Failed checks (1 inconclusive)

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

rhacs-bot commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rhacs-bot commented Mar 31, 2026

Uh oh!

codecov bot commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

davdhacs left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

rhacs-bot commented Mar 31, 2026

Uh oh!

rhacs-bot commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

coderabbitai bot commented Mar 31, 2026 •

edited

Loading

rhacs-bot commented Mar 31, 2026 •

edited

Loading

codecov bot commented Mar 31, 2026 •

edited

Loading

rhacs-bot commented Mar 31, 2026 •

edited

Loading