Restore arm64 builds for ocm-container-micro; add CI guardrails#534
Merged
openshift-merge-bot[bot] merged 1 commit intoJun 15, 2026
Conversation
Revert ocm-container-micro pipeline files from the bot-generated embedded pipelineSpec back to the lightweight pipelineRef style that Kirk Bater originally set up (PR openshift#461). The Konflux bot (PR openshift#488, commit a8458a1) silently replaced pipelineRef with pipelineSpec and stripped arm64 support on 2026-03-12. Add a CI guardrail script that fails if any PipelineRun file has its pipelineRef replaced with an embedded pipelineSpec or if arm64 is removed from build-platforms. ROSAENG-3945 Created with assistance from Claude 🤖 <claude@anthropic.com> Signed-off-by: Christopher Collins <collins.christopher@gmail.com>
WalkthroughThis PR introduces a Tekton pipeline validation script that enforces two rules across PipelineRun files: use of pipelineRef instead of embedded pipelineSpec, and inclusion of linux/arm64 in build-platforms. Two existing PipelineRun manifests are refactored to conform to these rules, replacing embedded pipeline definitions with references and expanding their build configuration. CI integration is added to run the validation step before image builds. ChangesTekton PipelineRun Validation and Refactoring
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Suggested labels
Suggested reviewers
🚥 Pre-merge checks | ✅ 14 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (14 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
openshift-ci
Bot
added
the
approved
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.ci/validate-tekton-pipelines.sh:
- Around line 13-20: The script defines an explicit allowlist PIPELINERUN_FILES
but currently only emits a warning and returns when a tracked PipelineRun file
is missing; change those early-return warning branches to fail the script with a
non-zero exit (use echo to STDERR and exit 1) so a missing or renamed entry
fails CI; update the two validation spots that currently "warn and return" (the
checks that iterate PIPELINERUN_FILES and the duplicate/coverage check) to emit
a clear error message and exit 1 instead of returning success.
In `@Makefile`:
- Around line 366-372: The global toolchain pre-checks are being evaluated
before Make selects targets, so running the new validate-tekton target still
fails on machines without go/podman/docker; update the Makefile so those checks
are only run for build/image targets by either moving the toolchain checks into
the build-only prerequisites (e.g., tie them to check-image-build/pr-check) or
guard their execution with a MAKECMDGOALS conditional that skips them when
MAKECMDGOALS contains validate-tekton, and ensure the validate-tekton target
(and pr-check if intended) can run standalone without triggering the global
checks.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: c22da03e-f832-40b8-9740-e3cb44599aef
📒 Files selected for processing (4)
.ci/validate-tekton-pipelines.sh.tekton/ocm-container-micro-pull-request.yaml.tekton/ocm-container-micro-push.yamlMakefile
Comment on lines
+13
to
+20
| PIPELINERUN_FILES=( | ||
| "ocm-container-micro-push.yaml" | ||
| "ocm-container-micro-pull-request.yaml" | ||
| "ocm-container-minimal-push.yaml" | ||
| "ocm-container-minimal-pull-request.yaml" | ||
| "ocm-container-push.yaml" | ||
| "ocm-container-pull-request.yaml" | ||
| ) |
There was a problem hiding this comment.
Fail when a tracked PipelineRun file is missing.
Line 26 and Line 59 only warn and return. Since PIPELINERUN_FILES is an explicit allowlist, renaming or deleting one of those manifests bypasses both validations and still leaves this guardrail green. Missing entries should count as validation failures so coverage cannot be silently dropped.
🛠️ Proposed fix
+check_file_exists() {
+ local file="$1"
+ local filepath="${TEKTON_DIR}/${file}"
+
+ if [ ! -f "${filepath}" ]; then
+ echo "FAILURE: ${file} not found"
+ ERRORS=$((ERRORS + 1))
+ return 1
+ fi
+}
+
check_no_embedded_pipelinespec() {
local file="$1"
local filepath="${TEKTON_DIR}/${file}"
- if [ ! -f "${filepath}" ]; then
- echo "WARNING: ${file} not found, skipping"
- return
- fi
+ check_file_exists "${file}" || return
if grep -q "pipelineSpec:" "${filepath}"; then
@@
check_arm64_in_build_platforms() {
local file="$1"
local filepath="${TEKTON_DIR}/${file}"
- if [ ! -f "${filepath}" ]; then
- echo "WARNING: ${file} not found, skipping"
- return
- fi
+ check_file_exists "${file}" || return
if ! grep -q "linux/arm64" "${filepath}"; thenAlso applies to: 26-29, 59-62
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.ci/validate-tekton-pipelines.sh around lines 13 - 20, The script defines an
explicit allowlist PIPELINERUN_FILES but currently only emits a warning and
returns when a tracked PipelineRun file is missing; change those early-return
warning branches to fail the script with a non-zero exit (use echo to STDERR and
exit 1) so a missing or renamed entry fails CI; update the two validation spots
that currently "warn and return" (the checks that iterate PIPELINERUN_FILES and
the duplicate/coverage check) to emit a clear error message and exit 1 instead
of returning success.
Comment on lines
+366
to
+372
| .PHONY: pr-check check-image-build release-image validate-tekton | ||
| # TODO: Add golang build/tests here (onboard project to boilerplate?) | ||
| pr-check: check-image-build | ||
| pr-check: validate-tekton check-image-build | ||
|
|
||
| validate-tekton: | ||
| @echo "Validating .tekton/ pipeline configuration..." | ||
| @bash .ci/validate-tekton-pipelines.sh |
There was a problem hiding this comment.
validate-tekton is not actually standalone yet.
Line 370 adds a lightweight validation target, but Make still evaluates the global toolchain checks at Lines 5-14 before target selection. On any runner without go or podman/docker, make validate-tekton aborts before this script runs, which defeats the new guardrail’s intended standalone check. Please move those checks behind build-only prereqs or gate them by MAKECMDGOALS.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@Makefile` around lines 366 - 372, The global toolchain pre-checks are being
evaluated before Make selects targets, so running the new validate-tekton target
still fails on machines without go/podman/docker; update the Makefile so those
checks are only run for build/image targets by either moving the toolchain
checks into the build-only prerequisites (e.g., tie them to
check-image-build/pr-check) or guard their execution with a MAKECMDGOALS
conditional that skips them when MAKECMDGOALS contains validate-tekton, and
ensure the validate-tekton target (and pr-check if intended) can run standalone
without triggering the global checks.
Contributor
|
/lgtm Good catch! |
Contributor
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: clcollins, iamkirkbater The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
pipelineSpecback to lightweightpipelineRefstyle (restoring Kirk Bater's original design from PR updates tekton builds for all targets #461)linux/arm64in micro'sbuild-platforms(matching minimal and full).ci/validate-tekton-pipelines.sh) that fails if any PipelineRun file has itspipelineRefreplaced with an embeddedpipelineSpecor iflinux/arm64is removed frombuild-platformsBackground
On 2026-03-12, the Konflux bot (
red-hat-konflux-kflux-prd-rh03) silently replaced micro'spipelineRefwith a 626-line embeddedpipelineSpecin PR #488 (commit a8458a1), stripping arm64 support. The PR was auto-merged in 2 seconds with no human review. The bot had also previously nudged minimal and full, but Kirk reverted those within hours — micro's nudge was never reverted.See investigation details on ROSAENG-3945.
Changes
.tekton/ocm-container-micro-push.yaml.tekton/ocm-container-micro-pull-request.yaml.ci/validate-tekton-pipelines.shMakefilevalidate-tektontarget, wired intopr-checkTest plan
make validate-tektonpassespodman manifest inspect quay.io/redhat-services-prod/openshift/ocm-container-micro:latestshows both architectures🤖 Generated with Claude Code
Summary by CodeRabbit