feat(RELEASE-1993): convert update-fbc-catalog-task to Python entrypoint

Replace the two inline bash steps with a call to the
standalone Python script in the release-service-utils
image. Tekton test mocks are converted to the declarative
mocks.yaml pattern compatible with the Python entrypoint,
and scenario-specific tests now covered by pytest in the
utils repo are removed.

Fix TASK_ENTRYPOINT quoting in test_tekton_tasks.sh: args
with Tekton placeholders were wrapped in double quotes,
which breaks when the substituted value has embedded
double quotes (e.g. JSON arrays). Switched to single
quotes so the value is preserved literally after Tekton
substitution.

Signed-off-by: Filip Nikolovski <fnikolov@redhat.com>

Author: FilipNikolovski

.github/scripts/mock_http_json.py

@@ -41,26 +41,28 @@ def log_message(self, *_args: object) -> None:
         # Keep Tekton step logs readable; every GET would otherwise print a line.
         return
 
-    def do_GET(self) -> None:
+    def _route_body(self) -> bytes | None:
         parsed = urlparse(self.path)
         path = parsed.path.rstrip("/") or "/"
-        body = None
         # Order in mocks.yaml matters: first matching rule wins (not most specific).
         for rule in self.routes:
             suf = rule.get("path_suffix")
             if suf is not None:
                 # Match both "/auth/token" and "/auth/token/" style paths.
-                if path.endswith(suf) or path.endswith(suf.rstrip("/")):
+                suf_stripped = suf.rstrip("/")
+                if path.endswith(suf) or (suf_stripped and path.endswith(suf_stripped)):
                     # mocks.yaml body values are strings, not pre-serialized bytes.
-                    body = rule["body"].encode("utf-8")
-                    break
+                    return rule["body"].encode("utf-8")
                 # path_suffix and path_contains are mutually exclusive per rule.
                 continue
             sub = rule.get("path_contains")
             if sub is not None and sub in parsed.path:
                 # Query string is ignored; only the path is checked.
-                body = rule["body"].encode("utf-8")
-                break
+                return rule["body"].encode("utf-8")
+        return None
+
+    def _send_routed_json(self) -> None:
+        body = self._route_body()
         if body is None:
             # Unmatched paths look like "service down" to callers, not empty JSON.
             self.send_response(404)
@@ -72,6 +74,8 @@ def do_GET(self) -> None:
         self.end_headers()
         self.wfile.write(body)
 
+    do_GET = do_POST = _send_routed_json
+
 
 class _ReuseHTTPServer(HTTPServer):
     # Lets the test step restart the mock without "Address already in use".

.github/scripts/test_tekton_tasks.sh

@@ -62,10 +62,13 @@ apply_python_command_mocks_merge() {
       echo '#!/usr/bin/env bash'
       echo "TASK_ENTRYPOINT=("
       for w in "${entrypoint_argv[@]}"; do
-        # Do not use printf %q for Tekton placeholders: single-quoted %q output
-        # prevents Tekton from rewriting $(params.*) inside spec.steps[].script.
+        # Tekton placeholders must stay unescaped so Tekton can substitute them
+        # (printf %q would escape the '$').  Use single quotes so that JSON
+        # values with embedded double quotes survive bash array construction.
+        # Tekton does raw text replacement on the whole script string before
+        # bash sees it, so single quotes do not prevent substitution.
         if [[ "$w" == *'$('* ]]; then
-          printf '  "%s"\n' "$w"
+          printf "  '%s'\n" "$w"
         else
           printf '  %q\n' "$w"
         fi

tasks/internal/update-fbc-catalog-task/tests/mocks.sh

@@ -0,0 +1,38 @@
+---
+# Declarative mocks for Tekton tests of this task (Python entrypoint). Rendered
+# by .github/scripts/render_python_task_mocks_from_yaml.py when
+# test_tekton_tasks.sh runs.
+version: 1
+services:
+  - type: http_json
+    bind: 127.0.0.1
+    routes:
+      - path_suffix: /fbc-operations
+        body: >-
+          {"id":1,"state":"in_progress","state_reason":"The request was initiated",
+          "from_index":"quay.io/scoheb/fbc-index-testing:latest",
+          "index_image":"quay.io/scoheb/fbc-index-testing:latest",
+          "fbc_fragments":["registry.io/image0@sha256:0000"],
+          "distribution_scope":"stage",
+          "logs":{"url":"http://127.0.0.1:8080/api/v1/builds/1/logs"}}
+      - path_contains: /builds/1/logs
+        body: "Mock IIB build log"
+      - path_suffix: /builds/1
+        body: >-
+          {"id":1,"state":"complete",
+          "state_reason":"The FBC fragment was successfully added in the index image",
+          "from_index":"quay.io/scoheb/fbc-index-testing:latest",
+          "index_image":"quay.io/scoheb/fbc-index-testing:latest",
+          "index_image_resolved":"registry-proxy-stage.engineering.redhat.com/rh-osbs-stage/iib@sha256:0000",
+          "internal_index_image_copy":"registry-proxy-stage.engineering.redhat.com/rh-osbs-stage/iib:1",
+          "fbc_fragments":["registry.io/image0@sha256:0000"],
+          "build_tags":[],"distribution_scope":"stage",
+          "updated":"2025-01-01T00:00:00+00:00","created":"2025-01-01T00:00:00+00:00",
+          "logs":{"url":"http://127.0.0.1:8080/api/v1/builds/1/logs"},
+          "request_type":"fbc-operations"}
+      - path_suffix: /builds
+        body: '{"items":[]}'
+    rewrite_secret_mount:
+      source: /mnt/iib-services-config
+      env_var: IIB_SERVICES_CONFIG_MOUNT
+      url_file: url

tasks/internal/update-fbc-catalog-task/tests/mocks.yaml

@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+# Tekton test mock: subprocess kinit in the task image succeeds without Kerberos.
+exit 0

tasks/internal/update-fbc-catalog-task/tests/mocks/kinit

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# Tekton test mock: wrap python3 to inject a stub requests_kerberos module.
+# The real requests_kerberos needs a live Kerberos credential cache that
+# does not exist in test pods (kinit is mocked). This stub provides the
+# HTTPKerberosAuth class as a no-op auth handler so requests.Session.post()
+# proceeds without Negotiate headers.
+set -eu
+
+MOCK_PYPATH="$(mktemp -d)"
+cat > "${MOCK_PYPATH}/requests_kerberos.py" << 'PYEOF'
+OPTIONAL = 1
+REQUIRED = 2
+DISABLED = 3
+
+class HTTPKerberosAuth:
+    def __init__(self, **kwargs):
+        pass
+    def __call__(self, r):
+        return r
+PYEOF
+
+export PYTHONPATH="${MOCK_PYPATH}:${PYTHONPATH:-}"
+exec /usr/bin/python3 "$@"

tasks/internal/update-fbc-catalog-task/tests/mocks/python3

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# Tekton test mock for skopeo inspect (called by helpers/skopeo.py via subprocess).
+set -eu
+
+for arg in "$@"; do
+  case "${arg}" in
+    --config) CONFIG=true ;;
+    --raw)    RAW=true ;;
+  esac
+done
+
+if [[ "${RAW:-}" == "true" ]]; then
+  cat <<'EOF'
+{"manifests":[
+{"mediaType":"application/vnd.docker.distribution.manifest.v2+json","digest":"sha256:000"},
+{"mediaType":"application/vnd.docker.distribution.manifest.v2+json","digest":"sha256:001"}
+]}
+EOF
+  exit 0
+fi
+
+if [[ "${CONFIG:-}" == "true" ]]; then
+  echo "{\"created\":\"$(date --iso-8601=seconds)\"}"
+  exit 0
+fi
+
+echo "mock skopeo: unhandled args: $*" >&2
+exit 1

tasks/internal/update-fbc-catalog-task/tests/mocks/skopeo

@@ -9,17 +9,11 @@ kubectl apply -f .github/resources/crd_rbac.yaml
 # create required secrets
 kubectl create secret generic iib-service-account-secret \
     --from-literal=principal="iib@kerberos" \
-    --from-literal=keytab="something"
+    --from-literal=keytab="c29tZXRoaW5n"
 kubectl create secret generic iib-services-config \
     --from-literal=krb5.conf="" \
     --from-literal=url="https://fakeiib.host"
 
 kubectl create secret generic iib-overwrite-fromimage-credentials \
     --from-literal=username="bot+user" \
     --from-literal=token="token"
-
-# Add mocks to the beginning of task step script
-TASK_PATH="$1"
-SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
-yq -i '.spec.steps[0].script = load_str("'$SCRIPT_DIR'/mocks.sh") + .spec.steps[0].script' "$TASK_PATH"
-yq -i '.spec.steps[1].script = load_str("'$SCRIPT_DIR'/mocks.sh") + .spec.steps[1].script' "$TASK_PATH"