Skip to content

DPTP-3787: promotion: unify ocp quay promotion; drop consolidation and -quay suffix#5233

Open
deepsm007 wants to merge 1 commit into
openshift:mainfrom
deepsm007:revert/consolidated-quay-promotion
Open

DPTP-3787: promotion: unify ocp quay promotion; drop consolidation and -quay suffix#5233
deepsm007 wants to merge 1 commit into
openshift:mainfrom
deepsm007:revert/consolidated-quay-promotion

Conversation

@deepsm007

@deepsm007 deepsm007 commented Jun 3, 2026

Copy link
Copy Markdown
Contributor

/cc @openshift/test-platform

/hold

This PR simplifies OpenShift image promotion in ci-operator by removing the old “consolidated quay promotion” split and making promotion behavior depend on whether a target refers to an official OCP/OKD image stream.

Practically, CI promotion now uses a single promotion path for official images, while Quay-specific behavior is driven by image namespace/tag detection instead of version-based consolidation checks. That means:

  • promotion destination selection is now based on whether the image is an official release image
  • Quay proxy tag resolution now uses the new ocp/<name>:<tag> style instead of -quay suffixed keys
  • release payload creation and image snapshot resolution now follow the unified official-image logic
  • retry/error logging in promotion scripts was updated to the new promotion: prefix

The PR also removes obsolete helpers tied to consolidated promotion and updates tests/fixtures across promotion, release, and image-resolution code to match the new naming and selection behavior.

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: automatic mode

@openshift-ci openshift-ci Bot requested a review from a team June 3, 2026 21:54
@openshift-ci openshift-ci Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jun 3, 2026
@coderabbitai

coderabbitai Bot commented Jun 3, 2026

Copy link
Copy Markdown

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review
ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 643b4331-5fac-46fe-b810-ecbc697f53bb

📥 Commits

Reviewing files that changed from the base of the PR and between 19a1202 and 145f1b0.

📒 Files selected for processing (16)
  • pkg/api/promotion.go
  • pkg/api/promotion_test.go
  • pkg/defaults/defaults.go
  • pkg/defaults/defaults_test.go
  • pkg/steps/input_image_tag_test.go
  • pkg/steps/release/create_release.go
  • pkg/steps/release/create_release_test.go
  • pkg/steps/release/promote.go
  • pkg/steps/release/promote_test.go
  • pkg/steps/release/snapshot.go
  • pkg/steps/release/snapshot_test.go
  • pkg/steps/release/testdata/zz_fixture_TestGetQuayPromotionShell_promotion_quay_4.12.yaml
  • pkg/steps/release/testdata/zz_fixture_TestGetQuayPromotionShell_promotion_quay_multiple_tags.yaml
  • pkg/steps/release/testdata/zz_fixture_TestGetQuayPromotionShell_promotion_quay_non_release_namespace.yaml
  • pkg/steps/utils/image.go
  • pkg/steps/utils/image_test.go
🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

  • openshift/release (manual)
  • openshift/ci-docs (manual)
  • openshift/release-controller (manual)
  • openshift/ci-chat-bot (manual)
✅ Files skipped from review due to trivial changes (3)
  • pkg/steps/release/testdata/zz_fixture_TestGetQuayPromotionShell_promotion_quay_non_release_namespace.yaml
  • pkg/steps/release/testdata/zz_fixture_TestGetQuayPromotionShell_promotion_quay_multiple_tags.yaml
  • pkg/steps/release/testdata/zz_fixture_TestGetQuayPromotionShell_promotion_quay_4.12.yaml
🚧 Files skipped from review as they are similar to previous changes (6)
  • pkg/steps/utils/image_test.go
  • pkg/steps/release/create_release.go
  • pkg/defaults/defaults.go
  • pkg/defaults/defaults_test.go
  • pkg/steps/release/create_release_test.go
  • pkg/api/promotion.go

📝 Walkthrough

Walkthrough

The PR updates Quay proxy key formatting, switches several promotion and image-resolution checks to official-image predicates, changes release command generation to prefer image-stream files, and adjusts related tests and retry-shell log output.

Changes

Official image promotion rewrite

Layer / File(s) Summary
Quay proxy target formatting
pkg/api/promotion.go, pkg/api/promotion_test.go
getQuayProxyTarget now formats named tags as namespace/name:tag, parses QuayOpenShiftCIRepo: targets with underscore-based patterns, and the mirror tests expect the new keys.
Promotion path selection
pkg/defaults/defaults.go, pkg/defaults/defaults_test.go
fromConfig switches the Quay promotion branch check to PromotesOfficialImages(..., WithoutOKD), and the OCP cases in the defaults test expect only the Quay promotion post step.
Official image resolution
pkg/steps/release/snapshot.go, pkg/steps/release/snapshot_test.go, pkg/steps/utils/image.go, pkg/steps/utils/image_test.go, pkg/steps/input_image_tag_test.go
snapshotImportSource and ResolveOfficialInputFrom now gate on RefersToOfficialImage(..., WithoutOKD), and the related tests update OCP, stable-stream, and Quay reference expectations.
Release command assembly
pkg/steps/release/create_release.go, pkg/steps/release/create_release_test.go
buildOcAdmReleaseNewCommand now always assembles a shell snippet that exports an imagestream to YAML and uses --from-image-stream-file when available; the test expects --reference-mode=source.
Promotion shell and tag parsing
pkg/steps/release/promote.go, pkg/steps/release/promote_test.go, pkg/steps/release/testdata/zz_fixture_*.yaml
quayProxyTagFromISKey accepts ocp/<version>:<tag> keys through RefersToOfficialImage(..., WithOKD), getResolveAndTagRetryShell changes the retry log prefix to promotion, and the tests and fixtures update the expected keys and log output.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Possibly related PRs

  • openshift/ci-tools#4866: Updates Quay proxy and promotion naming logic by removing legacy -quay key construction.
  • openshift/ci-tools#5255: Changes the same Quay promotion shell path and retry/logging behavior in pkg/steps/release/promote.go.

Suggested reviewers

  • danilo-gemoli
🚥 Pre-merge checks | ✅ 15 | ❌ 2

❌ Failed checks (2 warnings)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 18.18% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
Test Coverage For New Features ⚠️ Warning The new getQuayProxyTarget branch for <tag.Tag>_-prefixed remainders isn’t exercised by any test; current tables cover only the other branch and fallback. Add a table-driven QuayCombinedMirrorFunc case that drives the <tag.Tag>_ remainder path and asserts the resulting namespace/tag:component key.
✅ Passed checks (15 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately summarizes the main change: unifying OCP Quay promotion and removing consolidation and -quay suffixing.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Go Error Handling ✅ Passed No new panic paths or unchecked Go errors; changed functions either wrap errors with %w or intentionally return nil,false,nil when not applicable.
Stable And Deterministic Test Names ✅ Passed Reviewed the edited test tables: all titles are static strings, with no runtime-derived names or concatenation; versioned labels are fixed scenario names.
Test Structure And Quality ✅ Passed PASS: The changed tests are plain table-driven unit tests, not Ginkgo; they use fake clients and deterministic assertions, with no cluster waits or cleanup gaps.
Microshift Test Compatibility ✅ Passed No new Ginkgo e2e tests were added; the touched files are plain Go unit tests with no It/Describe/Context/When or MicroShift-sensitive runtime behavior.
Single Node Openshift (Sno) Test Compatibility ✅ Passed Touched tests are standard unit tests; no new Ginkgo e2e specs or SNO-unsafe assumptions were added.
Topology-Aware Scheduling Compatibility ✅ Passed Touched files only adjust promotion/image-resolution logic and logging; no new pod affinity, topology spread, node selectors, or replica logic were added.
Ote Binary Stdout Contract ✅ Passed No touched main/TestMain/BeforeSuite code writes stdout; the only init() blocks just register schemes and print nothing.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed No new Ginkgo e2e specs were added; the touched tests are plain Test... unit tests, so the IPv4/public-network check is not applicable.
No-Weak-Crypto ✅ Passed No MD5/SHA1/DES/RC4/3DES/Blowfish/ECB or custom crypto code appears in touched files; no secret/token comparisons were added.
Container-Privileges ✅ Passed Touched files are Go/tests/fixtures only; no changed manifest or pod spec sets privileged, hostPID/Network/IPC, SYS_ADMIN, allowPrivilegeEscalation, or root.
No-Sensitive-Data-In-Logs ✅ Passed Changed logs only emit image/tag identifiers and retry messages; no passwords, tokens, PII, session IDs, or customer data are logged.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@openshift-ci

openshift-ci Bot commented Jun 3, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: deepsm007

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 3, 2026

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (2)
pkg/api/promotion.go (1)

116-132: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Fallback rewrites tag-based proxy destinations to the wrong ISTag.

For targets like quay.io/openshift/ci:ocp_ovn-kubernetes_latest, this parse falls through and Line 132 emits ocp/ovn-kubernetes:ovn-kubernetes. That drops the configured promotion tag (latest) and sends the quay-proxy tag to a different destination than the normal registry promotion path. Please preserve the suffix encoded in target, or pass the configured promotion tag explicitly instead of defaulting to tag.Tag.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/api/promotion.go` around lines 116 - 132, The fallback return builds the
ISTag using tag.Tag (producing e.g. "ocp/ovn-kubernetes:ovn-kubernetes") which
drops the suffix encoded in target; change the fallback logic in the tag-based
promotion parsing (the block using variables target, targetParts, tagPart,
tagSuffix, targetNamespace, targetComponent) to preserve the suffix from the
original target string (e.g. the "_latest" part) or to explicitly use the
configured promotion suffix parsed from target (not tag.Tag) when constructing
the final fmt.Sprintf("%s/%s:%s"); ensure the code extracts and passes that
suffix (or full right-hand portion after the colon) into the returned ISTag
instead of defaulting to tag.Tag.
pkg/steps/utils/image.go (1)

89-103: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Keep the stable shortcut version-aware.

This now rewrites any official ocp/<stream>:<tag> to jobNamespace/stable:<tag> whenever stable has that tag. For versioned inputs like ocp/5.0:cli, that can silently pull the current stable payload instead of the requested stream. Please keep the stable fast-path behind a stream/version check and add a regression test where stable:cli exists but the requested base is a different official stream.

As per coding guidelines, "New or modified functionality should include test coverage. Bug fixes should include a regression test that fails without the fix."

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/steps/utils/image.go` around lines 89 - 103, The stable-image fast-path
currently rewrites any official image (base) to jobNamespace/stable:<tag>
whenever that tag exists; restrict this by only taking the stable shortcut when
the requested base actually refers to the same "stable" stream/version: in the
block using api.RefersToOfficialImage, add a guard that the base's stream equals
api.StableImageStream (or otherwise confirms the requested stream/version
matches the stable stream) before returning the ImageStreamTag from stable; keep
the existing ResolvePullSpec logic and error handling but skip the shortcut when
base is a versioned/other official stream (e.g., ocp/5.0:cli), and add a
regression test that creates stable:cli but requests ocp/5.0:cli to assert the
code does not rewrite to jobNamespace/stable:cli.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@pkg/api/promotion.go`:
- Around line 116-132: The fallback return builds the ISTag using tag.Tag
(producing e.g. "ocp/ovn-kubernetes:ovn-kubernetes") which drops the suffix
encoded in target; change the fallback logic in the tag-based promotion parsing
(the block using variables target, targetParts, tagPart, tagSuffix,
targetNamespace, targetComponent) to preserve the suffix from the original
target string (e.g. the "_latest" part) or to explicitly use the configured
promotion suffix parsed from target (not tag.Tag) when constructing the final
fmt.Sprintf("%s/%s:%s"); ensure the code extracts and passes that suffix (or
full right-hand portion after the colon) into the returned ISTag instead of
defaulting to tag.Tag.

In `@pkg/steps/utils/image.go`:
- Around line 89-103: The stable-image fast-path currently rewrites any official
image (base) to jobNamespace/stable:<tag> whenever that tag exists; restrict
this by only taking the stable shortcut when the requested base actually refers
to the same "stable" stream/version: in the block using
api.RefersToOfficialImage, add a guard that the base's stream equals
api.StableImageStream (or otherwise confirms the requested stream/version
matches the stable stream) before returning the ImageStreamTag from stable; keep
the existing ResolvePullSpec logic and error handling but skip the shortcut when
base is a versioned/other official stream (e.g., ocp/5.0:cli), and add a
regression test that creates stable:cli but requests ocp/5.0:cli to assert the
code does not rewrite to jobNamespace/stable:cli.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 00289a20-81ca-425d-bc71-e6b805920291

📥 Commits

Reviewing files that changed from the base of the PR and between f99d129 and 5010fbf.

📒 Files selected for processing (17)
  • pkg/api/promotion.go
  • pkg/api/promotion_test.go
  • pkg/defaults/defaults.go
  • pkg/defaults/defaults_test.go
  • pkg/steps/input_image_tag_test.go
  • pkg/steps/release/create_release.go
  • pkg/steps/release/create_release_test.go
  • pkg/steps/release/promote.go
  • pkg/steps/release/promote_test.go
  • pkg/steps/release/snapshot.go
  • pkg/steps/release/snapshot_test.go
  • pkg/steps/release/testdata/zz_fixture_TestGetPromotionPod_promotion_quay.yaml
  • pkg/steps/release/testdata/zz_fixture_TestGetPromotionPod_promotion_quay_4.12.yaml
  • pkg/steps/release/testdata/zz_fixture_TestGetPromotionPod_promotion_quay_multiple_tags.yaml
  • pkg/steps/release/testdata/zz_fixture_TestGetPromotionPod_promotion_quay_non_release_namespace.yaml
  • pkg/steps/utils/image.go
  • pkg/steps/utils/image_test.go
💤 Files with no reviewable changes (1)
  • pkg/steps/release/create_release.go

@deepsm007 deepsm007 changed the title promotion: unify ocp quay promotion; drop consolidation and -quay suffix DPTP-3787: promotion: unify ocp quay promotion; drop consolidation and -quay suffix Jun 3, 2026
@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jun 3, 2026
@openshift-ci-robot

openshift-ci-robot commented Jun 3, 2026

Copy link
Copy Markdown
Contributor

@deepsm007: This pull request references DPTP-3787 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

/cc @openshift/test-platform

/hold

Unify OCP Quay Promotion and Remove Consolidation Logic

This PR consolidates OpenShift's image promotion workflow by removing the "consolidated quay promotion" implementation and unifying all image promotion to use a single promotion step rather than separate [promotion] and [promotion-quay] steps.

Key Changes

Promotion Logic Simplification:

  • Removes the ConsolidatedQuayPromotion(), ConsolidatedQuayPromotionVersion(), and PromotionQuayStepName helpers that previously determined when to use special quay-promotion behavior
  • Consolidates all promotion under a single step named promotion (removing the -quay suffix convention)
  • Changes the promotion destination logic to use PromotesOfficialImages(cfg.CIConfig, api.WithoutOKD): when false, images promote to the default registry; when true (official OCP images), images promote to Quay

Official Image Detection:

  • Replaces checks on ConsolidatedQuayPromotionVersion with the existing RefersToOfficialImage() API to determine when images should be promoted to Quay (when they belong to the ocp or origin namespaces)
  • This unified approach uses the promotion target configuration's namespace rather than special version strings

Affected Components:

  • ci-operator promotion: The promotion step now uniformly handles both Quay and registry targets based on the target namespace rather than configuration version
  • Release payload creation: oc adm release new commands now use a unified --from-image-stream-file approach instead of version-specific branching
  • Image snapshots and resolving: Official image detection relies on namespace checks rather than special version predicates
  • Quay proxy targeting: Updated to directly use namespace/tag information without suffix manipulation logic

Impact for CI Users and Operators

  • Jobs promoting official OCP images will still be promoted to Quay, but now through a single unified promotion step rather than separate mechanisms
  • Simplified configuration: no more dual promotion steps; the promotion destination (Quay vs registry) is determined automatically based on the target's namespace
  • Reduced complexity in ci-operator's promotion logic, making it easier to understand and maintain

Testing Updates

  • Updated test fixtures to reflect the single promotion step name and new logic
  • Quay proxy tag handling tests updated with new namespace-based resolution expectations
  • Default configuration test cases simplified from dual-step promotion to single-step promotion

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@deepsm007 deepsm007 force-pushed the revert/consolidated-quay-promotion branch from 5010fbf to 2b0b091 Compare June 3, 2026 22:58

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/defaults/defaults.go`:
- Around line 306-314: Two promotion steps are created with the same logical
name (api.PromotionStepName) which leads to duplicate Step.Name() values; update
the second call that builds the Quay promotion step (the
releasesteps.PromotionStep invocation that currently passes
api.PromotionStepName and
api.QuayOpenShiftCIRepo/api.QuayCombinedMirrorFunc/api.QuayTargetNameFunc) to
use a distinct step name (for example introduce or use a constant like
api.QuayPromotionStepName or append a "-quay" suffix) so the formatted
Step.Name() differs from the other promotion node; ensure the new name is passed
where the first param (currently api.PromotionStepName) is supplied and run a
quick grep/audit for any code that assumes step-name uniqueness to confirm no
other changes are required.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 466ad4e3-02bd-490b-8c10-53c909a4613d

📥 Commits

Reviewing files that changed from the base of the PR and between 5010fbf and 2b0b091.

📒 Files selected for processing (17)
  • pkg/api/promotion.go
  • pkg/api/promotion_test.go
  • pkg/defaults/defaults.go
  • pkg/defaults/defaults_test.go
  • pkg/steps/input_image_tag_test.go
  • pkg/steps/release/create_release.go
  • pkg/steps/release/create_release_test.go
  • pkg/steps/release/promote.go
  • pkg/steps/release/promote_test.go
  • pkg/steps/release/snapshot.go
  • pkg/steps/release/snapshot_test.go
  • pkg/steps/release/testdata/zz_fixture_TestGetPromotionPod_promotion_quay.yaml
  • pkg/steps/release/testdata/zz_fixture_TestGetPromotionPod_promotion_quay_4.12.yaml
  • pkg/steps/release/testdata/zz_fixture_TestGetPromotionPod_promotion_quay_multiple_tags.yaml
  • pkg/steps/release/testdata/zz_fixture_TestGetPromotionPod_promotion_quay_non_release_namespace.yaml
  • pkg/steps/utils/image.go
  • pkg/steps/utils/image_test.go
💤 Files with no reviewable changes (1)
  • pkg/steps/release/create_release.go
✅ Files skipped from review due to trivial changes (3)
  • pkg/steps/release/snapshot_test.go
  • pkg/steps/release/testdata/zz_fixture_TestGetPromotionPod_promotion_quay_4.12.yaml
  • pkg/steps/release/testdata/zz_fixture_TestGetPromotionPod_promotion_quay.yaml
🚧 Files skipped from review as they are similar to previous changes (10)
  • pkg/steps/release/testdata/zz_fixture_TestGetPromotionPod_promotion_quay_non_release_namespace.yaml
  • pkg/steps/release/snapshot.go
  • pkg/steps/release/create_release_test.go
  • pkg/defaults/defaults_test.go
  • pkg/steps/utils/image.go
  • pkg/api/promotion_test.go
  • pkg/steps/release/testdata/zz_fixture_TestGetPromotionPod_promotion_quay_multiple_tags.yaml
  • pkg/steps/release/promote_test.go
  • pkg/steps/release/promote.go
  • pkg/api/promotion.go

Comment thread pkg/defaults/defaults.go
@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e

@deepsm007

Copy link
Copy Markdown
Contributor Author

/hold

@deepsm007 deepsm007 force-pushed the revert/consolidated-quay-promotion branch 3 times, most recently from 70b83ec to b16fe83 Compare June 4, 2026 01:21

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (2)
pkg/steps/release/promote.go (1)

292-322: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Eligibility logic now keying off ocp/origin (not consolidated stream versions); tests cover -quay + ocp paths but miss origin.

quayProxyTagFromISKey now treats a stream as eligible when api.RefersToOfficialImage(namespace, api.WithOKD) is true (always ocp, and origin when WithOKD) unless streamPart ends with -quay. TestQuayProxyTagFromISKey already covers:

  • legacy -quay suffix inputs (e.g. ocp/4.21-quay:..., ocp/5.0-quay:...)
  • namespace-based non--quay stream inputs (e.g. ocp/4.13:secondary-scheduler-operator)

Add a test for origin/<streamPart>:<tag> where streamPart does not end with -quay to exercise the origin branch.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/steps/release/promote.go` around lines 292 - 322, quayProxyTagFromISKey's
branch that accepts non-`-quay` streams for the `origin` namespace (via
api.RefersToOfficialImage(namespace, api.WithOKD)) is not covered by tests; add
a unit test in TestQuayProxyTagFromISKey that calls quayProxyTagFromISKey with
an input like "origin/<streamPart>:<tag>" where <streamPart> does NOT end with
"-quay", assert the function returns true and the expected formatted tag string
(using api.QCIAPPCIDomain, namespace "origin", the given streamPart and tag),
and ensure the test exercises the origin branch rather than the -quay or failure
paths.
pkg/api/promotion.go (1)

110-141: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Tighten/cover getQuayProxyTarget end-of-function fallback assumptions

  • pkg/api/promotion.go:getQuayProxyTarget already has test coverage for the “tag-based” parsing paths (e.g. ocp/ovn-kubernetes:latest, ocp/ovn-kubernetes:ci_a_latest) via TestQuayCombinedMirrorFunc / QuayCombinedMirrorFunc, so the second parsing branch’s tag.Tag + "_" prefix extraction matches the QuayTargetNameFunc-generated target format.
  • The final fallback (return fmt.Sprintf("%s/%s:%s", tag.Namespace, tag.Tag, tag.Tag)) is not exercised by existing tests; if parsing ever fails to extract the ${suffix} part from target, this fallback would assume the ImageStream name and tag are both tag.Tag, which may not match the intended <component>_<suffix> pattern.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/api/promotion.go` around lines 110 - 141, The final fallback in
getQuayProxyTarget currently assumes the ImageStream name equals tag.Tag, which
is unsafe; change the fallback to extract the component from the original target
(reuse targetParts[1] when available) and use that as the ImageStream name with
tag.Tag as the tag, falling back to a safe default only if the target cannot be
parsed; update getQuayProxyTarget to prefer targetParts[1] (or its component
portion) for the image stream name and only use tag.Tag as both name+tag as a
last-resort, ensuring you reference getQuayProxyTarget, targetParts, tag.Tag and
tag.Namespace when making the change.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@pkg/api/promotion.go`:
- Around line 110-141: The final fallback in getQuayProxyTarget currently
assumes the ImageStream name equals tag.Tag, which is unsafe; change the
fallback to extract the component from the original target (reuse targetParts[1]
when available) and use that as the ImageStream name with tag.Tag as the tag,
falling back to a safe default only if the target cannot be parsed; update
getQuayProxyTarget to prefer targetParts[1] (or its component portion) for the
image stream name and only use tag.Tag as both name+tag as a last-resort,
ensuring you reference getQuayProxyTarget, targetParts, tag.Tag and
tag.Namespace when making the change.

In `@pkg/steps/release/promote.go`:
- Around line 292-322: quayProxyTagFromISKey's branch that accepts non-`-quay`
streams for the `origin` namespace (via api.RefersToOfficialImage(namespace,
api.WithOKD)) is not covered by tests; add a unit test in
TestQuayProxyTagFromISKey that calls quayProxyTagFromISKey with an input like
"origin/<streamPart>:<tag>" where <streamPart> does NOT end with "-quay", assert
the function returns true and the expected formatted tag string (using
api.QCIAPPCIDomain, namespace "origin", the given streamPart and tag), and
ensure the test exercises the origin branch rather than the -quay or failure
paths.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: d03f6e12-c67a-4f10-aec3-c2450df8a469

📥 Commits

Reviewing files that changed from the base of the PR and between 2b0b091 and b16fe83.

📒 Files selected for processing (16)
  • pkg/api/promotion.go
  • pkg/api/promotion_test.go
  • pkg/defaults/defaults.go
  • pkg/defaults/defaults_test.go
  • pkg/steps/input_image_tag_test.go
  • pkg/steps/release/create_release.go
  • pkg/steps/release/create_release_test.go
  • pkg/steps/release/promote.go
  • pkg/steps/release/promote_test.go
  • pkg/steps/release/snapshot.go
  • pkg/steps/release/snapshot_test.go
  • pkg/steps/release/testdata/zz_fixture_TestGetPromotionPod_promotion_quay_4.12.yaml
  • pkg/steps/release/testdata/zz_fixture_TestGetPromotionPod_promotion_quay_multiple_tags.yaml
  • pkg/steps/release/testdata/zz_fixture_TestGetPromotionPod_promotion_quay_non_release_namespace.yaml
  • pkg/steps/utils/image.go
  • pkg/steps/utils/image_test.go
💤 Files with no reviewable changes (1)
  • pkg/steps/release/create_release.go
✅ Files skipped from review due to trivial changes (3)
  • pkg/steps/release/snapshot_test.go
  • pkg/steps/release/testdata/zz_fixture_TestGetPromotionPod_promotion_quay_4.12.yaml
  • pkg/steps/release/testdata/zz_fixture_TestGetPromotionPod_promotion_quay_multiple_tags.yaml
🚧 Files skipped from review as they are similar to previous changes (7)
  • pkg/steps/release/create_release_test.go
  • pkg/api/promotion_test.go
  • pkg/steps/utils/image_test.go
  • pkg/steps/release/snapshot.go
  • pkg/defaults/defaults.go
  • pkg/steps/input_image_tag_test.go
  • pkg/steps/release/promote_test.go

@deepsm007 deepsm007 force-pushed the revert/consolidated-quay-promotion branch from b16fe83 to 19a1202 Compare June 4, 2026 01:32

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
pkg/api/promotion.go (1)

117-141: 💤 Low value

Parsing logic is correct but dense; a brief why-comment per branch would help.

The two extraction patterns (suffix-match vs tag.Tag_-prefix) handle distinct target shapes and both branches are exercised by TestQuayCombinedMirrorFunc. The control flow is hard to follow at a glance — a one-line comment on each block explaining the target shape it matches would reduce future maintenance risk. No behavior change needed.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/api/promotion.go` around lines 117 - 141, Add concise one-line comments
explaining each branch of the tag parsing logic around targetParts/tagPart:
annotate the first branch (where tagSuffix is used and targetComponent is
extracted) with a comment like "matches targets where component name appears
between namespace and suffix '_<tag>' (e.g. namespace/component_tag)" and
annotate the second branch (where componentPrefix is detected from tag.Tag+"_"
and remainder is used) with a comment like "matches targets where tag is used as
namespace and component follows with '<tag>_component' pattern"; reference the
existing locals targetParts, tagPart, tagSuffix, targetComponent, remainder,
componentPrefix and the test TestQuayCombinedMirrorFunc to indicate these
patterns are exercised.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@pkg/api/promotion.go`:
- Around line 117-141: Add concise one-line comments explaining each branch of
the tag parsing logic around targetParts/tagPart: annotate the first branch
(where tagSuffix is used and targetComponent is extracted) with a comment like
"matches targets where component name appears between namespace and suffix
'_<tag>' (e.g. namespace/component_tag)" and annotate the second branch (where
componentPrefix is detected from tag.Tag+"_" and remainder is used) with a
comment like "matches targets where tag is used as namespace and component
follows with '<tag>_component' pattern"; reference the existing locals
targetParts, tagPart, tagSuffix, targetComponent, remainder, componentPrefix and
the test TestQuayCombinedMirrorFunc to indicate these patterns are exercised.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 8dfa51f1-e97a-4e4a-b069-a9ff7cced1a9

📥 Commits

Reviewing files that changed from the base of the PR and between b16fe83 and 19a1202.

📒 Files selected for processing (16)
  • pkg/api/promotion.go
  • pkg/api/promotion_test.go
  • pkg/defaults/defaults.go
  • pkg/defaults/defaults_test.go
  • pkg/steps/input_image_tag_test.go
  • pkg/steps/release/create_release.go
  • pkg/steps/release/create_release_test.go
  • pkg/steps/release/promote.go
  • pkg/steps/release/promote_test.go
  • pkg/steps/release/snapshot.go
  • pkg/steps/release/snapshot_test.go
  • pkg/steps/release/testdata/zz_fixture_TestGetPromotionPod_promotion_quay_4.12.yaml
  • pkg/steps/release/testdata/zz_fixture_TestGetPromotionPod_promotion_quay_multiple_tags.yaml
  • pkg/steps/release/testdata/zz_fixture_TestGetPromotionPod_promotion_quay_non_release_namespace.yaml
  • pkg/steps/utils/image.go
  • pkg/steps/utils/image_test.go
💤 Files with no reviewable changes (1)
  • pkg/steps/release/create_release.go
✅ Files skipped from review due to trivial changes (2)
  • pkg/steps/release/testdata/zz_fixture_TestGetPromotionPod_promotion_quay_non_release_namespace.yaml
  • pkg/steps/release/snapshot.go
🚧 Files skipped from review as they are similar to previous changes (11)
  • pkg/steps/release/snapshot_test.go
  • pkg/api/promotion_test.go
  • pkg/steps/release/testdata/zz_fixture_TestGetPromotionPod_promotion_quay_multiple_tags.yaml
  • pkg/steps/release/create_release_test.go
  • pkg/steps/release/testdata/zz_fixture_TestGetPromotionPod_promotion_quay_4.12.yaml
  • pkg/steps/utils/image_test.go
  • pkg/defaults/defaults.go
  • pkg/defaults/defaults_test.go
  • pkg/steps/release/promote_test.go
  • pkg/steps/input_image_tag_test.go
  • pkg/steps/release/promote.go

@Prucek

Prucek commented Jun 4, 2026

Copy link
Copy Markdown
Member

/retest-required

@deepsm007

Copy link
Copy Markdown
Contributor Author

/test images e2e

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Tests from second stage were triggered manually. Pipeline can be controlled only manually, until HEAD changes. Use command to trigger second stage.

@deepsm007 deepsm007 force-pushed the revert/consolidated-quay-promotion branch from 19a1202 to 6040116 Compare June 26, 2026 12:57
@deepsm007 deepsm007 force-pushed the revert/consolidated-quay-promotion branch from 6040116 to 145f1b0 Compare June 26, 2026 14:25

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/steps/release/promote.go`:
- Around line 475-479: The malformed-tag guard in getResolveAndTagRetryShell
uses a different log prefix than the rest of the function, which breaks
consistent log filtering. Update the echo message in getResolveAndTagRetryShell
to use the same unified promotion: prefix as the other failure/retry messages,
while keeping the same malformed quay proxy tag handling and exit behavior.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 643b4331-5fac-46fe-b810-ecbc697f53bb

📥 Commits

Reviewing files that changed from the base of the PR and between 19a1202 and 145f1b0.

📒 Files selected for processing (16)
  • pkg/api/promotion.go
  • pkg/api/promotion_test.go
  • pkg/defaults/defaults.go
  • pkg/defaults/defaults_test.go
  • pkg/steps/input_image_tag_test.go
  • pkg/steps/release/create_release.go
  • pkg/steps/release/create_release_test.go
  • pkg/steps/release/promote.go
  • pkg/steps/release/promote_test.go
  • pkg/steps/release/snapshot.go
  • pkg/steps/release/snapshot_test.go
  • pkg/steps/release/testdata/zz_fixture_TestGetQuayPromotionShell_promotion_quay_4.12.yaml
  • pkg/steps/release/testdata/zz_fixture_TestGetQuayPromotionShell_promotion_quay_multiple_tags.yaml
  • pkg/steps/release/testdata/zz_fixture_TestGetQuayPromotionShell_promotion_quay_non_release_namespace.yaml
  • pkg/steps/utils/image.go
  • pkg/steps/utils/image_test.go
🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

  • openshift/release (manual)
  • openshift/ci-docs (manual)
  • openshift/release-controller (manual)
  • openshift/ci-chat-bot (manual)
✅ Files skipped from review due to trivial changes (3)
  • pkg/steps/release/testdata/zz_fixture_TestGetQuayPromotionShell_promotion_quay_non_release_namespace.yaml
  • pkg/steps/release/testdata/zz_fixture_TestGetQuayPromotionShell_promotion_quay_multiple_tags.yaml
  • pkg/steps/release/testdata/zz_fixture_TestGetQuayPromotionShell_promotion_quay_4.12.yaml
🚧 Files skipped from review as they are similar to previous changes (6)
  • pkg/steps/utils/image_test.go
  • pkg/steps/release/create_release.go
  • pkg/defaults/defaults.go
  • pkg/defaults/defaults_test.go
  • pkg/steps/release/create_release_test.go
  • pkg/api/promotion.go

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caution

Inline review comments failed to post. This is likely due to GitHub's internal server error or limits when posting large numbers of comments. If you are seeing this consistently it is likely a permissions issue. Please check "Moderation" -> "Code review limits" under your organization settings.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/steps/release/promote.go`:
- Around line 475-479: The malformed-tag guard in getResolveAndTagRetryShell
uses a different log prefix than the rest of the function, which breaks
consistent log filtering. Update the echo message in getResolveAndTagRetryShell
to use the same unified promotion: prefix as the other failure/retry messages,
while keeping the same malformed quay proxy tag handling and exit behavior.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 643b4331-5fac-46fe-b810-ecbc697f53bb

📥 Commits

Reviewing files that changed from the base of the PR and between 19a1202 and 145f1b0.

📒 Files selected for processing (16)
  • pkg/api/promotion.go
  • pkg/api/promotion_test.go
  • pkg/defaults/defaults.go
  • pkg/defaults/defaults_test.go
  • pkg/steps/input_image_tag_test.go
  • pkg/steps/release/create_release.go
  • pkg/steps/release/create_release_test.go
  • pkg/steps/release/promote.go
  • pkg/steps/release/promote_test.go
  • pkg/steps/release/snapshot.go
  • pkg/steps/release/snapshot_test.go
  • pkg/steps/release/testdata/zz_fixture_TestGetQuayPromotionShell_promotion_quay_4.12.yaml
  • pkg/steps/release/testdata/zz_fixture_TestGetQuayPromotionShell_promotion_quay_multiple_tags.yaml
  • pkg/steps/release/testdata/zz_fixture_TestGetQuayPromotionShell_promotion_quay_non_release_namespace.yaml
  • pkg/steps/utils/image.go
  • pkg/steps/utils/image_test.go
🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

  • openshift/release (manual)
  • openshift/ci-docs (manual)
  • openshift/release-controller (manual)
  • openshift/ci-chat-bot (manual)
✅ Files skipped from review due to trivial changes (3)
  • pkg/steps/release/testdata/zz_fixture_TestGetQuayPromotionShell_promotion_quay_non_release_namespace.yaml
  • pkg/steps/release/testdata/zz_fixture_TestGetQuayPromotionShell_promotion_quay_multiple_tags.yaml
  • pkg/steps/release/testdata/zz_fixture_TestGetQuayPromotionShell_promotion_quay_4.12.yaml
🚧 Files skipped from review as they are similar to previous changes (6)
  • pkg/steps/utils/image_test.go
  • pkg/steps/release/create_release.go
  • pkg/defaults/defaults.go
  • pkg/defaults/defaults_test.go
  • pkg/steps/release/create_release_test.go
  • pkg/api/promotion.go
🛑 Comments failed to post (1)
pkg/steps/release/promote.go (1)

475-479: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Inconsistent log prefix in the malformed-tag guard.

The failure/retry echoes in this same function use the unified promotion: prefix, but this guard still emits promotion-quay:. Align it for consistent log filtering.

Proposed fix
-		return fmt.Sprintf("echo promotion-quay: malformed quay proxy tag %q >&2\nexit 1", quayProxyTag)
+		return fmt.Sprintf("echo promotion: malformed quay proxy tag %q >&2\nexit 1", quayProxyTag)
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

func getResolveAndTagRetryShell(registryConfig, quayProxyTag, isTag string, loglevel int, filterByOS string) string {
	colon := strings.LastIndex(quayProxyTag, ":")
	if colon == -1 {
		return fmt.Sprintf("echo promotion: malformed quay proxy tag %q >&2\nexit 1", quayProxyTag)
	}
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/steps/release/promote.go` around lines 475 - 479, The malformed-tag guard
in getResolveAndTagRetryShell uses a different log prefix than the rest of the
function, which breaks consistent log filtering. Update the echo message in
getResolveAndTagRetryShell to use the same unified promotion: prefix as the
other failure/retry messages, while keeping the same malformed quay proxy tag
handling and exit behavior.

@openshift-ci

openshift-ci Bot commented Jun 26, 2026

Copy link
Copy Markdown
Contributor

@deepsm007: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/integration 145f1b0 link true /test integration
ci/prow/breaking-changes 145f1b0 link false /test breaking-changes

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants