feat(RELEASE-1989): python for publish-index-images tasks

tasks/internal/publish-index-image and
tasks/managed/publish-index-image

internal bash scripts are replaced with python scripts
from release-service-utils

Author: midnightercz

tasks/internal/publish-index-image-task/publish-index-image-task.yaml

@@ -64,7 +64,7 @@ spec:
       securityContext:
         runAsUser: 1001
       image: >-
-        quay.io/konflux-ci/release-service-utils@sha256:5546fa78d3c88d7b6a2e8cff8902f7757f00541d0bbaf113b9f293133894afa3
+        quay.io/jluza/release-service-utils:RELEASE-1989
       computeResources:
         limits:
           memory: 64Mi
@@ -73,53 +73,13 @@ spec:
           cpu: 400m
       script: |
         #!/usr/bin/env bash
-        set -euo pipefail
-
         SOURCE_INDEX_CREDENTIAL="$(cat /mnt/publishingCredentials/sourceIndexCredential)"
         TARGET_INDEX_CREDENTIAL="$(cat /mnt/publishingCredentials/targetIndexCredential)"
 
-        PATH=/bin:/usr/bin:/usr/local/bin
-        export PATH
-
-        SOURCE_AUTH_ARGS=()
-        if [[ ! "$(params.sourceIndex)" =~ ^registry-proxy(\-stage)?.engineering.redhat.com ]]; then
-            SOURCE_AUTH_ARGS=("--src-creds" "${SOURCE_INDEX_CREDENTIAL}")
-        fi
-
-        TARGET_AUTH_ARGS=("--dest-creds" "${TARGET_INDEX_CREDENTIAL}")
-
-        # Extract digest from pull spec
-        SOURCE_INDEX="$(params.sourceIndex)"
-        SOURCE_DIGEST="${SOURCE_INDEX##*@}"
-
-        echo "Getting target image digest: $(params.targetIndex)"
-        if TARGET_DIGEST=$(skopeo inspect \
-            "docker://$(params.targetIndex)" \
-            --format '{{.Digest}}' \
-            --retry-times "$(params.retries)"); then
-            echo "Target image exists."
-            echo "DEBUG: Source Digest - $SOURCE_DIGEST"
-            echo "DEBUG: Target Digest - $TARGET_DIGEST"
-            if [ "$SOURCE_DIGEST" == "$TARGET_DIGEST" ]; then
-                echo "Image already exists with the same digest, skipping copy." | tee "$(results.requestMessage.path)"
-                exit 0
-            else
-                echo "Image exists in target registry but digests do not match." \
-                    "Proceeding to copy the image."
-            fi
-        else
-            echo "Target image does not exist. Proceeding to copy the image."
-        fi
-
-        # Proceed with copying the image
-        echo "Copying image from $(params.sourceIndex) to $(params.targetIndex)"
-        (skopeo copy \
-        --all \
-        --preserve-digests \
-        --retry-times "$(params.retries)" \
-        --src-tls-verify=false "${SOURCE_AUTH_ARGS[@]}" \
-        "docker://$(params.sourceIndex)" \
-        "${TARGET_AUTH_ARGS[@]}" \
-        "docker://$(params.targetIndex)" && \
-        echo -n "Index Image Published successfully" || \
-        echo -n "Error: Failed publishing Index Image" ) | tee "$(results.requestMessage.path)"
+        set -euo pipefail
+        python3 -m publish_index_image \
+          --source-index "$(params.sourceIndex)" \
+          --target-index "$(params.targetIndex)" \
+          --retries "$(params.retries)" \
+          --source-credential-path /mnt/publishingCredentials/sourceIndexCredential \
+          --target-credential-path /mnt/publishingCredentials/targetIndexCredential

tasks/managed/publish-index-image/publish-index-image.yaml

@@ -125,7 +125,7 @@ spec:
           value: $(params.sourceDataArtifact)
     - name: publish-index-image
       image: >-
-        quay.io/konflux-ci/release-service-utils@sha256:5546fa78d3c88d7b6a2e8cff8902f7757f00541d0bbaf113b9f293133894afa3
+        quay.io/jluza/release-service-utils:RELEASE-1989
       computeResources:
         limits:
           memory: 512Mi
@@ -142,71 +142,15 @@ spec:
             exit 1
         fi
 
-        request="publish-index-image-pipeline"
         credentials=$(jq -r '.fbc.publishingCredentials' "$DATA_FILE")
-        pipelinerun_label="internal-services.appstudio.openshift.io/pipelinerun-uid"
 
-        LENGTH="$(jq -r '.components | length' "$(params.dataDir)/$(params.internalRequestResultsFile)")"
-        for((i=0; i<LENGTH; i++)); do
-          targetIndex=$(jq -r --argjson i "$i" \
-            '.components[$i].target_index' "$(params.dataDir)/$(params.internalRequestResultsFile)")
-
-          sourceIndex=$(jq -r  --argjson i "$i" \
-            '.components[$i].index_image' "$(params.dataDir)/$(params.internalRequestResultsFile)")
-
-          buildTimestamp=$(jq -r --argjson i "$i" '.components[$i].completion_time' \
-            "$(params.dataDir)/$(params.internalRequestResultsFile)")
-
-          publishingImages=("$targetIndex")
-          # only publish the extra timestamp-based tag if the targetIndex does not have it already
-          if [[ ! "$targetIndex" =~ .*"$buildTimestamp"$ ]]; then
-            publishingImages+=("${targetIndex}-${buildTimestamp}")
-          fi
-
-          requestTimeout=$(params.requestTimeout)
-          pipelineTimeoutSeconds=$((requestTimeout+300))
-          pipelineTimeout=$(date -u -d @"${pipelineTimeoutSeconds}" +"%Hh%Mm%Ss")
-          taskTimeout=$(date -u -d @"${requestTimeout}" +"%Hh%Mm%Ss")
-
-          IR_RESULT_FILE=$(mktemp)
-
-          for((x=0; x<${#publishingImages[@]}; x++ )); do
-              echo "=== Creating internal request to publish image:"
-              echo ""
-              echo "- from: ${sourceIndex}"
-              echo "- to: ${publishingImages[$x]}"
-
-              internal-request --pipeline "${request}" \
-                  -p sourceIndex="${sourceIndex}" \
-                  -p targetIndex="${publishingImages[$x]}" \
-                  -p publishingCredentials="${credentials}" \
-                  -p retries="$(params.retries)" \
-                  -p taskGitUrl="$(params.taskGitUrl)" \
-                  -p taskGitRevision="$(params.taskGitRevision)" \
-                  -t "$(params.requestTimeout)" \
-                  --pipeline-timeout "${pipelineTimeout}" \
-                  --task-timeout "$taskTimeout" \
-                  -l ${pipelinerun_label}="$(params.pipelineRunUid)" \
-                  | tee "$IR_RESULT_FILE" || \
-                  (grep "^\[" "$IR_RESULT_FILE" | jq . && exit 1)
-
-              internalRequest=$(awk -F"'" '/created/ { print $2 }' "$IR_RESULT_FILE")
-              echo "done (${internalRequest})"
-
-              results=$(kubectl get internalrequest "${internalRequest}" -o=jsonpath='{.status.results}')
-              requestMessage=$(echo "${results}" | jq -r '.requestMessage // ""')
-
-              if echo "${requestMessage}" | grep -qi "error"; then
-                echo "ERROR: Publish to ${publishingImages[$x]} failed"
-                echo "requestMessage: ${requestMessage}"
-                exit 1
-              fi
-              echo "=== published successfully (${publishingImages[$x]})"
-
-              echo ""
-              echo ""
-          done
-        done
+        python3 -m managed_publish_index_image \
+          --request-timeout "$(params.requestTimeout)" \
+          --retries "$(params.retries)" \
+          --task-git-url "$(params.taskGitUrl)" \
+          --task-git-revision "$(params.taskGitRevision)" \
+          --pipeline-run-id "$(params.pipelineRunUid)" \
+          --ir-results-file "$(params.dataDir)/$(params.internalRequestResultsFile)"
     - name: create-trusted-artifact
       computeResources:
         limits: