refactor(RELEASE-1990): convert pulp-push-disk-images to python

This commit replaces the inline bash script for the
pulp-push-disk-images internal task with a standalone python
script in the utils image. Tekton tests use declarative mocks
via mocks.yaml and tests/mocks/.

Assisted-By: Cursor

Signed-off-by: Happy Bhati <hbhati@redhat.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

Author: happybhati

tasks/internal/pulp-push-disk-images/pulp-push-disk-images.yaml

@@ -107,237 +107,16 @@ spec:
       securityContext:
         runAsUser: 1001
       env:
-        - name: "SNAPSHOT_JSON"
-          value: "$(params.snapshot_json)"
-      script: |
-        #!/usr/bin/env bash
-        set -e
-
-        # Check certificate expiration for all certificates used in this step
-        echo "=== Checking certificate expiration ==="
-
-        # Check Exodus Gateway certificate
-        echo "Checking Exodus Gateway certificate"
-        if ! check_cert_expiration "/mnt/exodusGwSecret/cert" "$(params.certExpirationWarnDays)"; then
-          echo "ERROR: Exodus Gateway certificate validation failed"
-          exit 1
-        fi
-
-        # Check Pulp certificate
-        echo "Checking Pulp certificate"
-        if ! check_cert_expiration "/mnt/pulpSecret/konflux-release-rhsm-pulp.crt" \
-            "$(params.certExpirationWarnDays)"; then
-          echo "ERROR: Pulp certificate validation failed"
-          exit 1
-        fi
-
-        # Check UDCache certificate
-        echo "Checking UDCache certificate"
-        if ! check_cert_expiration "/mnt/udcacheSecret/cert" "$(params.certExpirationWarnDays)"; then
-          echo "ERROR: UDCache certificate validation failed"
-          exit 1
-        fi
-
-        echo "=== All certificates are valid ==="
-
-        EXODUS_CERT="$(cat /mnt/exodusGwSecret/cert)"
-        EXODUS_KEY="$(cat /mnt/exodusGwSecret/key)"
-        EXODUS_URL="$(cat /mnt/exodusGwSecret/url)"
-        PULP_URL="$(cat /mnt/pulpSecret/pulp_url)"
-        PULP_CERT="$(cat /mnt/pulpSecret/konflux-release-rhsm-pulp.crt)"
-        PULP_KEY="$(cat /mnt/pulpSecret/konflux-release-rhsm-pulp.key)"
-        UDC_URL="$(cat /mnt/udcacheSecret/url)"
-        UDC_CERT="$(cat /mnt/udcacheSecret/cert)"
-        UDC_KEY="$(cat /mnt/udcacheSecret/key)"
-        DOCKER_CONFIG_JSON="$(cat /mnt/redhat-workloads-token/.dockerconfigjson)"
-
-        CGW_USERNAME="$(cat "/mnt/cgwSecret/username")"
-        CGW_PASSWORD="$(cat "/mnt/cgwSecret/token")"
-
-        # export the variables used by the scripts in release-service-utils
-        export CGW_USERNAME CGW_PASSWORD
-
-        set -x
-
-        STDERR_FILE=/tmp/stderr.txt
-
-        exitfunc() {
-            local err=$1
-            local line=$2
-            local command="$3"
-            if [ "$err" -eq 0 ] ; then
-                echo -n "Success" > "$(results.result.path)"
-            else
-                echo "$0: ERROR '$command' failed at line $line - exited with status $err" \
-                  > "$(results.result.path)"
-                if [ -f "$STDERR_FILE" ] ; then
-                    tail -n 20 "$STDERR_FILE" >> "$(results.result.path)"
-                fi
-            fi
-            exit 0 # exit the script cleanly as there is no point in proceeding past an error or exit call
-        }
-        # due to set -e, this catches all EXIT and ERR calls and the task should never fail with nonzero exit code
-        trap 'exitfunc $? $LINENO "$BASH_COMMAND"' EXIT
-
-        # Setup required variables
-        export EXODUS_GW_CERT=/tmp/exodus.crt
-        export EXODUS_GW_KEY=/tmp/exodus.key
-        export PULP_CERT_FILE=/tmp/pulp.crt
-        export PULP_KEY_FILE=/tmp/pulp.key
-        export UDCACHE_CERT=/tmp/udc.crt
-        export UDCACHE_KEY=/tmp/udc.key
-        EXODUS_GW_ENV=$(params.exodusGwEnv)
-        export EXODUS_GW_ENV
-        export EXODUS_GW_URL="$EXODUS_URL"
-        export EXODUS_PULP_HOOK_ENABLED=True
-        export EXODUS_GW_TIMEOUT=7200
-        mkdir -p ~/.docker
-
-        set +x
-        echo "$EXODUS_CERT" > "$EXODUS_GW_CERT"
-        echo "$EXODUS_KEY" > "$EXODUS_GW_KEY"
-        echo "$PULP_CERT" > "$PULP_CERT_FILE"
-        echo "$PULP_KEY" > "$PULP_KEY_FILE"
-        echo "$UDC_CERT" > "$UDCACHE_CERT"
-        echo "$UDC_KEY" > "$UDCACHE_KEY"
-        # Quotes are added to the secret so it applies in k8s nicely. But now we have to remove them
-        echo "$DOCKER_CONFIG_JSON" | sed -r 's/(^|\})[^{}]+(\{|$)/\1\2/g' > ~/.docker/config.json
-        set -x
-
-        DISK_IMAGE_DIR="$(mktemp -d)"
-        export DISK_IMAGE_DIR
-
-        process_component() { # Expected argument is [component json]
-            COMPONENT=$1
-            PULLSPEC=$(jq -er '.containerImage' <<< "${COMPONENT}")
-            DESTINATION="${DISK_IMAGE_DIR}/$(jq -er '.staged.destination' <<< "${COMPONENT}")/FILES" \
-              || (echo "Missing staged.destination value for component. This should be an existing pulp repo. \
-                  Failing" && exit 1)
-            mkdir -p "${DESTINATION}"
-            DOWNLOAD_DIR=$(mktemp -d)
-            cd "$DOWNLOAD_DIR"
-            # oras has very limited support for selecting the right auth entry,
-            # so create a custom auth file with just one entry
-            AUTH_FILE=$(mktemp)
-            select-oci-auth "${PULLSPEC}" > "$AUTH_FILE"
-            oras pull --registry-config "$AUTH_FILE" "$PULLSPEC"
-            NUM_MAPPED_FILES=$(jq '.staged.files | length' <<< "${COMPONENT}")
-            for ((i = 0; i < NUM_MAPPED_FILES; i++)) ; do
-                FILE=$(jq -c --arg i "$i" '.staged.files[$i|tonumber]' <<< "$COMPONENT")
-                SOURCE=$(jq -er '.source' <<< "$FILE")
-                FILENAME=$(jq -er '.filename' <<< "$FILE")
-                # The .qcow2 images are not zipped
-                if [ -f "${SOURCE}.gz" ] ; then
-                    gzip -d "${SOURCE}.gz"
-                fi
-                DESTINATION_FILE="${DESTINATION}/${FILENAME}"
-                # Albeit a rare one, this is a race condition since this is run in parallel.
-                # The race condition is if two files have the same $DESTINATION_FILE and both
-                # if checks are run before either mv is run a few lines below.
-                if [ -f "${DESTINATION_FILE}" ] ; then
-                    echo -n "Multiple files use the same destination value: $DESTINATION" >&2
-                    echo " and filename value: $FILENAME. Failing..." >&2
-                    exit 1
-                fi
-                mv "$SOURCE" "${DESTINATION_FILE}" || echo "didn't find mapped file: ${SOURCE}"
-            done
-
-        }
-
-        process_component_for_developer_portal() { # Expected argument are [component json], [content_directory]
-          COMPONENT=$1
-
-          productName="$(jq -er '.contentGateway.productName' <<< "${COMPONENT}")" \
-            || (echo "Missing contentGateway.productName value for component. This should be an existing product \
-                  in the Developer Portal. Failing" && exit 1)
-
-          productCode="$(jq -er '.contentGateway.productCode' <<< "${COMPONENT}")" \
-            || (echo "Missing contentGateway.productCode value for component. This should be an existing product \
-                  in the Developer Portal. Failing" && exit 1)
-
-          productVersionName="$(jq -er '.contentGateway.productVersionName' <<< "${COMPONENT}")" \
-            || (echo "Missing contentGateway.productVersionName value for component. This should be an existing \
-                  product in the Developer Portal. Failing" && exit 1)
-
-          filePrefix="$(jq -er '.contentGateway.filePrefix' <<< "${COMPONENT}")" \
-            || (echo "Missing contentGateway.filePrefix value for component. This should be the prefix for files to \
-                  upload to the Developer Portal. Failing" && exit 1)
-
-          # Set proxy for preprod CGW environment (requires squid proxy for access)
-          if [[ "$(params.cgwHostname)" == *"developers.qa.redhat.com"* ]]; then
-            export HTTP_PROXY="http://squid.corp.redhat.com:3128"
-            export HTTPS_PROXY="http://squid.corp.redhat.com:3128"
-            echo "Using squid proxy for preprod CGW access"
-          fi
-
-          developer_portal_wrapper --debug --product-name "${productName}" \
-            --product-code "${productCode}" \
-            --product-version-name "${productVersionName}" \
-            --cgw-hostname "$(params.cgwHostname)" \
-            --content-directory "$2" \
-            --file-prefix "${filePrefix}"
-
-        }
-
-        RUNNING_JOBS="\j" # Bash parameter for number of jobs currently running
-        NUM_COMPONENTS=$(jq '.components | length' <<< "$SNAPSHOT_JSON")
-
-        # use the 1st component's version
-        VERSION=$(jq -cr '.components[0].staged.version // ""' <<< "$SNAPSHOT_JSON")
-        if [ "${VERSION}" == "" ] ; then
-          echo "Error: version not specified in .components[0].staged.version. Needed to publish to customer portal"
-          exit 1
-        fi
-
-        # Process each component in parallel
-        for ((i = 0; i < NUM_COMPONENTS; i++)) ; do
-            COMPONENT=$(jq -c --arg i "$i" '.components[$i|tonumber]' <<< "$SNAPSHOT_JSON")
-            # Limit batch size to concurrent limit
-            while (( ${RUNNING_JOBS@P} >= $(params.concurrentLimit) )); do
-                wait -n
-            done
-            process_component "$COMPONENT" 2> "$STDERR_FILE" &
-        done
-
-        # Wait for remaining processes to finish
-        while (( ${RUNNING_JOBS@P} > 0 )); do
-            wait -n
-        done
-
-        # Change to the subdir with the images
-        cd "${DISK_IMAGE_DIR}"
-
-        STAGED_JSON='{"header":{"version": "0.2"},"payload":{"files":[]}}'
-
-        # Add the files to the payload
-        # shell check wants us to find ./* but that adds `./` to the paths which breaks the script
-        # shellcheck disable=SC2035
-        while IFS= read -r -d '' file ; do
-            STAGED_JSON=$(jq --arg filename "$(basename "$file")" --arg path "$file" \
-              --arg version "$VERSION" \
-              '.payload.files[.payload.files | length] =
-              {"filename": $filename, "relative_path": $path, "version": $version}' <<< "$STAGED_JSON")
-        done < <(find * -type f -print0)
-
-        echo "$STAGED_JSON" | yq -P -I 4 > staged.yaml
-
-        pulp_push_wrapper --debug --source "${DISK_IMAGE_DIR}" --pulp-url "$PULP_URL" \
-          --pulp-cert $PULP_CERT_FILE --pulp-key $PULP_KEY_FILE --udcache-url "$UDC_URL" \
-          2> >(tee -a "$STDERR_FILE" >&2)
-
-        relative_paths=$(echo "$STAGED_JSON" | jq -erc .payload.files[].relative_path)
-        component_destinations=()
-        for path in $relative_paths:
-        do
-          parent_dir=$(dirname "$path")
-          component_destinations+=("${DISK_IMAGE_DIR}/$parent_dir")
-        done
-
-        ## Process Files for Developer Portal / CGW
-        ##
-        NUM_COMPONENTS=$(jq '.components | length' <<< "$SNAPSHOT_JSON")
-        for ((i = 0; i < NUM_COMPONENTS; i++)) ; do
-            COMPONENT=$(jq -c --arg i "$i" '.components[$i|tonumber]' <<< "$SNAPSHOT_JSON")
-            process_component_for_developer_portal "$COMPONENT" "${component_destinations[$i]}" \
-              2> >(tee -a "$STDERR_FILE" >&2)
-        done
+        - name: SNAPSHOT_JSON
+          value: $(params.snapshot_json)
+        - name: CERT_EXPIRATION_WARN_DAYS
+          value: $(params.certExpirationWarnDays)
+        - name: CONCURRENT_LIMIT
+          value: $(params.concurrentLimit)
+        - name: EXODUS_GW_ENV
+          value: $(params.exodusGwEnv)
+        - name: CGW_HOSTNAME
+          value: $(params.cgwHostname)
+        - name: RESULT_RESULT
+          value: $(results.result.path)
+      command: ["/home/scripts/python/tasks/internal/pulp_push_disk_images.py"]

tasks/internal/pulp-push-disk-images/tests/mocks.yaml

@@ -0,0 +1,5 @@
+---
+# Declarative mocks for Tekton tests of this task (Python entrypoint). Rendered
+# by .github/scripts/render_python_task_mocks_from_yaml.py when
+# test_tekton_tasks.sh runs.
+version: 1

tasks/internal/pulp-push-disk-images/tests/mocks/check_cert_expiration

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+echo "Mock check_cert_expiration called with: $*"
+echo "Certificate $2 is valid (mocked)"
+exit 0

tasks/internal/pulp-push-disk-images/tests/mocks/developer_portal_wrapper

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+echo Mock developer_portal_wrapper called with: "$@"
+
+/home/developer-portal-wrapper/developer_portal_wrapper "$@" --dry-run
+
+if ! [[ "$?" -eq 0 ]]; then
+  echo Unexpected call to developer_portal_wrapper
+  exit 1
+fi

tasks/internal/pulp-push-disk-images/tests/mocks/gzip

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+file="${@: -1}"
+if [[ "$file" == *"fail_gzip.raw.gz" ]]; then
+  echo gzip failed
+  exit 1
+fi
+mv "$file" "${file%.gz}"

tasks/internal/pulp-push-disk-images/tests/mocks/oras

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+echo Mock oras called with: "$@"
+
+if [[ "$*" != "pull --registry-config"* ]]; then
+  echo Error: Unexpected call to oras
+  exit 1
+fi
+
+if [[ "$*" == *"nonexistent-disk-image"* ]]; then
+  echo Simulating failing oras pull call
+  exit 1
+fi
+
+touch disk.qcow2
+touch disk.raw.gz
+touch fail_gzip.raw.gz

tasks/internal/pulp-push-disk-images/tests/mocks/pulp_push_wrapper

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+echo Mock pulp_push_wrapper called with: "$@"
+
+if [[ "$*" != *"--pulp-url https://pulp.com"* ]]; then
+  printf "Mocked failure of pulp_push_wrapper" > /nonexistent/location
+fi

tasks/internal/pulp-push-disk-images/tests/mocks/select-oci-auth

@@ -0,0 +1,2 @@
+#!/usr/bin/env bash
+echo Mock select-oci-auth called with: "$@"

tasks/internal/pulp-push-disk-images/tests/mocks/yq

@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+# Mock yq: pass JSON stdin through as YAML-like output for tests.
+cat

tasks/internal/pulp-push-disk-images/tests/pre-apply-task-hook.sh

@@ -1,11 +1,5 @@
 #!/usr/bin/env bash
 
-TASK_PATH="$1"
-SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
-
-# Add mocks to the beginning of task step script
-yq -i '.spec.steps[0].script = load_str("'$SCRIPT_DIR'/mocks.sh") + .spec.steps[0].script' "$TASK_PATH"
-
 # Create a dummy exodus secret (and delete it first if it exists)
 kubectl delete secret pulp-task-exodus-secret --ignore-not-found
 kubectl create secret generic pulp-task-exodus-secret --from-literal=cert=myexoduscert --from-literal=key=myexoduskey --from-literal=url=https://exodus.com