Skip to content

fix: scope e2e image update sed to avoid corrupting digests - #1886

Open
bacciotti wants to merge 1 commit into
konflux-ci:mainfrom
bacciotti:fix/e2e-update-script-scope-sha-replace
Open

fix: scope e2e image update sed to avoid corrupting digests#1886
bacciotti wants to merge 1 commit into
konflux-ci:mainfrom
bacciotti:fix/e2e-update-script-scope-sha-replace

Conversation

@bacciotti

Copy link
Copy Markdown

Summary

  • Scope the post-build SHA replacement in .tekton/konflux-e2e-tests-push.yaml so it only rewrites konflux-e2e-tests:<40-hex> tags.
  • The previous global s/[0-9a-f]{40}/…/g also matched the first 40 hex chars of unrelated @sha256: digests in the same YAML (e.g. task-runner), corrupting downstream update PRs.

Fixes the root cause of konflux-ci/build-definitions#3669 (seen in build-definitions PRs #3601 and #3668).

Test plan

  • Locally reproduce with a fixture that has a digest whose first 40 hex chars equal the old e2e tag SHA; confirm the new sed updates only the e2e image line.
  • After merge: next push to main that runs update-build-definitions-repo should open an “e2e-tests update” PR that changes only the konflux-e2e-tests: tag (digest of task-runner unchanged).
  • Same check for the build-tasks-dockerfiles update PR (integration-tests/tasks/e2e-test.yaml).

Made with Cursor

Scope the SHA replacement to konflux-e2e-tests image tags only so
unrelated @sha256 digests in the same file are left intact.

Co-authored-by: Cursor <cursoragent@cursor.com>
@openshift-ci

openshift-ci Bot commented Jul 24, 2026

Copy link
Copy Markdown

Hi @bacciotti. Thanks for your PR.

I'm waiting for a konflux-ci member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@qodo-app-for-konflux-ci

Copy link
Copy Markdown

PR Summary by Qodo

Scope e2e image tag rewrite to avoid corrupting unrelated SHA256 digests

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 10 minutes

Grey Divider

AI Description

• Restrict post-build SHA replacement to only konflux-e2e-tests: tags.
• Prevent accidental edits of unrelated @sha256: digests in the same YAML.
• Apply the same fix to both build-definitions and build-tasks-dockerfiles update scripts.
Diagram

graph TD
  A["Tekton push pipeline"] --> B["update scripts"] --> C["sed: scoped rewrite"] --> D[".tekton/tasks/e2e-test.yaml"] --> E["integration-tests/tasks/e2e-test.yaml"]

  subgraph Legend
    direction LR
    _cfg["YAML config"] ~~~ _op["Script step"]
  end
Loading
High-Level Assessment

The following are alternative approaches to this PR:

1. Use yq to update a specific YAML field
  • ➕ More robust than regex against formatting changes
  • ➕ Can target exact key paths, avoiding incidental matches
  • ➖ Adds tooling/complexity to the pipeline environment
  • ➖ Requires stable YAML structure and careful path selection
2. Capture-and-replace using sed groups (preserve prefix/suffix)
  • ➕ Even tighter control (e.g., only replace the SHA portion)
  • ➕ Keeps current dependency footprint (sed only)
  • ➖ Slightly more complex regex; easier to get wrong across sed variants

Recommendation: Keep the PR’s current approach: scoping the replacement to konflux-e2e-tests:[0-9a-f]{40} is the simplest change that directly addresses the corruption root cause while preserving the existing pipeline/tooling. Consider a yq-based update only if the YAML structure becomes more complex or if additional fields must be updated safely.

Files changed (1) +2 / -2

Bug fix (1) +2 / -2
konflux-e2e-tests-push.yamlConstrain sed replacement to konflux-e2e-tests image tags +2/-2

Constrain sed replacement to konflux-e2e-tests image tags

• Replaces a global 40-hex substitution with a pattern that matches only 'konflux-e2e-tests:<40-hex>' tags. This prevents rewriting unrelated SHA-like substrings (e.g., the first 40 hex chars inside '@sha256:' digests) in the target YAML files for both update scripts.

.tekton/konflux-e2e-tests-push.yaml

@qodo-app-for-konflux-ci

Copy link
Copy Markdown

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Grey Divider

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Grey Divider

Qodo Logo

@bacciotti bacciotti changed the title Fix e2e image update script corrupting task-runner digests fix: scope e2e image update sed to avoid corrupting digests Jul 27, 2026
@tisutisu

Copy link
Copy Markdown
Contributor

/ok-to-test

@openshift-ci

openshift-ci Bot commented Jul 28, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: tisutisu

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@konflux-ci-qe-bot

Copy link
Copy Markdown

Scenario: konflux-e2e
@bacciotti: The following test has Failed, say /retest to rerun failed tests.

PipelineRun Name Status Rerun command Build Log Test Log
konflux-e2e-7r8sj Failed /retest View Pipeline Log View Test Logs

Inspecting Test Artifacts

To inspect your test artifacts, follow these steps:

  1. Install ORAS (see the ORAS installation guide).
  2. Download artifacts with the following commands:
mkdir -p oras-artifacts
cd oras-artifacts
oras pull quay.io/konflux-test-storage/konflux-team/e2e-tests:konflux-e2e-7r8sj

Test results analysis

🚨 No JUnit file found, see the log from running tests:

Click to view logs
./mage -v ci:teste2e
Running target: CI:TestE2E
I0728 07:29:38.077042   11546 magefile.go:525] setting up new custom bundle for testing...
I0728 07:29:38.539284   11546 util.go:512] found credentials for image ref quay.io/redhat-appstudio-qe/test-images:pipeline-bundle-1785223778-ssob -> user: redhat-appstudio-qe+redhat_appstudio_quality
Creating Tekton Bundle:
	- Added Pipeline: docker-build to image
I0728 07:29:40.185675   11546 bundle.go:57] image digest for a new tekton bundle quay.io/redhat-appstudio-qe/test-images:pipeline-bundle-1785223778-ssob: quay.io/redhat-appstudio-qe/test-images@sha256:8cb636c90a89dd0fa53966ece00f5136298fcf538bc0d4a98534a1274be1fd3b
I0728 07:29:40.185694   11546 magefile.go:531] To use the custom docker bundle locally, run below cmd:

export CUSTOM_DOCKER_BUILD_PIPELINE_BUNDLE=quay.io/redhat-appstudio-qe/test-images:pipeline-bundle-1785223778-ssob

I0728 07:29:40.185715 11546 e2e_repo.go:347] checking if repository is e2e-tests
I0728 07:29:40.185718 11546 e2e_repo.go:335] multi-platform tests and require sprayproxy registering are set to TRUE
exec: git "diff" "--name-status" "upstream/main..HEAD"
I0728 07:29:40.188913 11546 util.go:451] The following files, .tekton/konflux-e2e-tests-push.yaml, were changed!
exec: go "install" "-mod=mod" "github.com/onsi/ginkgo/v2/ginkgo"
go: downloading github.com/go-task/slim-sprig/v3 v3.0.0
go: downloading github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83
I0728 07:29:43.633889 11546 install.go:226] cloning 'https://github.com/redhat-appstudio/infra-deployments' (ref: 'refs/heads/main', remote: 'upstream')
Enumerating objects: 88347, done.
Counting objects: 0% (1/231)
Counting objects: 1% (3/231)
Counting objects: 2% (5/231)
Counting objects: 3% (7/231)
Counting objects: 4% (10/231)
Counting objects: 5% (12/231)
Counting objects: 6% (14/231)
Counting objects: 7% (17/231)
Counting objects: 8% (19/231)
Counting objects: 9% (21/231)
Counting objects: 10% (24/231)
Counting objects: 11% (26/231)
Counting objects: 12% (28/231)
Counting objects: 13% (31/231)
Counting objects: 14% (33/231)
Counting objects: 15% (35/231)
Counting objects: 16% (37/231)
Counting objects: 17% (40/231)
Counting objects: 18% (42/231)
Counting objects: 19% (44/231)
Counting objects: 20% (47/231)
Counting objects: 21% (49/231)
Counting objects: 22% (51/231)
Counting objects: 23% (54/231)
Counting objects: 24% (56/231)
Counting objects: 25% (58/231)
Counting objects: 26% (61/231)
Counting objects: 27% (63/231)
Counting objects: 28% (65/231)
Counting objects: 29% (67/231)
Counting objects: 30% (70/231)
Counting objects: 31% (72/231)
Counting objects: 32% (74/231)
Counting objects: 33% (77/231)
Counting objects: 34% (79/231)
Counting objects: 35% (81/231)
Counting objects: 36% (84/231)
Counting objects: 37% (86/231)
Counting objects: 38% (88/231)
Counting objects: 39% (91/231)
Counting objects: 40% (93/231)
Counting objects: 41% (95/231)
Counting objects: 42% (98/231)
Counting objects: 43% (100/231)
Counting objects: 44% (102/231)
Counting objects: 45% (104/231)
Counting objects: 46% (107/231)
Counting objects: 47% (109/231)
Counting objects: 48% (111/231)
Counting objects: 49% (114/231)
Counting objects: 50% (116/231)
Counting objects: 51% (118/231)
Counting objects: 52% (121/231)
Counting objects: 53% (123/231)
Counting objects: 54% (125/231)
Counting objects: 55% (128/231)
Counting objects: 56% (130/231)
Counting objects: 57% (132/231)
Counting objects: 58% (134/231)
Counting objects: 59% (137/231)
Counting objects: 60% (139/231)
Counting objects: 61% (141/231)
Counting objects: 62% (144/231)
Counting objects: 63% (146/231)
Counting objects: 64% (148/231)
Counting objects: 65% (151/231)
Counting objects: 66% (153/231)
Counting objects: 67% (155/231)
Counting objects: 68% (158/231)
Counting objects: 69% (160/231)
Counting objects: 70% (162/231)
Counting objects: 71% (165/231)
Counting objects: 72% (167/231)
Counting objects: 73% (169/231)
Counting objects: 74% (171/231)
Counting objects: 75% (174/231)
Counting objects: 76% (176/231)
Counting objects: 77% (178/231)
Counting objects: 78% (181/231)
Counting objects: 79% (183/231)
Counting objects: 80% (185/231)
Counting objects: 81% (188/231)
Counting objects: 82% (190/231)
Counting objects: 83% (192/231)
Counting objects: 84% (195/231)
Counting objects: 85% (197/231)
Counting objects: 86% (199/231)
Counting objects: 87% (201/231)
Counting objects: 88% (204/231)
Counting objects: 89% (206/231)
Counting objects: 90% (208/231)
Counting objects: 91% (211/231)
Counting objects: 92% (213/231)
Counting objects: 93% (215/231)
Counting objects: 94% (218/231)
Counting objects: 95% (220/231)
Counting objects: 96% (222/231)
Counting objects: 97% (225/231)
Counting objects: 98% (227/231)
Counting objects: 99% (229/231)
Counting objects: 100% (231/231)
Counting objects: 100% (231/231), done.
Compressing objects: 1% (1/76)
Compressing objects: 2% (2/76)
Compressing objects: 3% (3/76)
Compressing objects: 5% (4/76)
Compressing objects: 6% (5/76)
Compressing objects: 7% (6/76)
Compressing objects: 9% (7/76)
Compressing objects: 10% (8/76)
Compressing objects: 11% (9/76)
Compressing objects: 13% (10/76)
Compressing objects: 14% (11/76)
Compressing objects: 15% (12/76)
Compressing objects: 17% (13/76)
Compressing objects: 18% (14/76)
Compressing objects: 19% (15/76)
Compressing objects: 21% (16/76)
Compressing objects: 22% (17/76)
Compressing objects: 23% (18/76)
Compressing objects: 25% (19/76)
Compressing objects: 26% (20/76)
Compressing objects: 27% (21/76)
Compressing objects: 28% (22/76)
Compressing objects: 30% (23/76)
Compressing objects: 31% (24/76)
Compressing objects: 32% (25/76)
Compressing objects: 34% (26/76)
Compressing objects: 35% (27/76)
Compressing objects: 36% (28/76)
Compressing objects: 38% (29/76)
Compressing objects: 39% (30/76)
Compressing objects: 40% (31/76)
Compressing objects: 42% (32/76)
Compressing objects: 43% (33/76)
Compressing objects: 44% (34/76)
Compressing objects: 46% (35/76)
Compressing objects: 47% (36/76)
Compressing objects: 48% (37/76)
Compressing objects: 50% (38/76)
Compressing objects: 51% (39/76)
Compressing objects: 52% (40/76)
Compressing objects: 53% (41/76)
Compressing objects: 55% (42/76)
Compressing objects: 56% (43/76)
Compressing objects: 57% (44/76)
Compressing objects: 59% (45/76)
Compressing objects: 60% (46/76)
Compressing objects: 61% (47/76)
Compressing objects: 63% (48/76)
Compressing objects: 64% (49/76)
Compressing objects: 65% (50/76)
Compressing objects: 67% (51/76)
Compressing objects: 68% (52/76)
Compressing objects: 69% (53/76)
Compressing objects: 71% (54/76)
Compressing objects: 72% (55/76)
Compressing objects: 73% (56/76)
Compressing objects: 75% (57/76)
Compressing objects: 76% (58/76)
Compressing objects: 77% (59/76)
Compressing objects: 78% (60/76)
Compressing objects: 80% (61/76)
Compressing objects: 81% (62/76)
Compressing objects: 82% (63/76)
Compressing objects: 84% (64/76)
Compressing objects: 85% (65/76)
Compressing objects: 86% (66/76)
Compressing objects: 88% (67/76)
Compressing objects: 89% (68/76)
Compressing objects: 90% (69/76)
Compressing objects: 92% (70/76)
Compressing objects: 93% (71/76)
Compressing objects: 94% (72/76)
Compressing objects: 96% (73/76)
Compressing objects: 97% (74/76)
Compressing objects: 98% (75/76)
Compressing objects: 100% (76/76)
Compressing objects: 100% (76/76), done.
Total 88347 (delta 174), reused 160 (delta 155), pack-reused 88116 (from 2)
From https://github.com/redhat-appstudio/infra-deployments

  • branch main -> FETCH_HEAD
    Already up to date.

=============================================================================
[2026-07-28 07:29:48] [STEP] Starting Konflux Cluster Bootstrap

[2026-07-28 07:29:48] [INFO] Mode: preview
[2026-07-28 07:29:48] [INFO] Options: OBO=disabled, EAAS=disabled, OPERATOR_OVERLAY=disabled
[2026-07-28 07:29:48] [INFO] Start time: 2026-07-28 07:29:48 UTC

=============================================================================
[2026-07-28 07:29:48] [STEP] Phase 1: Deploying ArgoCD

=============================================================================
[2026-07-28 07:29:48] [STEP] Deploying OpenShift GitOps (ArgoCD)

[2026-07-28 07:29:48] [SUBSTEP] Verifying cluster-admin permissions
[2026-07-28 07:29:49] [SUCCESS] User 'cluster-admin' has cluster-admin permissions
[2026-07-28 07:29:49] [SUBSTEP] Installing OpenShift GitOps operator subscription
clusterrole.rbac.authorization.k8s.io/appstudio-openshift-gitops-argocd-application-controller created
clusterrole.rbac.authorization.k8s.io/appstudio-openshift-gitops-argocd-server created
clusterrolebinding.rbac.authorization.k8s.io/appstudio-openshift-gitops-argocd-application-controller created
clusterrolebinding.rbac.authorization.k8s.io/appstudio-openshift-gitops-argocd-server created
subscription.operators.coreos.com/openshift-gitops-operator created
[2026-07-28 07:29:49] [SUCCESS] GitOps operator subscription applied
[2026-07-28 07:29:49] [SUBSTEP] Waiting for default ArgoCD project to be created
[2026-07-28 07:29:49] [WAITING] Default project not yet available (5s/300s)
[2026-07-28 07:29:54] [WAITING] Default project not yet available (10s/300s)
[2026-07-28 07:29:59] [WAITING] Default project not yet available (15s/300s)
[2026-07-28 07:30:05] [WAITING] Default project not yet available (20s/300s)
[2026-07-28 07:30:10] [WAITING] Default project not yet available (25s/300s)
[2026-07-28 07:30:15] [WAITING] Default project not yet available (30s/300s)
[2026-07-28 07:30:20] [WAITING] Default pr... the content is too long - please download the artifact to see the full content


OCI Artifact Browser URL

View in Artifact Browser

@bacciotti

Copy link
Copy Markdown
Author

/retest

@tisutisu

tisutisu commented Jul 31, 2026

Copy link
Copy Markdown
Contributor

we are configuring renovate to update the image now, we may remove updating reference from this pipeline now.

@openshift-ci

openshift-ci Bot commented Aug 5, 2026

Copy link
Copy Markdown

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants