Skip to content

SPLAT-2837: Add fbc build pipeline - #76

Open
AnnaZivkovic wants to merge 1 commit into
openshift:mainfrom
AnnaZivkovic:add-fbc-pipeline
Open

SPLAT-2837: Add fbc build pipeline#76
AnnaZivkovic wants to merge 1 commit into
openshift:mainfrom
AnnaZivkovic:add-fbc-pipeline

Conversation

@AnnaZivkovic

@AnnaZivkovic AnnaZivkovic commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

Summary by CodeRabbit

  • New Features
    • Added a new build pipeline for File-Based Catalog images.
    • Supports configurable source, build, and image-tag options, including multi-platform builds.
    • Generates build outputs and commit information for downstream use.
    • Includes optional validation and image-check steps, with controls to skip checks when needed.

@openshift-ci-robot

openshift-ci-robot commented Jul 7, 2026

Copy link
Copy Markdown

@AnnaZivkovic: This pull request references SPLAT-2837 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jul 7, 2026
@openshift-ci
openshift-ci Bot requested review from rvanderp3 and vr4manta July 7, 2026 22:45
@openshift-ci

openshift-ci Bot commented Jul 7, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: AnnaZivkovic

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 7, 2026
@coderabbitai

coderabbitai Bot commented Jul 7, 2026

Copy link
Copy Markdown

Walkthrough

This PR adds a new Tekton Pipeline definition, fbc-build-pipeline, in .tekton/fbc-build-pipeline.yaml. It defines parameters, results, a task chain for cloning, building, and indexing multi-platform images, conditional validation/tagging steps, and optional workspaces.

Changes

FBC Build Pipeline Definition

Layer / File(s) Summary
Pipeline metadata, params, and results
.tekton/fbc-build-pipeline.yaml
Defines Pipeline apiVersion, kind, metadata name, description, params (git source, build/image options, platforms, build args, proxy/caching toggles), and results for image URL/digest and repo URL/commit.
Core build task chain
.tekton/fbc-build-pipeline.yaml
Defines init, clone-repository, run-opm-command, prefetch-dependencies, and a matrixed buildah-remote-oci-ta step building per-platform images.
Image indexing and conditional checks
.tekton/fbc-build-pipeline.yaml
Adds build-image-index, deprecated-base-image-check, apply-tags, validate-fbc, fbc-target-index-pruning-check, and fbc-fips-check-oci-ta, several conditioned on skip-checks.
Workspaces declaration
.tekton/fbc-build-pipeline.yaml
Declares optional git-auth and netrc workspaces.

Estimated code review effort: 2 (Simple) | ~15 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Init
  participant CloneRepository
  participant RunOpmCommand
  participant PrefetchDependencies
  participant BuildTask as BuildahRemoteOciTa
  participant BuildImageIndex
  participant ChecksAndTags

  Init->>CloneRepository: clone repo into OCI storage
  CloneRepository->>RunOpmCommand: generate source artifacts
  RunOpmCommand->>PrefetchDependencies: prefetch dependencies
  PrefetchDependencies->>BuildTask: build per-platform images (matrix)
  BuildTask->>BuildImageIndex: aggregate images into index
  BuildImageIndex->>ChecksAndTags: run deprecated-base-image-check, apply-tags, validate-fbc, pruning-check, fips-check (guarded by skip-checks)
Loading

Related PRs: None found.

Suggested labels: tekton, ci/cd

Suggested reviewers: None found.

🚥 Pre-merge checks | ✅ 15
✅ Passed checks (15 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly matches the main change: adding a new FBC build pipeline.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed PR only adds a Tekton pipeline YAML; no Ginkgo test files or test titles were added or modified.
Test Structure And Quality ✅ Passed Only .tekton/fbc-build-pipeline.yaml changed; no Ginkgo test code or test-quality issues are in scope.
Microshift Test Compatibility ✅ Passed PR changes only add a Tekton Pipeline YAML; no Ginkgo e2e tests or test files were added, so MicroShift compatibility check is not applicable.
Single Node Openshift (Sno) Test Compatibility ✅ Passed Only a Tekton Pipeline YAML changed; no new Ginkgo e2e tests or SNO-sensitive test logic were added.
Topology-Aware Scheduling Compatibility ✅ Passed The PR only adds a Tekton Pipeline and contains no replicas, affinity, topology spread, selectors, or tolerations that affect workload scheduling.
Ote Binary Stdout Contract ✅ Passed Only a Tekton YAML pipeline was added; no process-level binary code or stdout writes were touched.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed PASS: The only added file is a Tekton Pipeline YAML, not a Ginkgo e2e test, and it has no It/Describe/Context/When or IPv4-only test logic.
No-Weak-Crypto ✅ Passed The new pipeline has no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB or custom crypto code; only sha256 image digests and an FIPS check task.
Container-Privileges ✅ Passed PASS: The only changed manifest is the new Tekton Pipeline, and it contains no privileged/host*/capabilities/allowPrivilegeEscalation/securityContext fields.
No-Sensitive-Data-In-Logs ✅ Passed The new pipeline contains no script/echo/log statements; secrets are only passed as workspaces/params, not logged.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🧹 Nitpick comments (1)
.tekton/fbc-build-pipeline.yaml (1)

56-58: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Missing explicit type on enable-cache-proxy param.

Every other param declares type: string/array explicitly; this one omits it. Tekton defaults to string, so it's functionally fine, but the inconsistency is worth tidying.

♻️ Proposed fix
   - default: "false"
     description: Enable cache proxy configuration
     name: enable-cache-proxy
+    type: string
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.tekton/fbc-build-pipeline.yaml around lines 56 - 58, The enable-cache-proxy
parameter in the Tekton pipeline is missing an explicit type, unlike the other
params. Update the parameter definition in the pipeline spec to include type:
string for enable-cache-proxy so it matches the surrounding parameter
declarations and stays consistent with the rest of the config.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.tekton/fbc-build-pipeline.yaml:
- Around line 67-75: The build-platforms parameter default in the Tekton
pipeline is currently missing linux/amd64 and still includes unsupported non-x86
targets. Update the build-platforms default in the pipeline definition to use
only linux/amd64, and ensure any related PipelineRun or parameter overrides that
reference build-platforms are aligned with that amd64-only constraint.

---

Nitpick comments:
In @.tekton/fbc-build-pipeline.yaml:
- Around line 56-58: The enable-cache-proxy parameter in the Tekton pipeline is
missing an explicit type, unlike the other params. Update the parameter
definition in the pipeline spec to include type: string for enable-cache-proxy
so it matches the surrounding parameter declarations and stays consistent with
the rest of the config.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: c0d393bf-4695-4dc4-bd49-ef261e2876e2

📥 Commits

Reviewing files that changed from the base of the PR and between fe2dba5 and ed3f8a3.

📒 Files selected for processing (1)
  • .tekton/fbc-build-pipeline.yaml

Comment on lines +67 to +75
- default:
- localhost
- linux/arm64
- linux/ppc64le
- linux/s390x
description: List of platforms to build the container images on. The available
set of values is determined by the configuration of the multi-platform-controller.
name: build-platforms
type: array

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win

build-platforms default omits linux/amd64 and includes disallowed non-x86 platforms.

This repo targets vSphere/amd64 only. The default list here has no linux/amd64 entry and instead builds linux/arm64, linux/ppc64le, and linux/s390x.

🛠️ Proposed fix
   - default:
     - localhost
-    - linux/arm64
-    - linux/ppc64le
-    - linux/s390x
+    - linux/amd64
     description: List of platforms to build the container images on. The available
       set of values is determined by the configuration of the multi-platform-controller.
     name: build-platforms
     type: array

Based on learnings, "any Tekton PipelineRun in this repo that defines/sets the build-platforms parameter must restrict it to linux/amd64 only. Do not include non-x86 platforms".

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- default:
- localhost
- linux/arm64
- linux/ppc64le
- linux/s390x
description: List of platforms to build the container images on. The available
set of values is determined by the configuration of the multi-platform-controller.
name: build-platforms
type: array
- default:
- localhost
- linux/amd64
description: List of platforms to build the container images on. The available
set of values is determined by the configuration of the multi-platform-controller.
name: build-platforms
type: array
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.tekton/fbc-build-pipeline.yaml around lines 67 - 75, The build-platforms
parameter default in the Tekton pipeline is currently missing linux/amd64 and
still includes unsupported non-x86 targets. Update the build-platforms default
in the pipeline definition to use only linux/amd64, and ensure any related
PipelineRun or parameter overrides that reference build-platforms are aligned
with that amd64-only constraint.

Source: Learnings

@openshift-ci

openshift-ci Bot commented Jul 7, 2026

Copy link
Copy Markdown

@AnnaZivkovic: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants