Skip to content

Automate CPE label update in release branch setup script #3536

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dheerajodha wants to merge 5 commits into
base: main
Choose a base branch
from
+32 −1
Open

Automate CPE label update in release branch setup script #3536

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
5fdc57f
Automate CPE label update in release branch setup script
dheerajodha Sep 3, 2026
c534ef8
Validate CPE_VERSION format before sed interpolation
dheerajodha Sep 3, 2026
87c764e
Rename CPE_VERSION to TAS_VERSION for clarity
dheerajodha Sep 8, 2026
e059e04
Verify sed substitution succeeded in Dockerfile.dist
dheerajodha Sep 8, 2026
15626a8
Use portable sed -i and fix echo to match inserted form
dheerajodha Sep 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 32 additions & 1 deletion hack/release-branch-pipeline-patch.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,6 +91,37 @@ EOT
awk "$awk_query" <(git show main:$MAIN_PR_PIPELINE) > $RELEASE_PR_PIPELINE
awk "$awk_query" <(git show main:$MAIN_PUSH_PIPELINE) > $RELEASE_PUSH_PIPELINE

# Set the CPE and name labels in Dockerfile.dist for the release branch.
# The TAS (Trusted Artifact Signer) version doesn't necessarily follow
# the Conforma version, so it must be provided explicitly.
TAS_VERSION="${TAS_VERSION:-}"
if [[ -z "$TAS_VERSION" ]]; then
read -rp "Enter the TAS version for this release (e.g. 1.5): " TAS_VERSION

@fullsend-ai-review fullsend-ai-review Bot Sep 8, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] error-handling

read -rp runs unguarded under set -o errexit. In a non-interactive context (CI, stdin closed) read returns non-zero on EOF, which under errexit terminates the script immediately with no output; the intended echo Error: TAS version is required at line 103 is never reached. Callers see a bare non-zero exit with no explanation.

Suggested fix: read -rp "..." TAS_VERSION || true, or guard with if [[ -t 0 ]]; then read -rp ...; fi, so the subsequent [[ -z "$TAS_VERSION" ]] check runs and emits the informative error.

fi

if [[ -z "$TAS_VERSION" ]]; then
echo "Error: TAS version is required"
exit 1
fi

if [[ ! "$TAS_VERSION" =~ ^[0-9]+\.[0-9]+$ ]]; then
echo "Error: TAS version must be in MAJOR.MINOR format (e.g. 1.5), got: ${TAS_VERSION}"
exit 1
fi

sed -i.bak -e "s|name=\"ec\"|name=\"rhtas/ec-rhel9\" \\\\\\n cpe=\"cpe:/a:redhat:trusted_artifact_signer:${TAS_VERSION}::el9\"|" Dockerfile.dist

@fullsend-ai-review fullsend-ai-review Bot Sep 8, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[high] portability

The sed replacement uses \n to inject a newline, but that is a GNU-sed-only extension. Bash double-quote processing turns the six backslashes + n into three backslashes + n sent to sed; GNU sed collapses to \ + newline (correct Dockerfile line-continuation). BSD sed (macOS default) does NOT interpret \n in the replacement as a newline, so Dockerfile.dist gets both labels concatenated on one physical line with a literal \n embedded inside the LABEL string. The follow-up grep -q for the CPE substring still matches on that broken single line and reports success, so the script prints Updated Dockerfile.dist labels while having produced a malformed LABEL. sed -i.bak already used here suggests macOS compatibility was intended.

Suggested fix: Use $'...' ANSI-C quoting so bash inserts a real newline before sed sees it (portable across GNU and BSD sed); or require GNU sed explicitly (detect and error if sed --version fails); or strengthen the post-check to anchor on the two-line form: grep -q '^ cpe="cpe:/a:redhat:trusted_artifact_signer:'"${TAS_VERSION}"'::el9"$' Dockerfile.dist.

rm -f Dockerfile.dist.bak

grep -q "cpe:/a:redhat:trusted_artifact_signer:${TAS_VERSION}::el9" Dockerfile.dist || {

@fullsend-ai-review fullsend-ai-review Bot Sep 8, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] correctness

grep -q cpe:/a:redhat:trusted_artifact_signer:${TAS_VERSION}::el9 interpolates ${TAS_VERSION} (containing a literal .) into a BRE, where . matches any character. The ^[0-9]+.[0-9]+$ validator makes a false positive essentially impossible in practice, but defensive scripting prefers fixed-string matching.

Suggested fix: Use grep -qF to treat the pattern as a fixed string.

echo "Error: failed to update Dockerfile.dist labels (pattern not found — file may already be patched, or the label format changed)"
exit 1
}

echo "Updated Dockerfile.dist labels:"
echo " name=\"rhtas/ec-rhel9\" \\"
echo " cpe=\"cpe:/a:redhat:trusted_artifact_signer:${TAS_VERSION}::el9\""
echo ""

echo "To review the new pipeline definitions:"
echo " vimdiff <(git show main:$MAIN_PR_PIPELINE) $RELEASE_PR_PIPELINE"
echo " vimdiff <(git show main:$MAIN_PUSH_PIPELINE) $RELEASE_PUSH_PIPELINE"
Expand All @@ -100,4 +131,4 @@ echo " vimdiff <(git show release-v$OLD_VERSION:$OLD_RELEASE_PUSH_PIPELINE) $RE
echo ""
echo "If the above comparisons look good then you probably want to do this:"
echo " git rm $MAIN_PR_PIPELINE $MAIN_PUSH_PIPELINE"
echo " git add $RELEASE_PR_PIPELINE $RELEASE_PUSH_PIPELINE"
echo " git add $RELEASE_PR_PIPELINE $RELEASE_PUSH_PIPELINE Dockerfile.dist"
Loading