Tekton: Fix git-clone task reference #1086
Conversation
📝 WalkthroughWalkthroughThe PipelineRun in .tekton/release.yaml changes the fetch-repository task reference from a named taskRef (git-clone) to a bundles resolver with params specifying the task name, bundle image (with digest), and kind. No other parts of the file are modified. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
participant PR as PipelineRun
participant PS as pipelineSpec
participant R as Resolver (bundles)
participant B as Bundle Image (task-git-clone@sha256:...)
participant T as Task (git-clone)
PR->>PS: Start fetch-repository
PS->>R: Resolve task via bundles (name=git-clone, kind=task, bundle=...)
R->>B: Fetch task definition
B-->>R: Return task payload
R-->>PS: Resolved task spec
PS->>T: Execute git-clone task
T-->>PS: Task results
PS-->>PR: Continue pipeline
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Tip 🔌 Remote MCP (Model Context Protocol) integration is now available!Pro plan users can now connect to remote MCP servers from the Integrations page. Connect with popular remote MCPs such as Notion and Linear to add more context to your reviews and chats. ✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (5)
.tekton/release.yaml (1)
22-29: Good switch to bundles resolver with a pinned digest.Supply-chain friendly; deterministic task resolution.
Follow-ups:
- The annotation pipelinesascode.tekton.dev/task: "[git-clone]" still references a named task but the Pipeline now uses a bundles resolver. Please confirm whether PAC still requires/uses this annotation; if not, drop it to avoid confusion.
You can update annotations like so (outside this hunk):
metadata: annotations: pipelinesascode.tekton.dev/max-keep-runs: "3" pipelinesascode.tekton.dev/on-event: "[push]" pipelinesascode.tekton.dev/on-target-branch: "[refs/tags/*]" # pipelinesascode.tekton.dev/task: "[git-clone]" # remove if unnecessary
- Consider also pinning the slack-webhook-notification task bundle with a digest for parity.
Example (outside this hunk):
finally: - name: slack-webhook-notification taskRef: resolver: bundles params: - name: name value: slack-webhook-notification - name: bundle value: quay.io/konflux-ci/tekton-catalog/task-slack-webhook-notification:0.1@sha256:<digest> - name: kind value: task.github/workflows/gating.yaml (4)
28-30: Log and verify the system nox version to catch distro lag issues.Apt nox can lag behind PyPI; surface the exact version in CI logs.
Apply this inline tweak:
apt-get update apt-get install --no-install-recommends --no-install-suggests -y git nox +noxtmp="$(nox --version || true)"; echo "nox: ${noxtmp}"
62-64: Align venv prerequisites across jobs or confirm they’re unnecessary.You install python3-venv here but not in “Unit tests”. If any nox session uses venv (not virtualenv), tests may fail intermittently. Either add python3-venv in tests as well, or confirm all sessions rely solely on virtualenv.
Suggested change in the tests job (outside this hunk):
- apt-get install --no-install-recommends --no-install-suggests -y git nox + apt-get install --no-install-recommends --no-install-suggests -y git nox python3-venv
111-115: Surface nox version in the build-image job for traceability.Small addition to help diagnose env drifts on runners.
sudo apt-get update sudo apt-get install --no-install-recommends --no-install-suggests -y createrepo-c nox +noxtmp="$(nox --version || true)"; echo "nox: ${noxtmp}"
183-184: Pre-flight check: confirm nox is on PATH before integration tests.Avoids opaque failures if nox isn’t installed as expected on the VM.
git config --global --add safe.directory "*" +nox --version nox -s integration-tests
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (2)
.github/workflows/gating.yaml(4 hunks).tekton/release.yaml(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Build container image and run integration tests on it
- GitHub Check: Konflux kflux-prd-rh03 / on-pull-request
eskultety
left a comment
There was a problem hiding this comment.
ACK to commit 2 (as a temporary fix), I'm personally not so much in favour of commit 1.
Let's explicitly link the git clone task to (hopefully) prevent recent issues with releasing new version of our image. Signed-off-by: Michal Šoltis <msoltis@redhat.com>
There was a problem hiding this comment.
Actionable comments posted: 0
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (3)
.tekton/release.yaml (3)
98-105: Pin slack-webhook-notification bundle by digest for consistency.The git-clone task is digest-pinned; do the same here to avoid tag drift.
- - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-slack-webhook-notification:0.1 + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-slack-webhook-notification:0.1@sha256:<digest>
65-66: Fix git fetch flag: use --tags (not --tag).Current command likely ignores/fails to fetch tags, breaking the version discovery.
- git fetch --tag -v + git fetch --tags -v
72-77: SemVer regex limits major to a single digit.This rejects versions like 10.2.0. Expand the major group.
- if [[ $version =~ ^([0-9])\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then + if [[ $version =~ ^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then
🧹 Nitpick comments (2)
.tekton/release.yaml (2)
9-9: Remove redundant Pipelines-as-Code task annotation.Now that git-clone is resolved via bundles inside the spec, this PaC annotation is unnecessary and can confuse future readers.
- pipelinesascode.tekton.dev/task: "[git-clone]"
91-94: Preserve multi-arch and add resiliency for image retag.If the source tag is a manifest list, include all architectures; add retries for transient registry errors.
- skopeo copy docker://quay.io/konflux-ci/hermeto:$PARAM_REVISION \ - docker://quay.io/konflux-ci/hermeto:$version + skopeo copy --all --retry-times 3 \ + docker://quay.io/konflux-ci/hermeto:$PARAM_REVISION \ + docker://quay.io/konflux-ci/hermeto:$version
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
.tekton/release.yaml(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Build container image and run integration tests on it
- GitHub Check: Konflux kflux-prd-rh03 / on-pull-request
🔇 Additional comments (1)
.tekton/release.yaml (1)
22-29: Bundle-based taskRef with digest pinning — good supply‑chain hardening.Using resolver: bundles and pinning git-clone by digest improves reproducibility and integrity. No issues spotted with params.
Maintainers will complete the following section
Note: if the contribution is external (not from an organization member), the CI
pipeline will not run automatically. After verifying that the CI is safe to run:
/ok-to-test(as is the standard for Pipelines as Code)