refactor(RELEASE-1985): convert create-advisory internal task to python

[johnbieren]

This commit replaces the inline bash script for the create-advisory internal task with a standalone python script contained in the utils image. The tekton unit tests are updated accordingly (mocks converted to a way that works with the python script and test scenarios removed that are already covered via pytest in the utils repo).

Describe your changes

Relevant Jira

Checklist before requesting a review

• I have marked as draft or added do not merge label if there's a dependency PR
  • If you want reviews on your draft PR, you can add reviewers or add the release-service-maintainers handle if you are unsure who to tag
• My commit message includes Signed-off-by: My name <email>
• I read CONTRIBUTING.MD and commit formatting
• I have run the README.md generator script in .github/scripts/readme_generator.sh and verified the results using .github/scripts/check_readme.sh
• If an AI agent was used, I marked that via a commit footer like Assisted-By: Cursor

[johnbieren]

/retest

[johnbieren]

/retest

[johnbieren]

/retest

[johnbieren]

/retest

[johnbieren]

/retest

[johnbieren]

/retest

[johnbieren]

/retest

[johnbieren]

/retest

[johnbieren]

/retest

[johnbieren]

/retest

[johnbieren]

Depends on konflux-ci/release-service-utils#778

[johnbieren]

/retest

[johnbieren]

/retest

[johnbieren]

/retest

[qodo-app-for-konflux-ci]

PR Reviewer Guide 🔍

Warning

/review is deprecated. Use /agentic_review instead (removal date not yet scheduled).

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 3 🔵🔵🔵⚪⚪

🧪 PR contains tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Interface Drift The task now passes params/results via multiple PARAM_* and RESULT_* environment variables and switches to a Python entrypoint. Please validate that the Python script’s expected environment variable names match these exactly (including casing) and that all previously produced Tekton results are still written for downstream consumers. - name: create-advisory image: quay.io/konflux-ci/release-service-utils@sha256:71a99d12d920fcc157e08e5dc9894fbc4bce42328e9c2f58dc53411278858d91 computeResources: limits: memory: 512Mi requests: memory: 512Mi cpu: '1' # 1 is the max allowed by at least the staging cluster volumeMounts: - name: advisory-secret mountPath: /mnt/advisory_secret - name: errata-secret mountPath: /mnt/errata_secret env: - name: ADVISORY_JSON value: $(params.advisory_json) - name: PARAM_COMPONENT_GROUP value: $(params.componentGroup) - name: PARAM_ORIGIN value: $(params.origin) - name: PARAM_CONFIG_MAP_NAME value: $(params.config_map_name) - name: PARAM_CONTENT_TYPE value: $(params.contentType) - name: PARAM_INTERNAL_REQUEST_PIPELINE_RUN_NAME value: $(params.internalRequestPipelineRunName) - name: PARAM_TASK_RUN_NAME value: $(context.taskRun.name) - name: RESULT_RESULT value: $(results.result.path) - name: RESULT_ADVISORY_URL value: $(results.advisory_url.path) - name: RESULT_ADVISORY_INTERNAL_URL value: $(results.advisory_internal_url.path) - name: RESULT_INTERNAL_REQUEST_PIPELINE_RUN_NAME value: $(results.internalRequestPipelineRunName.path) - name: RESULT_INTERNAL_REQUEST_TASK_RUN_NAME value: $(results.internalRequestTaskRunName.path) command: ["/home/scripts/python/tasks/internal/create_advisory.py"] Test Robustness The pre-apply hook creates cluster-scoped test fixtures (RBAC, ConfigMap, Secrets) and writes a temp file under /tmp. Consider making the script more robust by ensuring cleanup (e.g., trap-based teardown) and using stricter bash settings so partial failures don’t leave state behind that could affect subsequent test runs. # Add RBAC so that the SA executing the tests can retrieve CRs kubectl apply -f .github/resources/crd_rbac.yaml cat > "/tmp/cm.json" << EOF { "apiVersion": "v1", "data": { "PYXIS_URL": "https://pyxis.stage.engineering.redhat.com", "SIG_KEY_NAMES": "redhate2etesting redhate2etesting2", "PYXIS_SSL_CERT_FILE_NAME": "hacbs-signing-pipeline.pem", "PYXIS_SSL_CERT_SECRET_NAME": "hacbs-signing-pipeline-certs", "PYXIS_SSL_KEY_FILE_NAME": "hacbs-signing-pipeline.key", "UMB_CLIENT_NAME": "hacbs-signing-pipeline-nonprod", "UMB_LISTEN_TOPIC": "VirtualTopic.eng.robosignatory.hacbs.sign", "UMB_PUBLISH_TOPIC": "VirtualTopic.eng.hacbs-signing-pipeline.hacbs.sign", "UMB_URL": "umb.stage.api.redhat.com", "UMB_SSL_CERT_FILE_NAME": "hacbs-signing-pipeline.pem", "UMB_SSL_CERT_SECRET_NAME": "hacbs-signing-pipeline-certs", "UMB_SSL_KEY_FILE_NAME": "hacbs-signing-pipeline.key", "SIGNER_TYPE": "batch" }, "kind": "ConfigMap", "metadata": { "name": "create-advisory-test-cm" } } EOF kubectl delete -f /tmp/cm.json --ignore-not-found kubectl create -f /tmp/cm.json kubectl delete secret create-advisory-secret --ignore-not-found kubectl create secret generic create-advisory-secret \ --from-literal=git_author_email=tester@tester \ --from-literal=git_author_name=tester \ --from-literal=gitlab_access_token=abc \ --from-literal=gitlab_host=myurl \ --from-literal=git_repo=https://gitlab.com/org/repo.git kubectl delete secret create-advisory-errata-secret --ignore-not-found kubectl create secret generic create-advisory-errata-secret \ --from-literal=errata_api=https://errata/api/v1 \ --from-literal=name=errata-tester \ --from-literal=base64_keytab=Zm9vCg==

📚 Focus areas based on broader codebase context Task Semantics This task previously documented (and relied on) the invariant that it "will always exit 0 even if something fails" so that task results are still set and propagated. With the refactor to a Python entrypoint, ensure the invoked script preserves that behavior (always writes all expected results and exits 0 even on errors), otherwise downstream internal-request handling may break. (Ref 1, Ref 4) - name: create-advisory image: quay.io/konflux-ci/release-service-utils@sha256:71a99d12d920fcc157e08e5dc9894fbc4bce42328e9c2f58dc53411278858d91 computeResources: limits: memory: 512Mi requests: memory: 512Mi cpu: '1' # 1 is the max allowed by at least the staging cluster volumeMounts: - name: advisory-secret mountPath: /mnt/advisory_secret - name: errata-secret mountPath: /mnt/errata_secret env: - name: ADVISORY_JSON value: $(params.advisory_json) - name: PARAM_COMPONENT_GROUP value: $(params.componentGroup) - name: PARAM_ORIGIN value: $(params.origin) - name: PARAM_CONFIG_MAP_NAME value: $(params.config_map_name) - name: PARAM_CONTENT_TYPE value: $(params.contentType) - name: PARAM_INTERNAL_REQUEST_PIPELINE_RUN_NAME value: $(params.internalRequestPipelineRunName) - name: PARAM_TASK_RUN_NAME value: $(context.taskRun.name) - name: RESULT_RESULT value: $(results.result.path) - name: RESULT_ADVISORY_URL value: $(results.advisory_url.path) - name: RESULT_ADVISORY_INTERNAL_URL value: $(results.advisory_internal_url.path) - name: RESULT_INTERNAL_REQUEST_PIPELINE_RUN_NAME value: $(results.internalRequestPipelineRunName.path) - name: RESULT_INTERNAL_REQUEST_TASK_RUN_NAME value: $(results.internalRequestTaskRunName.path) command: ["/home/scripts/python/tasks/internal/create_advisory.py"] Reference reasoning: The existing internal task definitions explicitly call out "always exit 0 even if something fails" as a key contract because task results must be set regardless of failures. The PR changes the implementation from an inline bash script (which trapped EXIT/ERR and forced exit 0 while writing results) to a Python command, so the new entrypoint must intentionally re-implement the same contract.

📄 References konflux-ci/release-service-catalog/tasks/internal/create-advisory-task/create-advisory-task.yaml [1-15] konflux-ci/release-service-catalog/tasks/internal/create-advisory-task/tests/test-create-advisory.yaml [1-13] konflux-ci/release-service-catalog/pipelines/internal/create-advisory/create-advisory.yaml [47-74] konflux-ci/release-service-catalog/tasks/internal/create-advisory-oci-artifact-task/create-advisory-oci-artifact-task.yaml [1-15] konflux-ci/release-service-catalog/pipelines/internal/create-advisory-oci-artifact/create-advisory-oci-artifact.yaml [23-38] konflux-ci/release-service-catalog/pipelines/managed/rh-rpm-advisories/rh-rpm-advisories.yaml [251-267] konflux-ci/release-service-catalog/tasks/managed/create-advisory/create-advisory.yaml [1-14] konflux-ci/release-service-catalog/pipelines/managed/calunga-push-to-pulp/calunga-push-to-pulp.yaml [346-355]

[qodo-app-for-konflux-ci]

PR Code Suggestions ✨

Warning

/improve is deprecated. Use /agentic_review instead (removal date not yet scheduled).

Inline suggestions were posted as code suggestions.

[johnbieren]

@FilipNikolovski @seanconroy2021 this one is finally ready, PTAL

[FilipNikolovski]

LGTM, have one question - noticed you're only using env vars for the params instead of command line args for the script, is there a specific reason for that or its just a preference?

[johnbieren]

LGTM, have one question - noticed you're only using env vars for the params instead of command line args for the script, is there a specific reason for that or its just a preference?

Not a specific reason - that is just how cursor did it the first time and I stuck with it

[FilipNikolovski]

LGTM, have one question - noticed you're only using env vars for the params instead of command line args for the script, is there a specific reason for that or its just a preference?

Not a specific reason - that is just how cursor did it the first time and I stuck with it

okay thanks!

[seanconroy2021]

lgtm

[ach912]

lgtm

[ach912]

Production Approval Record

Field	Value
Action	APPROVED
Reviewer	@ach912
Timestamp	2026-06-15T09:39:52.166Z

Approved