Repository navigation
RHIDP-18434: add script to check plugin digests against tags [release-2.1] - #2719
Merged
Merged
Conversation
Collaborator
Shellcheck Analysis ResultsChanged shell scripts in this PR: 1 Scripts analyzed:
Check the Files changed tab for detailed shellcheck suggestions. All findings are reported as warnings and won't block the PR. Automated shellcheck analysis • See shellcheck.net for details |
Collaborator
PR Build ResultsBuild passed -- 2/2 titles | 69s Content Quality AssessmentCQA Report
SummaryChecks: 22 total, 22 pass, 0 fail Modules not yet in product_product7 modules (proc, con, ref) are not yet included in the
|
nickboldt
force-pushed
the
RHIDP-18434-check-plugin-digests
branch
from
November 4, 2026 15:08
9995c7c to
4798053
Compare
The generated dynamic plugin tables pin an immutable @sha256: digest per plugin and name the mutable artifact tag in the next column. Once a tag is rebuilt, the pinned digest no longer matches what the tag publishes and the tables are stale until the catalog indexes and the tables are regenerated. check-plugin-digests.sh pairs each pinned digest with its artifact tag, runs skopeo inspect on both references, and compares the platform manifest digest because the tables pin single-architecture manifest digests while tags publish multi-architecture indexes. Rows that differ are reported with both digests and build times, followed by the call to action for the community catalog index build, the downstream "update index" schedule, and the documentation table update workflow. Assisted-by: pi (GPT 5.6 Sol High) Signed-off-by: Nick Boldt <nboldt@redhat.com>
The aligned fixed-width console table broke whenever an image or tag name exceeded its column, and full ISO 8601 timestamps with nanoseconds dominated the output. Render the report as a markdown table instead, truncate build times to the minute in UTC, and add --output to write the report to a file. Assisted-by: pi (GPT 5.6 Sol High) Signed-off-by: Nick Boldt <nboldt@redhat.com>
Printing the markdown report alone left nothing to open in an editor. Write it to report.md next to the working directory as well, keep stdout unchanged, and let --output redirect the file. Ignore report.md so a run does not dirty the tree. Assisted-by: pi (GPT 5.6 Sol High) Signed-off-by: rhdh-bot service account <rhdh-bot@redhat.com>
Signed-off-by: rhdh-bot service account <rhdh-bot@redhat.com>
Sonar shell:S7679 flagged '"$1"' in extract_pins(). Same pattern in epoch(); both now copy the argument into a local, as inspect_ref() already did. Generated-by: paseo (pi + DeepSeek V4.1 Flash (EnMaaS), thinking: off)
extract_pins() dropped a pin when no tag row followed it, so a table format change would silently shrink the checked set. The pending pin is now emitted with a "-" sentinel and reported as NO_TAG, have_pin resets at a |=== table break, and the last-cell branch uses a counted split() instead of the length(array) extension so it also parses with a POSIX awk. Generated-by: paseo (pi + DeepSeek V4.1 Flash (EnMaaS), thinking: off)
The skopeo cache was tab separated and read with IFS=$'\t'. A tab is IFS whitespace, so `read` collapses runs of it: an empty Created field shifted the manifest digest into the Created slot and the comparison then reported DIGEST_MISMATCH. Cached fields are now separated and read with $'\x1f'. Generated-by: paseo (pi + DeepSeek V4.1 Flash (EnMaaS), thinking: off)
Signed-off-by: Nick Boldt <nboldt@redhat.com>
Signed-off-by: Nick Boldt <nboldt@redhat.com>
nickboldt
force-pushed
the
RHIDP-18434-check-plugin-digests
branch
from
November 5, 2026 16:08
5e2dc99 to
e874fb4
Compare
Member
Author
|
/cherry-pick main |
Contributor
|
@nickboldt: once the present PR merges, I will cherry-pick it on top of DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
…ck-plugin-digests.sh script Signed-off-by: Nick Boldt <nboldt@redhat.com>
|
nickboldt
added a commit
that referenced
this pull request
Nov 5, 2026
…-2.1] (#2719) * RHIDP-18434: add script to check plugin digests against tags The generated dynamic plugin tables pin an immutable @sha256: digest per plugin and name the mutable artifact tag in the next column. Once a tag is rebuilt, the pinned digest no longer matches what the tag publishes and the tables are stale until the catalog indexes and the tables are regenerated. check-plugin-digests.sh pairs each pinned digest with its artifact tag, runs skopeo inspect on both references, and compares the platform manifest digest because the tables pin single-architecture manifest digests while tags publish multi-architecture indexes. Rows that differ are reported with both digests and build times, followed by the call to action for the community catalog index build, the downstream "update index" schedule, and the documentation table update workflow. Assisted-by: pi (GPT 5.6 Sol High) Signed-off-by: Nick Boldt <nboldt@redhat.com> * RHIDP-18434: report plugin digest drift as a markdown table The aligned fixed-width console table broke whenever an image or tag name exceeded its column, and full ISO 8601 timestamps with nanoseconds dominated the output. Render the report as a markdown table instead, truncate build times to the minute in UTC, and add --output to write the report to a file. Assisted-by: pi (GPT 5.6 Sol High) Signed-off-by: Nick Boldt <nboldt@redhat.com> * RHIDP-18434: always save the digest report to report.md Printing the markdown report alone left nothing to open in an editor. Write it to report.md next to the working directory as well, keep stdout unchanged, and let --output redirect the file. Ignore report.md so a run does not dirty the tree. Assisted-by: pi (GPT 5.6 Sol High) Signed-off-by: rhdh-bot service account <rhdh-bot@redhat.com> * simplify CTA for respinning index content Signed-off-by: rhdh-bot service account <rhdh-bot@redhat.com> * RHIDP-18434: assign positional parameters to local variables Sonar shell:S7679 flagged '"$1"' in extract_pins(). Same pattern in epoch(); both now copy the argument into a local, as inspect_ref() already did. Generated-by: paseo (pi + DeepSeek V4.1 Flash (EnMaaS), thinking: off) * RHIDP-18434: report pins whose table row has no artifact tag extract_pins() dropped a pin when no tag row followed it, so a table format change would silently shrink the checked set. The pending pin is now emitted with a "-" sentinel and reported as NO_TAG, have_pin resets at a |=== table break, and the last-cell branch uses a counted split() instead of the length(array) extension so it also parses with a POSIX awk. Generated-by: paseo (pi + DeepSeek V4.1 Flash (EnMaaS), thinking: off) * RHIDP-18434: keep empty cache fields in the digest check The skopeo cache was tab separated and read with IFS=$'\t'. A tab is IFS whitespace, so `read` collapses runs of it: an empty Created field shifted the manifest digest into the Created slot and the comparison then reported DIGEST_MISMATCH. Cached fields are now separated and read with $'\x1f'. Generated-by: paseo (pi + DeepSeek V4.1 Flash (EnMaaS), thinking: off) * revise CTA text Signed-off-by: Nick Boldt <nboldt@redhat.com> * improved CTA flow Signed-off-by: Nick Boldt <nboldt@redhat.com> * add disclaimer about the modules/extend_dynamic-plugins-reference/check-plugin-digests.sh script Signed-off-by: Nick Boldt <nboldt@redhat.com> --------- Signed-off-by: Nick Boldt <nboldt@redhat.com> Signed-off-by: rhdh-bot service account <rhdh-bot@redhat.com> Co-authored-by: rhdh-bot service account <rhdh-bot@redhat.com>
Contributor
|
@nickboldt: #2719 failed to apply on top of branch "main": DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
modules/extend_dynamic-plugins-reference/check-plugin-digests.shfor RHIDP-18434.The generated dynamic plugin tables pin an immutable
@sha256:digest per plugin and name the mutable artifact tag in the next column. When a tag is rebuilt, the pinned digest and build time no longer match what the tag publishes, so the tables are stale until the catalog indexes are rebuilt and the tables regenerated. Nothing currently reports that condition.The script:
oci://…@sha256:…inref-community-supported-plugins.adoc,ref-ga-plugins.adoc,ref-technology-preview-plugins.adoc, andref-other-installable-plugins.adocwith the artifact tag in the following table cell.skopeo inspectonrepo@digestandrepo:tagin parallel (-j, default 8).--arch/--osselect the manifest (defaultamd64/linux).OK,STALE_PIN,PIN_NEWER_THAN_TAG,DIGEST_MISMATCH,PINNED_UNRESOLVABLE, andTAG_UNRESOLVABLErows with pinned and tag digests plus build times.update indexschedule play, and the documentation table update workflow, each ingh/glaband REST API form.--warn-onlyreports without failing,--triggerdispatches the two GitHub workflows.README.mddocuments the script.Test plan
bash -n modules/extend_dynamic-plugins-reference/check-plugin-digests.shshellcheck --severity=style modules/extend_dynamic-plugins-reference/check-plugin-digests.shmodules/extend_dynamic-plugins-reference/check-plugin-digests.sh --helpmodules/extend_dynamic-plugins-reference/check-plugin-digests.sh -f ref-community-supported-plugins.adoc→ reports the 36 community pins whose tags were rebuilt on 2026-10-30 against pins from 2026-10-28, exit 1modules/extend_dynamic-plugins-reference/check-plugin-digests.sh --warn-only→ 105 pinned artifacts checked; supported and tech-preview rows fromquay.iomatch, community rows fromghcr.ioare stale, exit 0modules/extend_dynamic-plugins-reference/check-plugin-digests.sh -f /tmp/drift-fixture.adoc --all→ per-row output verified againstskopeo inspectofbackstage-community-plugin-azure-devops-backend:bs_1.54.9__0.32.0Assisted-by: pi (GPT 5.6 Sol High)