[KONFLUX-13286] Replace appstudio-utils image with task-runner#3316
[KONFLUX-13286] Replace appstudio-utils image with task-runner#3316jsmid1 wants to merge 1 commit into
Conversation
📝 WalkthroughWalkthroughThis PR standardizes Tekton runner images: the HACBS example switches to ChangesContainer image reference updates
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@release/cli.yaml`:
- Line 94: Replace every mutable image reference
"quay.io/konflux-ci/task-runner:v1" with the digest-pinned form
"quay.io/konflux-ci/task-runner@sha256:<approved-digest>" so the release steps
are immutable; update all occurrences of that image string in the manifest (the
entries currently using :v1) to use the approved sha256 digest and ensure the
exact approved digest is used consistently across the release steps.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: 32ed78f5-978c-4827-b6df-eb6de30eb0d6
📒 Files selected for processing (2)
pkg/schema/examples/hacbs2_valid.jsonrelease/cli.yaml
| - $(results.cli-snapshot-spec.path) | ||
| - $(results.bundle-snapshot-spec.path) | ||
| image: quay.io/konflux-ci/appstudio-utils:latest | ||
| image: quay.io/konflux-ci/task-runner:v1 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify whether task-runner references in release pipeline are digest-pinned.
# Expected: task-runner references exist, but none are pinned with `@sha256` in current PR state.
rg -n 'image:\s*quay\.io/konflux-ci/task-runner' release/cli.yaml
rg -n 'image:\s*quay\.io/konflux-ci/task-runner@sha256:' release/cli.yamlRepository: conforma/cli
Length of output: 320
Pin task-runner references by digest in release steps.
Lines 94, 184, 190, 203, and 210 use the mutable tag :v1, which allows unreviewed image drift in the release pipeline and weakens supply-chain guarantees. Pin each reference to a specific digest instead:
image: quay.io/konflux-ci/task-runner@sha256:<approved-digest>
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@release/cli.yaml` at line 94, Replace every mutable image reference
"quay.io/konflux-ci/task-runner:v1" with the digest-pinned form
"quay.io/konflux-ci/task-runner@sha256:<approved-digest>" so the release steps
are immutable; update all occurrences of that image string in the manifest (the
entries currently using :v1) to use the approved sha256 digest and ensure the
exact approved digest is used consistently across the release steps.
Codecov Report✅ All modified and coverable lines are covered by tests.
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
The appstudio-utils image is being decommissioned. Replace all references with the task-runner image. Signed-off-by: Jan Smid <jsmid@redhat.com>
There was a problem hiding this comment.
♻️ Duplicate comments (1)
release/cli.yaml (1)
94-94:⚠️ Potential issue | 🔴 Critical | 🏗️ Heavy liftPin
task-runnerreferences by digest in release steps.Lines 94, 184, 190, 203, and 210 use the mutable tag
:v1, which allows unreviewed image drift in the release pipeline and weakens supply-chain guarantees. Pin each reference to a specific digest instead.Run the following script to retrieve the current digest for
task-runner:v1and verify the image exists:#!/bin/bash # Verify task-runner:v1 image exists and get its current digest for pinning echo "Checking if quay.io/konflux-ci/task-runner:v1 exists and retrieving digest..." skopeo inspect docker://quay.io/konflux-ci/task-runner:v1 | jq -r '.Digest' echo "" echo "To pin by digest, replace 'quay.io/konflux-ci/task-runner:v1' with:" echo "quay.io/konflux-ci/task-runner@sha256:<digest-from-above>" echo "" echo "Checking for any known vulnerabilities..." gh api graphql -f query=' { securityVulnerabilities(first: 5, ecosystem: CONTAINER, package: "konflux-ci/task-runner") { nodes { advisory { summary severity publishedAt } vulnerableVersionRange } } }'🔒 Recommended fix to pin by digest
After retrieving the digest from the verification script above, apply this pattern to all five occurrences:
- image: quay.io/konflux-ci/task-runner:v1 + image: quay.io/konflux-ci/task-runner@sha256:<digest>Apply to lines: 94, 184, 190, 203, 210
Also applies to: 184-184, 190-190, 203-203, 210-210
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@release/cli.yaml` at line 94, Replace all mutable task-runner image tags "quay.io/konflux-ci/task-runner:v1" with an immutable digest-pinned form "quay.io/konflux-ci/task-runner@sha256:<digest>" in release/cli.yaml wherever that exact tag appears (the five occurrences of the same string), by first obtaining the current digest (e.g., via skopeo inspect or your registry tooling) and then performing a find-and-replace of "quay.io/konflux-ci/task-runner:v1" -> "quay.io/konflux-ci/task-runner@sha256:<digest>" so every image reference (the string "quay.io/konflux-ci/task-runner:v1") is replaced with the digest-pinned URI.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In `@release/cli.yaml`:
- Line 94: Replace all mutable task-runner image tags
"quay.io/konflux-ci/task-runner:v1" with an immutable digest-pinned form
"quay.io/konflux-ci/task-runner@sha256:<digest>" in release/cli.yaml wherever
that exact tag appears (the five occurrences of the same string), by first
obtaining the current digest (e.g., via skopeo inspect or your registry tooling)
and then performing a find-and-replace of "quay.io/konflux-ci/task-runner:v1" ->
"quay.io/konflux-ci/task-runner@sha256:<digest>" so every image reference (the
string "quay.io/konflux-ci/task-runner:v1") is replaced with the digest-pinned
URI.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: 4940a0e2-fa62-4f8d-8b83-954459e1aa2d
📒 Files selected for processing (2)
pkg/schema/examples/hacbs2_valid.jsonrelease/cli.yaml
1 participant
Summary
appstudio-utilsimage is being decommissioned ,task-runneris the replacement.quay.io/konflux-ci/appstudio-utils:latestwithquay.io/konflux-ci/task-runner:v1inrelease/cli.yamlpkg/schema/examples/hacbs2_valid.jsonso it won't be flagged by image deprecation scans.Issue: KONFLUX-13286