ART-19029: feat(doozer): use openshift/golang-builder for released golang-builder pullspec

[lgarciaaco]

Summary

• Centralize RHSI delivery URLs for released openshift-golang-builder images in rh_art_images_base_pullspec so they resolve to registry.redhat.io/openshift/golang-builder instead of art-images-base.
• Wire update-golang to build stream pullspecs via the same helper to avoid drift.

Problem

Before: Doozer/pyartcd assumed published golang builders lived under openshift/art-images-base, which no longer matches Konflux silent-release delivery for golang builders.

After: openshift-golang-builder* NVR strings map to openshift/golang-builder; other silent-released bases stay on openshift/art-images-base. Rebase call sites unchanged.

Links

• Konflux release data: https://gitlab.cee.redhat.com/releng/konflux-release-data/-/merge_requests/18169
• Tracking: ART-19029 (sub-task of ART-14300)

Testing

• Lint: make / ruff as in make test front half (pass).
• Packages (from correct roots where required): pytest doozer/tests/ -k 'not FindGoMainPackages' (908 passed — excludes macOS /private/var temp-path flakes in TestFindGoMainPackages), pytest pyartcd/tests from pyartcd/, pytest elliott/tests from elliott/, pytest artcommon/tests + ocp-build-data-validator/tests (all pass).
• Repo make test currently fails on Darwin for unrelated TestFindGoMainPackages path canonicalization and parallel runner grep -P quirks.

Summary by CodeRabbit

• New Features

  • Golang builder images now use the dedicated openshift/golang-builder repository.
  • Image pullspecs include the complete build version as the image tag.
  • Base-image Quay fallback settings can be configured through image metadata or group settings, defaulting to enabled.

• Bug Fixes

  • Non-Golang base images continue using the standard ART base-image repository.
  • Builder image publishing and availability checks now use the correct repository.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci-robot]

@lgarciaaco: This pull request references ART-19029 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the sub-task to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

• Centralize RHSI delivery URLs for released openshift-golang-builder images in rh_art_images_base_pullspec so they resolve to registry.redhat.io/openshift/golang-builder instead of art-images-base.
• Wire update-golang to build stream pullspecs via the same helper to avoid drift.

Problem

Before: Doozer/pyartcd assumed published golang builders lived under openshift/art-images-base, which no longer matches Konflux silent-release delivery for golang builders.

After: openshift-golang-builder* NVR strings map to openshift/golang-builder; other silent-released bases stay on openshift/art-images-base. Rebase call sites unchanged.

Links

• Konflux release data: https://gitlab.cee.redhat.com/releng/konflux-release-data/-/merge_requests/18169
• Tracking: ART-19029 (sub-task of ART-14300)

Testing

• Lint: make / ruff as in make test front half (pass).
• Packages (from correct roots where required): pytest doozer/tests/ -k 'not FindGoMainPackages' (908 passed — excludes macOS /private/var temp-path flakes in TestFindGoMainPackages), pytest pyartcd/tests from pyartcd/, pytest elliott/tests from elliott/, pytest artcommon/tests + ocp-build-data-validator/tests (all pass).
• Repo make test currently fails on Darwin for unrelated TestFindGoMainPackages path canonicalization and parallel runner grep -P quirks.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift-eng/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: b7d615cd-0532-42c2-b16a-6d326e98d1d8

📥 Commits

Reviewing files that changed from the base of the PR and between c5a05ff and 45e423c.

📒 Files selected for processing (7)

• doozer/doozerlib/constants.py
• doozer/doozerlib/image.py
• doozer/doozerlib/util.py
• doozer/tests/backend/test_rebaser.py
• elliott/elliottlib/cli/get_golang_report_cli.py
• pyartcd/pyartcd/pipelines/update_golang.py
• pyartcd/tests/pipelines/test_update_golang.py

🚧 Files skipped from review as they are similar to previous changes (7)

• elliott/elliottlib/cli/get_golang_report_cli.py
• doozer/doozerlib/constants.py
• pyartcd/tests/pipelines/test_update_golang.py
• doozer/doozerlib/util.py
• doozer/doozerlib/image.py
• doozer/tests/backend/test_rebaser.py
• pyartcd/pyartcd/pipelines/update_golang.py

---

Walkthrough

The change adds Quay fallback resolution and routes openshift-golang-builder NVRs to openshift/golang-builder. It updates pullspec generation, pipeline integration, tests, and Golang image path documentation.

Changes

Golang builder routing

Layer / File(s)	Summary
Routing contracts doozer/doozerlib/constants.py, doozer/doozerlib/image.py	The code defines the Golang Builder application and resolves base_image_release.quay_fallback from image metadata, group configuration, or True.
Conditional pullspec generation doozer/doozerlib/util.py	The helper selects golang-builder for NVRs beginning with openshift-golang-builder. Other NVRs use art-images-base. The full NVR remains the image tag.
Pipeline integration and validation pyartcd/pyartcd/pipelines/update_golang.py, doozer/tests/backend/test_rebaser.py, pyartcd/tests/pipelines/test_update_golang.py, elliott/elliottlib/cli/get_golang_report_cli.py	The update pipeline uses the shared helper. Tests and documentation use the dedicated Golang builder repository path.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant UpdateGolang
  participant PullspecHelper
  participant Registry
  UpdateGolang->>PullspecHelper: Request builder pullspec
  PullspecHelper->>PullspecHelper: Select application from NVR
  PullspecHelper->>Registry: Construct registry.redhat.io pullspec
  Registry-->>UpdateGolang: Return builder pullspec

Loading

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change to use openshift/golang-builder for released Golang builder pullspecs.
Docstring Coverage	✅ Passed	Docstring coverage is 90.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No-Weak-Crypto	✅ Passed	PR introduces no weak cryptography. Changes add constants, conditional repository selection logic, and tests. No MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, custom crypto, or insecure secret comparis...
Container-Privileges	✅ Passed	This pull request contains only Python source files (constants, methods, utility functions) with no Kubernetes manifests or container specifications that could contain privileged configurations.
No-Sensitive-Data-In-Logs	✅ Passed	No logging statements expose sensitive data. Added code only references public registry URLs, image repositories, version strings, and configuration values. No passwords, tokens, credentials, or PI...
No-Hardcoded-Secrets	✅ Passed	The seven-file diff adds only image names, pullspecs, tests, and config lookup logic; scans found no secret assignments, credential URLs, private-key/JWT markers, or long base64 literals.
No-Injection-Vectors	✅ Passed	Code changes contain no injection vectors: uses safe string constants, type conversion, f-string formatting, and safe string methods only.
Ai-Attribution	✅ Passed	PR description does not mention AI tool usage. No explicit indication that AI was used to generate the code changes, so AI attribution requirements do not apply.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign fgallott for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@doozer/tests/backend/test_rebaser.py`:
- Line 1589: Rename
test_resolve_member_parent_late_resolve_fails_when_art_base_missing to reflect
the golang-builder case, and update its rh_pullspec expectation to
registry.redhat.io/openshift/golang-builder so it matches the changed mapping
while preserving the existing failure assertion.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: openshift-eng/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 922c8060-11bd-4463-8dca-691db687ce48

📥 Commits

Reviewing files that changed from the base of the PR and between bc8e9a5 and 3e0c694.

📒 Files selected for processing (7)

• doozer/doozerlib/constants.py
• doozer/doozerlib/image.py
• doozer/doozerlib/util.py
• doozer/tests/backend/test_rebaser.py
• elliott/elliottlib/cli/get_golang_report_cli.py
• pyartcd/pyartcd/pipelines/update_golang.py
• pyartcd/tests/pipelines/test_update_golang.py

[openshift-ci]

@lgarciaaco: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/security	45e423c	link	false	/test security

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.