feat(HUM-2068): push-rpms integration test update

[scoheb]

Summary

• Update RPA with signOptions config for RPM signing (keytab, pipeline image, SA, artifact storage, key alias, unsigned/signed domains)
• Add multi-component test support with wait_for_releases using internal helper
• Update vault secrets for new Pulp bot and packages URL
• Enhance create-pulp-resources script with signed repo support
• Use unsigned domain for artifact verification

Test plan

• Integration test: cd integration-tests && ./run-test.sh push-rpms-to-pulp -i

Jira

https://redhat.atlassian.net/browse/HUM-2068

Part of HUM-959 - PR 6 of 6

🤖 Generated with Claude Code

[qodo-code-review]

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →

[scoheb]

The push-rpms-to-pulp-e2e-test failure is expected — this PR updates the integration test to reference the RPM signing workflow, but the required task/pipeline changes are in PRs #2233–#2237 which haven't been merged to development yet. This PR should be merged last in the sequence, after which the e2e test will pass.

[swickersh]

lgtm
#2237 needs approved/merged first.

[swickersh]

this will need prod/needs-approval label to progress through review process once @theflockers is good with the change.

[swickersh]

looks like just a vault update since last approval.
lgtm

[qodo-code-review]

PR Reviewer Guide 🔍

(Review updated until commit ba4b0ee)

Warning

/review is deprecated. Use /agentic_review instead (removal date not yet scheduled).

Here are some key observations to aid the review process:

🎫 Ticket compliance analysis 🔶 HUM-2068 - Partially compliant Compliant requirements: Update push-rpms-to-pulp integration test to support/validate the RPM signing workflow. Ensure integration test configuration supports new signing-related inputs (e.g., sign options / domains) as needed for the workflow. Non-compliant requirements: Requires further human verification: Validate the updated integration test via an integration run (./run-test.sh push-rpms-to-pulp -i). HUM-959 - Partially compliant Compliant requirements: Non-compliant requirements: Requires further human verification: Contribute the rpm-signing branch changes back to release-service-catalog development branch. Ensure the set of related PRs/subtasks are integrated/compatible as part of the overall effort.

⏱️ Estimated effort to review: 3 🔵🔵🔵⚪⚪

🧪 PR contains tests

🔒 Security concerns Supply chain risk: signPipelineImage is set to quay.io/konflux-ci/signing:latest, which is mutable and could pull unexpected content over time. Prefer a pinned digest/tag to reduce the risk of unintended execution changes.

⚡ Recommended focus areas for review Unused var release_names is assigned but the script iterates over RELEASE_NAMES. This may be a leftover from a refactor and can cause confusion about which variable is authoritative for multi-release behavior. release_names="${release_name}" "${SUITE_DIR}/../scripts/wait-for-release.sh" } YQ selection The new yq expressions select the first matching src artifact via [0]. If no src artifact exists, this can yield null/error behavior depending on yq version; consider guarding with a length check and/or using -r to ensure consistent empty-string output. sbom_url=$(yq '[.spec.content.artifacts[] | select(.architecture == "src")] | .[0].sbom // ""' \ "${advisory_yaml_dir}/advisory.yaml") if [ -n "${sbom_url}" ]; then echo "Found SBOM URL: ${sbom_url}" # Get Pulp credentials from the secret # Disable tracing to prevent credential exposure { set +x; } 2>/dev/null pulp_secret_name="pulp-credentials-${component_name}" cli_toml=$(kubectl get secret "${pulp_secret_name}" -n "${managed_namespace}" \ -o jsonpath='{.data.cli\.toml}' 2>/dev/null | base64 -d || echo "") if [ -n "${cli_toml}" ]; then pulp_username=$(echo "${cli_toml}" | grep username | cut -d'"' -f2) pulp_password=$(echo "${cli_toml}" | grep password | cut -d'"' -f2) # Try to download the SBOM sbom_file=$(mktemp) http_code=$(curl -L -s -w "%{http_code}" -u "${pulp_username}:${pulp_password}" \ -o "${sbom_file}" "${sbom_url}" 2>/dev/null || echo "000") if [ "${http_code}" = "200" ]; then echo "✅️ SBOM downloaded successfully (HTTP ${http_code})" # Validate it's valid JSON if jq -e . "${sbom_file}" >/dev/null 2>&1; then echo "✅️ SBOM is valid JSON" else echo "🔴 SBOM is not valid JSON" failures=$((failures+1)) fi else echo "🔴 Failed to download SBOM (HTTP ${http_code})" failures=$((failures+1)) fi rm -f "${sbom_file}" else echo "Warning: Could not retrieve Pulp credentials, skipping SBOM download verification" fi else echo "🔴 sbom field not found in source RPM artifact entry" failures=$((failures+1)) fi # Verify attestation field is present for source RPM artifacts and is downloadable echo "Checking attestation for source RPM artifacts..." attestation_url=$(yq '[.spec.content.artifacts[] | select(.architecture == "src")] | .[0].attestation // ""' \ "${advisory_yaml_dir}/advisory.yaml") Pinned image signPipelineImage uses a :latest tag, which can make the integration test non-reproducible and flaky if the image changes. Prefer pinning to a digest or a specific version tag. signPipelineImage: "quay.io/konflux-ci/signing:latest" signPipelineServiceAccount: "signing-pipeline-sa" # Skips the signing pipeline's re-upload of signed RPMs to Pulp;

[qodo-code-review]

PR Code Suggestions ✨

Warning

/improve is deprecated. Use /agentic_review instead (removal date not yet scheduled).

Inline suggestions were posted as code suggestions.

[theflockers]

my comments were clarified. So LGTM.

[qodo-code-review]

PR Code Suggestions ✨

Warning

/improve is deprecated. Use /agentic_review instead (removal date not yet scheduled).

Inline suggestions were posted as code suggestions.

[qodo-code-review]

PR Code Suggestions ✨

Warning

/improve is deprecated. Use /agentic_review instead (removal date not yet scheduled).

Inline suggestions were posted as code suggestions.

[johnbieren]

This is not a user facing change, so no prod-approval label needed. I removed it. Scott H, you can resolve the qodo comments yourself after either addressing them or deciding they aren't necessary. Scott W, you can merge this once it has passing e2e

[qodo-code-review]

PR Code Suggestions ✨

Warning

/improve is deprecated. Use /agentic_review instead (removal date not yet scheduled).

Inline suggestions were posted as code suggestions.

[qodo-code-review]

PR Code Suggestions ✨

Warning

/improve is deprecated. Use /agentic_review instead (removal date not yet scheduled).

Inline suggestions were posted as code suggestions.

[swickersh]

This is not a user facing change, so no prod-approval label needed. I removed it. Scott H, you can resolve the qodo comments yourself after either addressing them or deciding they aren't necessary. Scott W, you can merge this once it has passing e2e

Ack, thanks. Sorry forgot we don't need the label on these.