Skip to content

[WIP] RHTAP-5694 Add workspaces instead of results for parameters in pipelines #1287

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jkopriva wants to merge 7 commits into
base: main
Choose a base branch
from
Open

[WIP] RHTAP-5694 Add workspaces instead of results for parameters in pipelines #1287

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
395b6b8
RHTAP-5694 Add workspaces instead of results for parameters in pipelines
jkopriva Sep 26, 2025
f859de7
Update e2e-main-pipelinerun.yaml
jkopriva Mar 3, 2026
be02832
Update e2e-periodic-pipelinerun.yaml
jkopriva Mar 3, 2026
0d10e16
Add missing params
jkopriva Mar 3, 2026
236c8c6
Merge branch 'main' into RHTAP-5694
jkopriva Mar 5, 2026
f88c714
Remove comment in get-rhads-config.yaml
jkopriva Mar 6, 2026
17d232e
Merge branch 'main' into RHTAP-5694
jkopriva Mar 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 9 additions & 2 deletions integration-tests/pipelines/e2e-main-pipeline.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,9 @@ spec:
description: 'The number of replicas for the cluster nodes.'
default: "3"
type: string
workspaces:
- name: rhads-config
description: "Workspace for sharing RHADS configuration data between tasks"
tasks:
- name: test-metadata
taskRef:
Expand Down Expand Up @@ -56,6 +59,9 @@ spec:
params:
- name: job-spec
value: $(tasks.test-metadata.results.job-spec)
workspaces:
- name: rhads-config
workspace: rhads-config
- name: start-nested-pipelines
timeout: "2h30m"
runAfter:
Expand All @@ -75,8 +81,6 @@ spec:
value: $(params.SNAPSHOT)
- name: job-spec
value: $(tasks.test-metadata.results.job-spec)
- name: rhads-config
value: $(tasks.process-rhads-config.results.rhads-config)
- name: mode
value: "single"
- name: konflux-test-infra-secret
Expand All @@ -89,6 +93,9 @@ spec:
value: $(params.ocp-replicas)
- name: context-pipeline-run-name
value: $(context.pipelineRun.name)
workspaces:
- name: rhads-config
workspace: rhads-config
finally:
- name: cancel-nested-pipelines
when:
Expand Down
33 changes: 33 additions & 0 deletions integration-tests/pipelines/e2e-main-pipelinerun.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
---
apiVersion: tekton.dev/v1
kind: PipelineRun
metadata:
name: e2e-main-pipelinerun
namespace: rhtap-shared-team-tenant
labels:
appstudio.openshift.io/component: tssc-cli
appstudio.openshift.io/application: tssc-cli
spec:
pipelineRef:
resolver: git
params:
- name: url
value: https://github.com/redhat-appstudio/tssc-cli
- name: revision
value: main
- name: pathInRepo
value: integration-tests/pipelines/e2e-main-pipeline.yaml
params:
- name: konflux-test-infra-secret
value: konflux-test-infra
- name: cloud-credential-key
value: rhtap-cloud-credentials-us-east-1
workspaces:
Comment thread
coderabbitai[bot] marked this conversation as resolved.
- name: rhads-config
volumeClaimTemplate:
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 1Gi
11 changes: 9 additions & 2 deletions integration-tests/pipelines/e2e-periodic-pipeline.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,9 @@ spec:
description: 'Additional parameters for installation testing (e.g., PRE_RELEASE=TAS TAS_VERSION=1.3.2). When empty, does not alter normal installation.'
default: ""
type: string
workspaces:
- name: rhads-config
description: "Workspace for sharing RHADS configuration data between tasks"
tasks:
- name: test-metadata
taskRef:
Expand Down Expand Up @@ -63,6 +66,9 @@ spec:
params:
- name: job-spec
value: $(tasks.test-metadata.results.job-spec)
workspaces:
- name: rhads-config
workspace: rhads-config
runAfter:
- test-metadata
- name: start-periodic-pipelines
Expand All @@ -83,8 +89,6 @@ spec:
value: $(params.SNAPSHOT)
- name: job-spec
value: $(tasks.test-metadata.results.job-spec)
- name: rhads-config
value: $(tasks.process-periodic-configs.results.rhads-config)
- name: mode
value: "periodic"
- name: konflux-test-infra-secret
Expand All @@ -99,3 +103,6 @@ spec:
value: $(params.install-params)
- name: context-pipeline-run-name
value: $(context.pipelineRun.name)
workspaces:
- name: rhads-config
workspace: rhads-config
29 changes: 29 additions & 0 deletions integration-tests/pipelines/e2e-periodic-pipelinerun.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
---
apiVersion: tekton.dev/v1
kind: PipelineRun
metadata:
generateName: e2e-periodic-pipelinerun-
spec:
pipelineRef:
resolver: git
params:
- name: url
value: https://github.com/redhat-appstudio/tssc-cli
- name: revision
value: main
- name: pathInRepo
value: integration-tests/pipelines/e2e-periodic-pipeline.yaml
params:
- name: konflux-test-infra-secret
value: konflux-test-infra
- name: cloud-credential-key
value: rhtap-cloud-credentials-us-east-1
workspaces:
- name: rhads-config
volumeClaimTemplate:
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 1Gi
7 changes: 3 additions & 4 deletions integration-tests/tasks/get-rhads-config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,12 +14,13 @@ spec:
- name: job-spec
description: "Job specification metadata"
type: string
results:
workspaces:
- name: rhads-config
description: "The RHADS configuration content (base64 encoded)"
description: "Workspace for storing RHADS configuration data"
steps:
- name: get-rhads-config
image: quay.io/konflux-ci/appstudio-utils:ab6b0b8e40e440158e7288c73aff1cf83a2cc8a9@sha256:24179f0efd06c65d16868c2d7eb82573cce8e43533de6cea14fec3b7446e0b14
workingDir: $(workspaces.rhads-config.path)
env:
- name: JOB_SPEC
value: $(params.job-spec)
Expand All @@ -44,5 +45,3 @@ spec:

echo "Original rhads-config content:"
cat rhads-config
echo "Encoding rhads-config to base64:"
cat rhads-config | base64 -w 0 | tee $(results.rhads-config.path)
14 changes: 8 additions & 6 deletions integration-tests/tasks/process-periodic-configs.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,9 +15,10 @@ spec:
- name: job-spec
description: "Job specification metadata"
type: string
results:
workspaces:
- name: rhads-config
description: "JSON formatted configuration data (array of configs from PICT, base64 encoded)"
description: "Workspace for storing RHADS configuration data"
results:
- name: periodic-pict
description: "Periodic PICT file content for sharing between steps"
- name: pict-output
Expand Down Expand Up @@ -55,6 +56,7 @@ spec:

- name: process-config
image: quay.io/konflux-ci/appstudio-utils:ab6b0b8e40e440158e7288c73aff1cf83a2cc8a9@sha256:24179f0efd06c65d16868c2d7eb82573cce8e43533de6cea14fec3b7446e0b14
workingDir: $(workspaces.rhads-config.path)
script: |
#!/usr/bin/env bash
set -euo pipefail
Expand All @@ -63,7 +65,7 @@ spec:
# Get the PICT output from the previous step
cat $(results.pict-output.path) > pict_output.txt
# Set local variable for maximum configurations (0 = all configurations)
MAX_CONFIGS=1 # Change this value to limit configurations (e.g., 5, 10, etc.)
MAX_CONFIGS=0 # Change this value to limit configurations (e.g., 5, 10, etc.)
echo "Maximum configurations requested: $MAX_CONFIGS (0 = all configurations)"
# Debug: Check if pict_output.txt exists and show its content
if [[ ! -f pict_output.txt ]]; then
Expand Down Expand Up @@ -136,10 +138,10 @@ spec:
else
echo "No limit applied - processed all available configurations"
fi
# Copy output to result path
# Copy output to workspace
echo "Final output:"
cat "$OUTPUT_FILE"

echo "Encoding rhads-config to base64:"
cat "$OUTPUT_FILE" | base64 -w 0 | tee $(results.rhads-config.path)
echo "Writing rhads-config to workspace:"
cp "$OUTPUT_FILE" rhads-config
echo "Configuration count: $CONFIG_COUNT"
17 changes: 8 additions & 9 deletions integration-tests/tasks/start-pipelines.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,9 +19,6 @@ spec:
- name: job-spec
description: "Job specification metadata"
type: string
- name: rhads-config
description: "RHADS configuration data (single config or array of configs with separators, base64 encoded)"
type: string
- name: mode
description: "Pipeline mode: 'single' for single config, 'periodic' for multiple configs with separators"
type: string
Expand All @@ -48,19 +45,21 @@ spec:
description: "Context pipeline run name for labeling"
type: string
default: ""
workspaces:
- name: rhads-config
description: "Workspace containing RHADS configuration data"
results:
- name: pipeline-runs
description: "Array of started pipeline run names"
steps:
- name: start-pipelines
image: quay.io/openshift-pipeline/ci
workingDir: $(workspaces.rhads-config.path)
env:
Comment on lines 56 to 58

@coderabbitai coderabbitai Bot Sep 26, 2025

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

❓ Verification inconclusive

Pin the execution image.

quay.io/openshift-pipeline/ci is unpinned. Use a versioned tag+digest to ensure reproducibility and avoid supply-chain drift.

Share the desired version and I’ll suggest a pinned digest.

Pin the execution image
integration-tests/tasks/start-pipelines.yaml:52 – replace the unpinned quay.io/openshift-pipeline/ci with a versioned tag and digest (e.g. quay.io/openshift-pipeline/ci:vX.Y.Z@sha256:<hash>). Share your desired tag and I’ll provide the corresponding digest.

🤖 Prompt for AI Agents 
integration-tests/tasks/start-pipelines.yaml around lines 52 to 54: the image is
currently unpinned ("quay.io/openshift-pipeline/ci"); replace it with a fully
pinned image reference that includes a version tag and digest (format:
quay.io/openshift-pipeline/ci:vX.Y.Z@sha256:<hash>) to ensure immutability;
update the image field to that pinned value (use the specific tag you want and
ask the reviewer to supply the correct sha256 digest to insert).

- name: SNAPSHOT
value: $(params.snapshot)
- name: JOB_SPEC
value: $(params.job-spec)
- name: RHADS_CONFIG
value: $(params.rhads-config)
- name: MODE
value: $(params.mode)
- name: CONTEXT_PIPELINE_RUN_NAME
Expand Down Expand Up @@ -93,10 +92,10 @@ spec:

echo "Starting pipelines in mode: $MODE"
echo "Using Konflux metadata: namespace=$KONFLUX_NAMESPACE, app=$KONFLUX_APPLICATION_NAME, component=$KONFLUX_COMPONENT_NAME"
# Decode base64 encoded rhads-config
echo "Decoding base64 encoded rhads-config..."
DECODED_RHADS_CONFIG=$(echo "$RHADS_CONFIG" | base64 -d)
echo "Decoded rhads-config content:"
# Read rhads-config from workspace
echo "Reading rhads-config from workspace..."
DECODED_RHADS_CONFIG=$(cat rhads-config)
echo "rhads-config content:"
echo "$DECODED_RHADS_CONFIG"
Comment on lines +95 to 99

@coderabbitai coderabbitai Bot Mar 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Avoid logging full rhads-config content.

Dumping the entire config to logs risks leaking sensitive data. Log metadata only (e.g., presence/size), not raw content.

Safer logging in this block 
         # Read rhads-config from workspace
         echo "Reading rhads-config from workspace..."
         DECODED_RHADS_CONFIG=$(cat rhads-config)
-        echo "rhads-config content:"
-        echo "$DECODED_RHADS_CONFIG"
+        echo "rhads-config loaded from workspace."
+        echo "rhads-config size: ${`#DECODED_RHADS_CONFIG`} bytes"
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# Read rhads-config from workspace
echo "Reading rhads-config from workspace..."
DECODED_RHADS_CONFIG=$(cat rhads-config)
echo "rhads-config content:"
echo "$DECODED_RHADS_CONFIG"
# Read rhads-config from workspace
echo "Reading rhads-config from workspace..."
DECODED_RHADS_CONFIG=$(cat rhads-config)
echo "rhads-config loaded from workspace."
echo "rhads-config size: ${`#DECODED_RHADS_CONFIG`} bytes"
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@integration-tests/tasks/start-pipelines.yaml` around lines 89 - 93, The
script currently prints the full rhads-config by echoing DECODED_RHADS_CONFIG
which can leak secrets; change the logging to avoid outputting raw content and
instead log only metadata (e.g., existence and byte/line count). Locate the
block that sets DECODED_RHADS_CONFIG and replace the echo of its content with
safe checks such as testing file existence and using wc or stat to report
size/line count, and ensure any diagnostic logs reference DECODED_RHADS_CONFIG
only for metadata rather than printing its value.

# Extract images from snapshot
tssc_image=$(echo "${SNAPSHOT}" | jq -r '.components[] |select(.name | startswith("tssc-cli")).containerImage')
Expand Down