update hermetic build fix

.tekton/mlflow-pull-request.yaml

@@ -0,0 +1,72 @@
+apiVersion: tekton.dev/v1
+kind: PipelineRun
+metadata:
+  annotations:
+    build.appstudio.openshift.io/repo: https://github.com/red-hat-data-services/mlflow?rev={{revision}}
+    build.appstudio.redhat.com/commit_sha: '{{revision}}'
+    build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    build.appstudio.redhat.com/pull_request_number: "{{pull_request_number}}"
+    pipelinesascode.tekton.dev/max-keep-runs: "3"
+    pipelinesascode.tekton.dev/on-comment: "^/build-konflux mlflow"
+    pipelinesascode.tekton.dev/on-event: "[pull_request]"
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+  labels:
+    appstudio.openshift.io/application: automation
+    appstudio.openshift.io/component: pull-request-pipelines-mlflow
+    pipelines.appstudio.openshift.io/type: build
+  name: mlflow-on-pull-request
+  namespace: rhoai-tenant
+spec:
+  params:
+  - name: git-url
+    value: '{{source_url}}'
+  - name: revision
+    value: '{{revision}}'
+  - name: additional-tags
+    value:
+    - 'pr-{{pull_request_number}}-into-{{target_branch}}'
+  - name: additional-labels
+    value:
+    - version=on-pr-{{revision}}
+    - io.openshift.tags=mlflow
+  - name: output-image
+    value: quay.io/rhoai/pull-request-pipelines:mlflow-{{revision}}
+  - name: rhoai-version
+    value: "3.3.3"
+  - name: dockerfile
+    value: Dockerfile.konflux
+  - name: path-context
+    value: .
+  - name: hermetic
+    value: 'true'
+  - name: prefetch-input
+    value: '[{"type": "pip", "path": ".", "requirements_files": ["requirements/konflux-requirements.txt"]}, {"type": "yarn", "path": "mlflow/server/js"}, {"type": "rpm", "path": "requirements"}]'
+  - name: build-source-image
+    value: true
+  - name: build-image-index
+    value: true
+  - name: build-platforms
+    value:
+    - linux-extra-fast/amd64
+    - linux-m2xlarge/arm64
+    - linux/ppc64le
+  - name: image-expires-after
+    value: 5d
+  - name: enable-slack-failure-notification
+    value: "false"
+  pipelineRef:
+    resolver: git
+    params:
+    - name: url
+      value: https://github.com/red-hat-data-services/konflux-central.git
+    - name: revision
+      value: '{{ target_branch }}'
+    - name: pathInRepo
+      value: pipelines/multi-arch-container-build.yaml
+  taskRunTemplate:
+    serviceAccountName: build-pipeline-pull-request-pipelines
+  workspaces:
+  - name: git-auth
+    secret:
+      secretName: '{{ git_auth_secret }}'
+status: {}

.tekton/odh-mlflow-v3-3-push.yaml

@@ -1,17 +1,17 @@
 apiVersion: tekton.dev/v1
 kind: PipelineRun
-# konflux build manual retrigger
 metadata:
   annotations:
     build.appstudio.openshift.io/repo: https://github.com/red-hat-data-services/mlflow?rev={{revision}}
     build.appstudio.redhat.com/commit_sha: '{{revision}}'
     build.appstudio.redhat.com/target_branch: '{{target_branch}}'
+    pipelinesascode.tekton.dev/cancel-in-progress: "false"
     pipelinesascode.tekton.dev/max-keep-runs: "3"
     build.appstudio.openshift.io/build-nudge-files: "build/operator-nudging.yaml"
     pipelinesascode.tekton.dev/on-cel-expression: |
       event == "push"
       && target_branch == "rhoai-3.3"
-      && ( !".tekton/**".pathChanged() || ".tekton/odh-mlflow-v3-3-push.yaml".pathChanged() )
+      && ( files.all.exists(p, !p.matches('^\\.tekton/')) || ".tekton/odh-mlflow-v3-3-push.yaml".pathChanged() )
   labels:
     appstudio.openshift.io/application: rhoai-v3-3
     appstudio.openshift.io/component: odh-mlflow-v3-3
@@ -20,8 +20,8 @@ metadata:
   namespace: rhoai-tenant
 spec:
   timeouts:
-    pipeline: "8h0m0s"
-    tasks: "4h0m0s"
+    pipeline: 8h0m0s
+    tasks: 4h0m0s
   params:
   - name: git-url
     value: '{{source_url}}'
@@ -34,18 +34,20 @@ spec:
     value: quay.io/rhoai/odh-mlflow-rhel9:{{target_branch}}
   - name: rhoai-version
     value: "3.3.3"
-  - name: build-platforms
-    value:
-    - linux-extra-fast/amd64
-    - linux-m2xlarge/arm64
   - name: dockerfile
     value: Dockerfile.konflux
   - name: path-context
     value: .
   - name: hermetic
-    value: false
-  - name: build-image-index
-    value: true
+    value: 'true'
+  - name: prefetch-input
+    value: '[{"type": "pip", "path": ".", "requirements_files": ["requirements/konflux-requirements.txt"]}, {"type": "yarn", "path": "mlflow/server/js"}, {"type": "rpm", "path": "requirements"}]'
+  - name: build-platforms
+    value:
+    - linux-extra-fast/amd64
+    - linux-m2xlarge/arm64
+    - linux/ppc64le
+    - linux/s390x
   pipelineRef:
     resolver: git
     params:

Dockerfile.konflux

@@ -1,20 +1,32 @@
 FROM registry.access.redhat.com/ubi9/nodejs-24:9.7@sha256:06a4942584cad8a566450b5775c9564a09802f07a5c3cf2c9ea440aa84cec357 AS ui-builder
 WORKDIR /opt/app-root/src
 USER 0
-RUN npm install -g yarn
 COPY --chown=1001:0 mlflow/server/js/ .
+# Create a yarn wrapper since corepack is not available in this base image.
+# The bundled Yarn Berry CJS file is shipped in yarn/releases/.
+RUN yarn_cjs=$(ls yarn/releases/yarn-*.cjs | head -1) && \
+    printf '#!/bin/sh\nexec node /opt/app-root/src/%s "$@"\n' "$yarn_cjs" > /usr/local/bin/yarn && \
+    chmod +x /usr/local/bin/yarn
 USER 1001
-RUN yarn install --silent \
+RUN if [ -f /cachi2/cachi2.env ]; then \
+        . /cachi2/cachi2.env && \
+        export YARN_ENABLE_GLOBAL_CACHE=true && \
+        export YARN_ENABLE_OFFLINE_MODE=true && \
+        export YARN_ENABLE_NETWORK=false; \
+    fi && \
+    yarn install --immutable \
     && yarn build
 
 FROM registry.access.redhat.com/ubi9/python-311:9.7@sha256:de8a3132505ea3aabc0133dab66aae1e45cc967edbf399477a771e18cf0c34e8 AS python-builder
 WORKDIR /src
 USER 0
 COPY --chown=1001:0 . .
-RUN set -eux; \
-    python -m pip install --no-cache-dir build; \
-    python -m build --wheel --outdir /tmp/dist; \
-    python -m build --wheel --outdir /tmp/dist kubernetes-workspace-provider
+RUN if [ -f /cachi2/cachi2.env ]; then . /cachi2/cachi2.env; fi && \
+    set -eux; \
+    python -m pip wheel --no-build-isolation --no-deps --no-cache-dir \
+        --wheel-dir /tmp/dist .; \
+    python -m pip wheel --no-build-isolation --no-deps --no-cache-dir \
+        --wheel-dir /tmp/dist kubernetes-workspace-provider
 
 FROM registry.access.redhat.com/ubi9/python-311:9.7@sha256:de8a3132505ea3aabc0133dab66aae1e45cc967edbf399477a771e18cf0c34e8
 ARG MLFLOW_VERSION=3.3.2
@@ -28,9 +40,11 @@ COPY --from=python-builder /tmp/dist/mlflow_kubernetes_workspace_provider-*.whl
 COPY requirements/konflux-requirements.txt /tmp/konflux-requirements.txt
 RUN set -eux; \
     dnf install -y --setopt=tsflags=nodocs postgresql-devel gcc python3-devel && \
+    dnf clean all
+RUN if [ -f /cachi2/cachi2.env ]; then . /cachi2/cachi2.env; fi && \
+    set -eux; \
     python -m pip install --no-cache-dir --require-hashes -r /tmp/konflux-requirements.txt && \
     python -m pip install --no-cache-dir --no-deps /tmp/dist/mlflow-*.whl /tmp/dist/mlflow_kubernetes_workspace_provider-*.whl && \
-    dnf clean all && \
     rm -f /tmp/dist/mlflow-*.whl /tmp/dist/mlflow_kubernetes_workspace_provider-*.whl /tmp/konflux-requirements.txt
 
 # Copy built UI from builder stage

mlflow/server/js/.yarnrc.yml

@@ -1,2 +1,8 @@
 yarnPath: yarn/releases/yarn-4.9.1.cjs
 nodeLinker: node-modules
+supportedArchitectures:
+  cpu:
+    - x64
+    - arm64
+    - ppc64le
+    - s390x

requirements/rpms.in.yaml

@@ -0,0 +1,24 @@
+# RPM lockfile input for UBI9 (multi-arch)
+#
+# Lists RPMs installed via dnf in the Dockerfile that need to be
+# prefetched for hermetic Konflux builds.
+#
+# Regenerate the lock file with:
+#   rpm-lockfile-prototype --containerfile Dockerfile.konflux --outfile requirements/rpms.lock.yaml requirements/rpms.in.yaml
+arches:
+  - x86_64
+  - aarch64
+  - ppc64le
+  - s390x
+
+contentOrigin:
+  repofiles:
+    - ubi.repo
+
+packages:
+  - gcc
+  - postgresql-devel
+  - python3-devel
+
+context:
+  containerfile: ../Dockerfile.konflux

requirements/rpms.lock.yaml

@@ -0,0 +1,180 @@
+---
+lockfileVersion: 1
+lockfileVendor: redhat
+arches:
+- arch: aarch64
+  packages:
+  - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/appstream/os/Packages/p/python3-devel-3.9.25-7.el9_8.aarch64.rpm
+    repoid: ubi-9-for-aarch64-appstream-rpms
+    size: 258076
+    checksum: sha256:c3c5ebabc1e1f3559cfaed1636358a231a7e402fbe7d86da1ac54cc2444355d4
+    name: python3-devel
+    evr: 3.9.25-7.el9_8
+    sourcerpm: python3.9-3.9.25-7.el9_8.src.rpm
+  - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/appstream/os/Packages/p/python3-pip-21.3.1-2.el9_8.noarch.rpm
+    repoid: ubi-9-for-aarch64-appstream-rpms
+    size: 2135291
+    checksum: sha256:e23ed9e25c89636826bde36317940b35c9f7dd1513dd1f6d76f7420e95aaac0f
+    name: python3-pip
+    evr: 21.3.1-2.el9_8
+    sourcerpm: python-pip-21.3.1-2.el9_8.src.rpm
+  - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/p/python3-3.9.25-7.el9_8.aarch64.rpm
+    repoid: ubi-9-for-aarch64-baseos-rpms
+    size: 33637
+    checksum: sha256:280b1ba4a3b77c290505a50fabf403099b60215afaab59d6a086abccb378141c
+    name: python3
+    evr: 3.9.25-7.el9_8
+    sourcerpm: python3.9-3.9.25-7.el9_8.src.rpm
+  - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/p/python3-libs-3.9.25-7.el9_8.aarch64.rpm
+    repoid: ubi-9-for-aarch64-baseos-rpms
+    size: 8473573
+    checksum: sha256:d67bf7994de7b255fed9d4a8a86d2ee52faada1ef8b4a258ab002954bf757b2b
+    name: python3-libs
+    evr: 3.9.25-7.el9_8
+    sourcerpm: python3.9-3.9.25-7.el9_8.src.rpm
+  source:
+  - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/p/python-pip-21.3.1-2.el9_8.src.rpm
+    repoid: ubi-9-for-aarch64-baseos-source-rpms
+    size: 8988034
+    checksum: sha256:c755a55a4023f5a52ecae2029ebb9be588981de14a10ff9adc4174277e47a00a
+    name: python-pip
+    evr: 21.3.1-2.el9_8
+  - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/source/SRPMS/Packages/p/python3.9-3.9.25-7.el9_8.src.rpm
+    repoid: ubi-9-for-aarch64-baseos-source-rpms
+    size: 20825946
+    checksum: sha256:cca2abdde75b1deaa74f6072283651ba7193c2a4fcda8295413bdbb4cf88fa40
+    name: python3.9
+    evr: 3.9.25-7.el9_8
+  module_metadata: []
+- arch: ppc64le
+  packages:
+  - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/ppc64le/appstream/os/Packages/p/python3-devel-3.9.25-7.el9_8.ppc64le.rpm
+    repoid: ubi-9-for-ppc64le-appstream-rpms
+    size: 258105
+    checksum: sha256:d411a471e5b9e22e26e23a216a4ff16902547b7a32af30f6811224a226049266
+    name: python3-devel
+    evr: 3.9.25-7.el9_8
+    sourcerpm: python3.9-3.9.25-7.el9_8.src.rpm
+  - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/ppc64le/appstream/os/Packages/p/python3-pip-21.3.1-2.el9_8.noarch.rpm
+    repoid: ubi-9-for-ppc64le-appstream-rpms
+    size: 2135291
+    checksum: sha256:e23ed9e25c89636826bde36317940b35c9f7dd1513dd1f6d76f7420e95aaac0f
+    name: python3-pip
+    evr: 21.3.1-2.el9_8
+    sourcerpm: python-pip-21.3.1-2.el9_8.src.rpm
+  - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/ppc64le/baseos/os/Packages/p/python3-3.9.25-7.el9_8.ppc64le.rpm
+    repoid: ubi-9-for-ppc64le-baseos-rpms
+    size: 33692
+    checksum: sha256:b48fbbd5c5b28db8f615030cf9c6706c73d9bfe679b1b070220bdf49be346d37
+    name: python3
+    evr: 3.9.25-7.el9_8
+    sourcerpm: python3.9-3.9.25-7.el9_8.src.rpm
+  - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/ppc64le/baseos/os/Packages/p/python3-libs-3.9.25-7.el9_8.ppc64le.rpm
+    repoid: ubi-9-for-ppc64le-baseos-rpms
+    size: 8449585
+    checksum: sha256:02cd8747abcd32a34dfb5faf68e6baec878f8c468b53ff4f80bd2f00d2b599a8
+    name: python3-libs
+    evr: 3.9.25-7.el9_8
+    sourcerpm: python3.9-3.9.25-7.el9_8.src.rpm
+  source:
+  - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/ppc64le/baseos/source/SRPMS/Packages/p/python-pip-21.3.1-2.el9_8.src.rpm
+    repoid: ubi-9-for-ppc64le-baseos-source-rpms
+    size: 8988034
+    checksum: sha256:c755a55a4023f5a52ecae2029ebb9be588981de14a10ff9adc4174277e47a00a
+    name: python-pip
+    evr: 21.3.1-2.el9_8
+  - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/ppc64le/baseos/source/SRPMS/Packages/p/python3.9-3.9.25-7.el9_8.src.rpm
+    repoid: ubi-9-for-ppc64le-baseos-source-rpms
+    size: 20825946
+    checksum: sha256:cca2abdde75b1deaa74f6072283651ba7193c2a4fcda8295413bdbb4cf88fa40
+    name: python3.9
+    evr: 3.9.25-7.el9_8
+  module_metadata: []
+- arch: s390x
+  packages:
+  - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/s390x/appstream/os/Packages/p/python3-devel-3.9.25-7.el9_8.s390x.rpm
+    repoid: ubi-9-for-s390x-appstream-rpms
+    size: 257943
+    checksum: sha256:c8dd5d12f29b939b802b832198286d0526ceba9516e959c9f2b6834a6028474e
+    name: python3-devel
+    evr: 3.9.25-7.el9_8
+    sourcerpm: python3.9-3.9.25-7.el9_8.src.rpm
+  - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/s390x/appstream/os/Packages/p/python3-pip-21.3.1-2.el9_8.noarch.rpm
+    repoid: ubi-9-for-s390x-appstream-rpms
+    size: 2135291
+    checksum: sha256:e23ed9e25c89636826bde36317940b35c9f7dd1513dd1f6d76f7420e95aaac0f
+    name: python3-pip
+    evr: 21.3.1-2.el9_8
+    sourcerpm: python-pip-21.3.1-2.el9_8.src.rpm
+  - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/s390x/baseos/os/Packages/p/python3-3.9.25-7.el9_8.s390x.rpm
+    repoid: ubi-9-for-s390x-baseos-rpms
+    size: 33480
+    checksum: sha256:667a54cb203dda2151c521bddb65f84c9e7b9986b84db1609d570054aa82c513
+    name: python3
+    evr: 3.9.25-7.el9_8
+    sourcerpm: python3.9-3.9.25-7.el9_8.src.rpm
+  - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/s390x/baseos/os/Packages/p/python3-libs-3.9.25-7.el9_8.s390x.rpm
+    repoid: ubi-9-for-s390x-baseos-rpms
+    size: 8314201
+    checksum: sha256:ecb17d1b06fead17c2e469ebaba6dc3f4f14534575597833f4e2e9ec73d4d551
+    name: python3-libs
+    evr: 3.9.25-7.el9_8
+    sourcerpm: python3.9-3.9.25-7.el9_8.src.rpm
+  source:
+  - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/s390x/baseos/source/SRPMS/Packages/p/python-pip-21.3.1-2.el9_8.src.rpm
+    repoid: ubi-9-for-s390x-baseos-source-rpms
+    size: 8988034
+    checksum: sha256:c755a55a4023f5a52ecae2029ebb9be588981de14a10ff9adc4174277e47a00a
+    name: python-pip
+    evr: 21.3.1-2.el9_8
+  - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/s390x/baseos/source/SRPMS/Packages/p/python3.9-3.9.25-7.el9_8.src.rpm
+    repoid: ubi-9-for-s390x-baseos-source-rpms
+    size: 20825946
+    checksum: sha256:cca2abdde75b1deaa74f6072283651ba7193c2a4fcda8295413bdbb4cf88fa40
+    name: python3.9
+    evr: 3.9.25-7.el9_8
+  module_metadata: []
+- arch: x86_64
+  packages:
+  - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/appstream/os/Packages/p/python3-devel-3.9.25-7.el9_8.x86_64.rpm
+    repoid: ubi-9-for-x86_64-appstream-rpms
+    size: 258092
+    checksum: sha256:efa9a00b343a01c2b3d8353a57e06272ac0789ba2ffca2f7f7a109c652c05575
+    name: python3-devel
+    evr: 3.9.25-7.el9_8
+    sourcerpm: python3.9-3.9.25-7.el9_8.src.rpm
+  - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/appstream/os/Packages/p/python3-pip-21.3.1-2.el9_8.noarch.rpm
+    repoid: ubi-9-for-x86_64-appstream-rpms
+    size: 2135291
+    checksum: sha256:e23ed9e25c89636826bde36317940b35c9f7dd1513dd1f6d76f7420e95aaac0f
+    name: python3-pip
+    evr: 21.3.1-2.el9_8
+    sourcerpm: python-pip-21.3.1-2.el9_8.src.rpm
+  - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/p/python3-3.9.25-7.el9_8.x86_64.rpm
+    repoid: ubi-9-for-x86_64-baseos-rpms
+    size: 33674
+    checksum: sha256:6e19476d33bcc02b1c275c7d01131c3a15f3160d1bbc03348c7929aebbb3f686
+    name: python3
+    evr: 3.9.25-7.el9_8
+    sourcerpm: python3.9-3.9.25-7.el9_8.src.rpm
+  - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/p/python3-libs-3.9.25-7.el9_8.x86_64.rpm
+    repoid: ubi-9-for-x86_64-baseos-rpms
+    size: 8482615
+    checksum: sha256:91a38a134da1fdf79c721099cf733613b676f1c200f63e434319a34e6d8005be
+    name: python3-libs
+    evr: 3.9.25-7.el9_8
+    sourcerpm: python3.9-3.9.25-7.el9_8.src.rpm
+  source:
+  - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/p/python-pip-21.3.1-2.el9_8.src.rpm
+    repoid: ubi-9-for-x86_64-baseos-source-rpms
+    size: 8988034
+    checksum: sha256:c755a55a4023f5a52ecae2029ebb9be588981de14a10ff9adc4174277e47a00a
+    name: python-pip
+    evr: 21.3.1-2.el9_8
+  - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/source/SRPMS/Packages/p/python3.9-3.9.25-7.el9_8.src.rpm
+    repoid: ubi-9-for-x86_64-baseos-source-rpms
+    size: 20825946
+    checksum: sha256:cca2abdde75b1deaa74f6072283651ba7193c2a4fcda8295413bdbb4cf88fa40
+    name: python3.9
+    evr: 3.9.25-7.el9_8
+  module_metadata: []