Skip to content

feat(HUM-2061): optimize filter-already-released-advisory-rpms for speed and reliability #2233

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
johnbieren merged 1 commit into from
Jun 8, 2026
Merged

feat(HUM-2061): optimize filter-already-released-advisory-rpms for speed and reliability #2233

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions pipelines/internal/filter-already-released-advisory-rpms/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,5 +11,7 @@ It returns lists of unreleased RPMs and RPMs found in advisories for digest vali
| origin | The origin workspace where the release CR comes from | No | - |
| advisory_secret_name | The name of the secret that contains the advisory GitLab metadata | No | - |
| internalRequestPipelineRunName | Name of the PipelineRun that requested this pipeline | No | - |
| ociStorage | The OCI repository to store results artifact | No | - |
| taskGitUrl | The url to the git repo where the release-service-catalog tasks to be used are stored | Yes | https://github.com/konflux-ci/release-service-catalog.git |
| taskGitRevision | The revision in the taskGitUrl repo to be used | No | - |
| orasOptions | oras options to pass to oras calls | Yes | "" |
Comment thread
scoheb marked this conversation as resolved.
17 changes: 13 additions & 4 deletions ...internal/filter-already-released-advisory-rpms/filter-already-released-advisory-rpms.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,13 +23,20 @@ spec:
- name: internalRequestPipelineRunName
type: string
description: Name of the PipelineRun that requested this pipeline
- name: ociStorage
type: string
description: The OCI repository to store results artifact
- name: taskGitUrl
type: string
description: The url to the git repo where the release-service-catalog tasks to be used are stored
default: https://github.com/konflux-ci/release-service-catalog.git
- name: taskGitRevision
type: string
description: The revision in the taskGitUrl repo to be used
- name: orasOptions
type: string
description: oras options to pass to oras calls
default: ""
tasks:
- name: filter-already-released-advisory-rpms-task
taskRef:
Expand All @@ -50,13 +57,15 @@ spec:
value: $(params.advisory_secret_name)
- name: internalRequestPipelineRunName
value: $(params.internalRequestPipelineRunName)
- name: ociStorage
value: $(params.ociStorage)
- name: orasOptions
value: $(params.orasOptions)
results:
- name: result
value: $(tasks.filter-already-released-advisory-rpms-task.results.result)
- name: unreleased_rpms
value: $(tasks.filter-already-released-advisory-rpms-task.results.unreleased_rpms)
- name: in_advisory_rpms
value: $(tasks.filter-already-released-advisory-rpms-task.results.in_advisory_rpms)
- name: filter_results_artifact
value: $(tasks.filter-already-released-advisory-rpms-task.results.filter_results_artifact)
- name: advisory_url
value: $(tasks.filter-already-released-advisory-rpms-task.results.advisory_url)
- name: advisory_internal_url
Expand Down
2 changes: 1 addition & 1 deletion scripts/run-local-tests.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -277,7 +277,7 @@ classify_tasks() {
continue
fi

# Check if task supports Trusted Artifacts (uses TA step actions)
# Check if task needs OCI registry (uses TA step actions)
if grep -q "name: use-trusted-artifact\|name: create-trusted-artifact" "$task_file"; then
trusted_artifacts_tasks+=("$item")
else
Expand Down
19 changes: 11 additions & 8 deletions tasks/internal/filter-already-released-advisory-rpms-task/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,11 +6,14 @@ RPMs found in advisories (for digest validation by the calling task).

## Parameters

| Name | Description | Optional | Default value |
|--------------------------------|-----------------------------------------------------------------------|----------|---------------|
| transformedSnapshot | Base64 string of gzipped JSON array of RPM entries with purls | No | - |
| origin | The origin workspace for the release CR | No | - |
| advisory_secret_name | Name of the secret containing advisory GitLab metadata | No | - |
| internalRequestPipelineRunName | Name of the PipelineRun that requested this task | No | - |
| caTrustConfigMapName | The name of the ConfigMap to read CA bundle data from | Yes | trusted-ca |
| caTrustConfigMapKey | The name of the key in the ConfigMap that contains the CA bundle data | Yes | ca-bundle.crt |
| Name | Description | Optional | Default value |
|-------------------------------------------------|--------------------------------------------------------------------------------------------|----------|-----------------------------------------------------|
| transformedSnapshot | Base64 string of gzipped JSON array of RPM entries with purls | No | - |
| origin | The origin workspace for the release CR | No | - |
| advisory_secret_name | Name of the secret containing advisory GitLab metadata | No | - |
| internalRequestPipelineRunName | Name of the PipelineRun that requested this task | No | - |
| ociStorage | The OCI repository to store results artifact | No | - |
| trusted_artifacts_dockerconfig_json_secret_name | The name of the secret that contains the dockerconfig json for trusted artifact operations | Yes | quay-token-konflux-release-trusted-artifacts-secret |
| orasOptions | oras options to pass to oras calls | Yes | "" |
| caTrustConfigMapName | The name of the ConfigMap to read CA bundle data from | Yes | trusted-ca |
| caTrustConfigMapKey | The name of the key in the ConfigMap that contains the CA bundle data | Yes | ca-bundle.crt |
Loading
Loading