From 45e423c8df196468ce12eca59b369099b5b285b1 Mon Sep 17 00:00:00 2001 From: LuLo Date: Tue, 4 Aug 2026 14:14:09 +0200 Subject: [PATCH] ART-19029: feat(doozer): use openshift/golang-builder for released golang-builder pullspec Route openshift-golang-builder NVRs inside rh_art_images_base_pullspec so rebaser and pipelines stay in sync with konflux-release-data delivery. update-golang reuses that helper. Includes CI test and format fixes. rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED --- doozer/doozerlib/constants.py | 1 + doozer/doozerlib/image.py | 20 ++++++++++++++++++ doozer/doozerlib/util.py | 13 ++++++++++-- doozer/tests/backend/test_rebaser.py | 21 +++++++++++++------ .../elliottlib/cli/get_golang_report_cli.py | 3 ++- pyartcd/pyartcd/pipelines/update_golang.py | 6 ++---- pyartcd/tests/pipelines/test_update_golang.py | 8 +++---- 7 files changed, 55 insertions(+), 17 deletions(-) diff --git a/doozer/doozerlib/constants.py b/doozer/doozerlib/constants.py index ec64374da8..7611a58e28 100644 --- a/doozer/doozerlib/constants.py +++ b/doozer/doozerlib/constants.py @@ -92,3 +92,4 @@ KONFLUX_RELEASE_FBC_EC_POLICY_CONFIGURATION = "rhtap-releng-tenant/fbc-ocp-art-stage" ART_IMAGES_BASE_APPLICATION = "art-images-base" +ART_IMAGES_GOLANG_BUILDER_APPLICATION = "golang-builder" diff --git a/doozer/doozerlib/image.py b/doozer/doozerlib/image.py index fcc3a3caea..f3ce7ff960 100644 --- a/doozer/doozerlib/image.py +++ b/doozer/doozerlib/image.py @@ -1461,6 +1461,26 @@ def should_trigger_base_image_release(self) -> bool: self.logger.info(f"Base image release enabled set from {source} {base_image_release_enabled}") return base_image_release_enabled + def is_base_image_release_quay_fallback_enabled(self) -> bool: + """ + When False and ``should_trigger_base_image_release()`` applies, late parent resolve + must not fall back to Konflux ``image_pullspec`` if the ``registry.redhat.io`` delivery mirror + (``openshift/golang-builder`` for golang builders, ``openshift/art-images-base`` for other base_only images) + is unreachable (rebase fails instead). + + Image ``base_image_release.quay_fallback`` overrides group; default True + (same pattern as ``konflux.cachi2.lockfile.enabled``). + """ + base_image_release_quay_fallback_config_override = self.config.base_image_release.quay_fallback + if base_image_release_quay_fallback_config_override not in [Missing, None]: + return bool(base_image_release_quay_fallback_config_override) + else: + base_image_release_quay_fallback_group_override = self.runtime.group_config.base_image_release.quay_fallback + if base_image_release_quay_fallback_group_override not in [Missing, None]: + return bool(base_image_release_quay_fallback_group_override) + + return True + def get_required_artifacts(self) -> list: """ Get list of required artifacts from image config. diff --git a/doozer/doozerlib/util.py b/doozer/doozerlib/util.py index 8ce2078049..9358dffa6f 100644 --- a/doozer/doozerlib/util.py +++ b/doozer/doozerlib/util.py @@ -53,8 +53,17 @@ def ignore_aliases(self, data): def rh_art_images_base_pullspec(nvr: str) -> str: - """Pullspec for golang/base images after art-images-base release (NVR = component-version-release).""" - return f"{doozer_constants.DELIVERY_IMAGE_REGISTRY}/openshift/{doozer_constants.ART_IMAGES_BASE_APPLICATION}:{nvr}" + """registry.redhat.io pullspec after Konflux silent release (image tag = full publish NVR string). + + openshift-golang-builder image NVRs publish under openshift/ ``ART_IMAGES_GOLANG_BUILDER_APPLICATION``. + Other silent-released base images publish under openshift/ ``ART_IMAGES_BASE_APPLICATION``. + """ + repo_app = ( + doozer_constants.ART_IMAGES_GOLANG_BUILDER_APPLICATION + if nvr.startswith("openshift-golang-builder") + else doozer_constants.ART_IMAGES_BASE_APPLICATION + ) + return f"{doozer_constants.DELIVERY_IMAGE_REGISTRY}/openshift/{repo_app}:{nvr}" def dict_get(dct, path, default=DICT_EMPTY): diff --git a/doozer/tests/backend/test_rebaser.py b/doozer/tests/backend/test_rebaser.py index 8b968a843c..d2ad25ed13 100644 --- a/doozer/tests/backend/test_rebaser.py +++ b/doozer/tests/backend/test_rebaser.py @@ -1504,10 +1504,19 @@ def test_single_segment(self): class TestRhArtImagesBasePullspec(TestCase): - def test_rh_art_images_base_pullspec_matches_db_convention(self): + def test_golang_builder_uses_delivery_golang_repo(self): from doozerlib.util import rh_art_images_base_pullspec nvr = "openshift-golang-builder-container-v1.21-1.el9" + self.assertEqual( + rh_art_images_base_pullspec(nvr), + f"registry.redhat.io/openshift/golang-builder:{nvr}", + ) + + def test_non_golang_base_uses_art_images_base_repo(self): + from doozerlib.util import rh_art_images_base_pullspec + + nvr = "ose-base-rhel9-container-v1.0.0-test" self.assertEqual( rh_art_images_base_pullspec(nvr), f"registry.redhat.io/openshift/art-images-base:{nvr}", @@ -1545,11 +1554,11 @@ async def test_resolve_member_parent_uses_rh_when_art_base_and_labels_present(se resolved, _embargo = await rebaser._resolve_member_parent("golang-builder", "ignored") self.assertEqual( resolved, - "registry.redhat.io/openshift/art-images-base:openshift-golang-builder-container-v1.21-1.el9", + "registry.redhat.io/openshift/golang-builder:openshift-golang-builder-container-v1.21-1.el9", ) - async def test_resolve_member_parent_late_resolve_uses_rh_art_base_tag(self): - """Late-resolve (DB) base/golang: RH art-images-base when tag is reachable.""" + async def test_resolve_member_parent_late_resolve_uses_rh_delivery_tag(self): + """Late-resolve (DB) golang-builder: openshift/golang-builder on RH if reachable, else Konflux digest.""" parent = MagicMock() parent.distgit_key = "golang-builder" parent.should_trigger_base_image_release.return_value = True @@ -1577,7 +1586,7 @@ async def test_resolve_member_parent_late_resolve_uses_rh_art_base_tag(self): resolved, emb = await rebaser._resolve_member_parent("golang-builder", "orig") self.assertEqual( - resolved, "registry.redhat.io/openshift/art-images-base:openshift-golang-builder-container-v1.21-1.el9" + resolved, "registry.redhat.io/openshift/golang-builder:openshift-golang-builder-container-v1.21-1.el9" ) self.assertFalse(emb) @@ -1608,7 +1617,7 @@ async def test_resolve_member_parent_late_resolve_fails_when_art_base_missing(se rebaser.derived_group = "openshift-4.18" rebaser._registry_pullspec_exists = AsyncMock(return_value=False) - rh_pullspec = "registry.redhat.io/openshift/art-images-base:openshift-golang-builder-container-v1.21-1.el9" + rh_pullspec = "registry.redhat.io/openshift/golang-builder:openshift-golang-builder-container-v1.21-1.el9" with self.assertRaises(IOError) as ctx: await rebaser._resolve_member_parent("golang-builder", "orig") self.assertIn("golang-builder", str(ctx.exception)) diff --git a/elliott/elliottlib/cli/get_golang_report_cli.py b/elliott/elliottlib/cli/get_golang_report_cli.py index ca3b2e1238..7eb64477fc 100644 --- a/elliott/elliottlib/cli/get_golang_report_cli.py +++ b/elliott/elliottlib/cli/get_golang_report_cli.py @@ -83,7 +83,8 @@ def golang_report_for_version(runtime, ocp_version: str, ignore_rhel: bool = Fal else: tag = image_nvr_like.split(':')[-1] if tag.startswith('openshift-golang-builder-container-'): - # registry.redhat.io/openshift/art-images-base:openshift-golang-builder-container-v1.25.8-... + # registry.redhat.io/openshift/golang-builder:openshift-golang-builder-container-v1.25.8-... + # (formerly art-images-base before ART moved published golang builders) # Tag is already in NVR name format nvr = tag else: diff --git a/pyartcd/pyartcd/pipelines/update_golang.py b/pyartcd/pyartcd/pipelines/update_golang.py index 2b599ef041..914f887ce2 100644 --- a/pyartcd/pyartcd/pipelines/update_golang.py +++ b/pyartcd/pyartcd/pipelines/update_golang.py @@ -16,7 +16,6 @@ GOLANG_NVR_LABEL, KONFLUX_DEFAULT_IMAGE_REPO, PRODUCT_NAMESPACE_MAP, - REGISTRY_REDHAT_IO, ) from artcommonlib.github_auth import get_github_client_for_org from artcommonlib.konflux.konflux_build_record import ArtifactType, Engine, KonfluxBuildOutcome, KonfluxBuildRecord @@ -25,7 +24,7 @@ from artcommonlib.rpm_utils import parse_nvr from artcommonlib.util import new_roundtrip_yaml_handler from doozerlib.cli.config_plashet import KNOWN_SIGNING_KEYS -from doozerlib.constants import ART_IMAGES_BASE_APPLICATION +from doozerlib.util import rh_art_images_base_pullspec from elliottlib import util as elliottutil from elliottlib.constants import GOLANG_BUILDER_CVE_COMPONENT from tenacity import before_sleep_log, retry, retry_if_exception_type, stop_after_attempt, wait_exponential @@ -38,7 +37,6 @@ _LOGGER = logging.getLogger(__name__) yaml = new_roundtrip_yaml_handler() -PUBLISHED_GOLANG_BUILDER_REPO = f"{REGISTRY_REDHAT_IO}/openshift/{ART_IMAGES_BASE_APPLICATION}" def is_latest(ocp_version: str, el_v: int, nvr: str, koji_session) -> bool: @@ -781,7 +779,7 @@ def _get_builder_pullspec(self, builder_nvr: str): elif component_name != GOLANG_BUILDER_CVE_COMPONENT: raise ValueError(f"Expected a golang builder image NVR, got: {builder_nvr}") published_nvr = f'{component_name}-{parsed_nvr["version"]}-{parsed_nvr["release"]}' - return f'{PUBLISHED_GOLANG_BUILDER_REPO}:{published_nvr}' + return rh_art_images_base_pullspec(published_nvr) @staticmethod def _get_konflux_builder_pullspec(builder_nvr: str): diff --git a/pyartcd/tests/pipelines/test_update_golang.py b/pyartcd/tests/pipelines/test_update_golang.py index 357bce517b..8b3616d822 100644 --- a/pyartcd/tests/pipelines/test_update_golang.py +++ b/pyartcd/tests/pipelines/test_update_golang.py @@ -835,7 +835,7 @@ def test_get_builder_pullspec(self, mock_konflux_db): self.assertEqual( pullspec, - "registry.redhat.io/openshift/art-images-base:" + "registry.redhat.io/openshift/golang-builder:" "openshift-golang-builder-container-v1.25.8-202604150744.p2.gf28329a.el9", ) @@ -849,7 +849,7 @@ def test_get_builder_pullspec_normalizes_konflux_nvr_name(self, mock_konflux_db) self.assertEqual( pullspec, - "registry.redhat.io/openshift/art-images-base:" + "registry.redhat.io/openshift/golang-builder:" "openshift-golang-builder-container-v1.25.8-202604150744.p2.gf28329a.el9", ) @@ -867,7 +867,7 @@ async def test_ensure_builder_pullspec_available_reuses_oc_helper(self, mock_kon """Test published pullspec availability check reuses pyartcd.oc.get_image_info with quay auth""" pipeline = self._make_pipeline(build_system="konflux") - pullspec = "registry.redhat.io/openshift/art-images-base:openshift-golang-builder-container-v1.25.8-test" + pullspec = "registry.redhat.io/openshift/golang-builder:openshift-golang-builder-container-v1.25.8-test" quay_auth_file = str(Path(self.enterContext(tempfile.TemporaryDirectory())) / "quay-auth.json") with patch.dict( @@ -885,7 +885,7 @@ async def test_ensure_builder_pullspec_available_errors_when_oc_helper_fails(sel """Test published pullspec availability check raises when pyartcd.oc.get_image_info fails""" pipeline = self._make_pipeline(build_system="konflux") - pullspec = "registry.redhat.io/openshift/art-images-base:openshift-golang-builder-container-v1.25.8-test" + pullspec = "registry.redhat.io/openshift/golang-builder:openshift-golang-builder-container-v1.25.8-test" get_image_info.side_effect = ValueError("Image pullspec is not found.") quay_auth_file = str(Path(self.enterContext(tempfile.TemporaryDirectory())) / "quay-auth.json")