chore(release): Add start Y release script - #179
Conversation
E2E Test ResultsCommit: 6995c2d |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #179 +/- ##
=======================================
Coverage 72.37% 72.37%
=======================================
Files 31 31
Lines 1383 1383
=======================================
Hits 1001 1001
Misses 336 336
Partials 46 46
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. |
📝 WalkthroughSummary by CodeRabbit
WalkthroughChangesThe PR adds a Bash Y-stream release orchestrator that validates inputs, updates parent repository Tekton configuration, generates Konflux stage and production release resources, validates kustomize output, and supports dry-run execution without remote pushes. Y-stream release workflow
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant ReleaseScript
participant ParentRepository
participant KonfluxReleaseData
participant BuildSingle
ReleaseScript->>ParentRepository: Create release branch and update Tekton configuration
ReleaseScript->>ParentRepository: Commit and optionally push changes
ReleaseScript->>KonfluxReleaseData: Generate release admissions and kustomization
KonfluxReleaseData->>BuildSingle: Validate tenant configuration
ReleaseScript->>KonfluxReleaseData: Commit and optionally push release-data branch
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/start-y-stream-release.sh`:
- Around line 106-114: The release branch creation in
prepare_stackrox_mcp_branch and prepare_konflux_data_branch is not rerun-safe.
In scripts/start-y-stream-release.sh lines 106-114 and 155-163, replace each git
checkout -b invocation with checkout -B using the same branch name and
origin/main base, and add a brief comment noting that reruns reset and discard
local unpushed commits on the existing release branch.
- Line 203: Remove the `select(. == "*")` filter from the `.patches[0].patch`
update in the release-generation command, and apply `sub("release-X.Y", ...)`
directly to the patch text. Preserve the existing VERSION substitution and match
the direct substitution pattern used by the nearby `.transformers[0]` update.
- Around line 132-136: Replace the fragile shell quote-splicing in the yq
expressions within the release script, including the repeated occurrences around
the metadata, service account, and extra-label updates, with yq’s env(NAME)
variable access. First verify that the yq version pinned by validate_inputs
supports the required env() string-concatenation semantics, then apply the
consistent expression style to all affected VERSION and VERSION_DASHED usages.
- Around line 189-190: Replace the hard-coded tags[2] and tags[3] assignments in
the release update flow with the same pattern-based sub() approach used by
create_release_kustomization, targeting the intended tag values by their
existing content rather than array position while preserving the VERSION and
timestamp substitutions.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: 4d1dca25-8ef9-46ed-95ee-ace21a4cbd19
📒 Files selected for processing (4)
scripts/start-y-stream-release.shscripts/templates/release-kustomization.yamlscripts/templates/release-plan-admission-prod.yamlscripts/templates/release-plan-admission-stage.yaml
| prepare_stackrox_mcp_branch() { | ||
| local branch="release-${VERSION}" | ||
|
|
||
| log "Fetching origin in stackrox-mcp..." | ||
| git -C "${SCRIPT_DIR}/.." fetch origin | ||
|
|
||
| log "Creating branch ${branch} from origin/main..." | ||
| git -C "${SCRIPT_DIR}/.." checkout -b "${branch}" origin/main | ||
| } |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
No rerun-safety for release branch creation in either repo workflow. Both prepare_stackrox_mcp_branch and prepare_konflux_data_branch use git checkout -b, which fails if the branch already exists locally — e.g. after a dry-run followed by a real run, or after any mid-script failure that leaves the branch behind. Under set -e this aborts the whole release script.
scripts/start-y-stream-release.sh#L106-L114: switch togit checkout -B "${branch}" origin/main(or checkgit rev-parse --verifyfirst) so a rerun resets the branch to origin/main instead of failing.scripts/start-y-stream-release.sh#L155-L163: apply the same fix foragentic-suite-release-${VERSION_DASHED}.
Note -B discards any local, unpushed commits on a pre-existing branch of the same name — acceptable for a re-run of "start release," but worth calling out explicitly in a comment.
📍 Affects 1 file
scripts/start-y-stream-release.sh#L106-L114(this comment)scripts/start-y-stream-release.sh#L155-L163
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@scripts/start-y-stream-release.sh` around lines 106 - 114, The release branch
creation in prepare_stackrox_mcp_branch and prepare_konflux_data_branch is not
rerun-safe. In scripts/start-y-stream-release.sh lines 106-114 and 155-163,
replace each git checkout -b invocation with checkout -B using the same branch
name and origin/main base, and add a brief comment noting that reruns reset and
discard local unpushed commits on the existing release branch.
| yq -i --yaml-compact-seq-indent '.metadata.labels."appstudio.openshift.io/application" = "agentic-cluster-security-suite-'"${VERSION_DASHED}"'"' "${file}" | ||
| yq -i --yaml-compact-seq-indent '.metadata.labels."appstudio.openshift.io/component" = "acs-mcp-server-'"${VERSION_DASHED}"'"' "${file}" | ||
| yq -i --yaml-compact-seq-indent '.spec.taskRunTemplate.serviceAccountName = "build-pipeline-acs-mcp-server-'"${VERSION_DASHED}"'"' "${file}" | ||
| yq -i --yaml-compact-seq-indent '(.spec.params[] | select(.name == "extra-labels") | .value[0]) = "cpe=cpe:/a:redhat:agentic_cluster_security_suite:'"${VERSION}"'::el9"' "${file}" | ||
| done |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win
Consider env(VAR) instead of string-concatenated yq expressions.
This quoting-concatenation pattern ('...'"${VERSION_DASHED}"'...') repeats at lines 185-190, 203-204, and 215. yq supports reading environment variables directly inside expressions (env(NAME)), which would avoid the fragile quote-splicing and make the expressions easier to read/maintain.
♻️ Example using env()
- yq -i --yaml-compact-seq-indent '.metadata.labels."appstudio.openshift.io/application" = "agentic-cluster-security-suite-'"${VERSION_DASHED}"'"' "${file}"
+ yq -i --yaml-compact-seq-indent '.metadata.labels."appstudio.openshift.io/application" = "agentic-cluster-security-suite-" + env(VERSION_DASHED)' "${file}"Please confirm env(VAR) string-concatenation semantics against the yq version pinned in validate_inputs before adopting broadly.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@scripts/start-y-stream-release.sh` around lines 132 - 136, Replace the
fragile shell quote-splicing in the yq expressions within the release script,
including the repeated occurrences around the metadata, service account, and
extra-label updates, with yq’s env(NAME) variable access. First verify that the
yq version pinned by validate_inputs supports the required env()
string-concatenation semantics, then apply the consistent expression style to
all affected VERSION and VERSION_DASHED usages.
| yq -i '.spec.data.mapping.defaults.tags[2] = "'"${VERSION}"'"' "${target}" | ||
| yq -i '.spec.data.mapping.defaults.tags[3] = "'"${VERSION}"'-{{ timestamp }}"' "${target}" |
There was a problem hiding this comment.
🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win
Hard-coded array indices are fragile.
tags[2]/tags[3] assume the template's tag ordering never changes; a future template edit would silently overwrite the wrong entries with no error. The sub()-based approach used in create_release_kustomization (line 203) is safer and more self-documenting.
♻️ Suggested pattern-based replacement
- yq -i '.spec.data.mapping.defaults.tags[2] = "'"${VERSION}"'"' "${target}"
- yq -i '.spec.data.mapping.defaults.tags[3] = "'"${VERSION}"'-{{ timestamp }}"' "${target}"
+ yq -i '.spec.data.mapping.defaults.tags |= map(sub("^X\.Y$", "'"${VERSION}"'"))' "${target}"
+ yq -i '.spec.data.mapping.defaults.tags |= map(sub("^X\.Y-\{\{ timestamp \}\}$", "'"${VERSION}"'-{{ timestamp }}"))' "${target}"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| yq -i '.spec.data.mapping.defaults.tags[2] = "'"${VERSION}"'"' "${target}" | |
| yq -i '.spec.data.mapping.defaults.tags[3] = "'"${VERSION}"'-{{ timestamp }}"' "${target}" | |
| yq -i '.spec.data.mapping.defaults.tags |= map(sub("^X\.Y$", "'"${VERSION}"'"))' "${target}" | |
| yq -i '.spec.data.mapping.defaults.tags |= map(sub("^X\.Y-\{\{ timestamp \}\}$", "'"${VERSION}"'-{{ timestamp }}"))' "${target}" |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@scripts/start-y-stream-release.sh` around lines 189 - 190, Replace the
hard-coded tags[2] and tags[3] assignments in the release update flow with the
same pattern-based sub() approach used by create_release_kustomization,
targeting the intended tag values by their existing content rather than array
position while preserving the VERSION and timestamp substitutions.
| cp "${TEMPLATE_DIR}/release-kustomization.yaml" "${release_dir}/kustomization.yaml" | ||
|
|
||
| local target="${release_dir}/kustomization.yaml" | ||
| yq -i '(.patches[0].patch | select(. == "*")) |= sub("release-X.Y", "release-'"${VERSION}"'")' "${target}" |
There was a problem hiding this comment.
🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win
select(. == "*") makes the patch substitution a permanent no-op.
.patches[0].patch is the literal multi-line Component patch text (never the string "*"), so the select filter never matches and sub("release-X.Y", ...) is never applied via |=. Every generated kustomization.yaml will ship the unresolved placeholder revision: release-X.Y instead of the real release branch, breaking the Component pointer for every release. Line 204's .transformers[0] |= sub(...) (no select) shows this was likely a stray leftover.
🐛 Proposed fix
- yq -i '(.patches[0].patch | select(. == "*")) |= sub("release-X.Y", "release-'"${VERSION}"'")' "${target}"
+ yq -i '.patches[0].patch |= sub("release-X.Y", "release-'"${VERSION}"'")' "${target}"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| yq -i '(.patches[0].patch | select(. == "*")) |= sub("release-X.Y", "release-'"${VERSION}"'")' "${target}" | |
| yq -i '.patches[0].patch |= sub("release-X.Y", "release-'"${VERSION}"'")' "${target}" |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@scripts/start-y-stream-release.sh` at line 203, Remove the `select(. == "*")`
filter from the `.patches[0].patch` update in the release-generation command,
and apply `sub("release-X.Y", ...)` directly to the patch text. Preserve the
existing VERSION substitution and match the direct substitution pattern used by
the nearby `.transformers[0]` update.
2 participants
Description
Adds an automated script for starting Y-stream releases of the Agentic Cluster Security Suite. Previously, creating a new release stream required manual edits across two repositories (stackrox-mcp and konflux-release-data), which was error-prone and time-consuming.
The script
scripts/start-y-stream-release.shtakes a version (e.g.,1.5) and the path to the konflux-release-data repo, then:In stackrox-mcp:
release-x.ybranch fromorigin/mainyqIn konflux-release-data:
agentic-suite-release-x-ybranch fromorigin/mainbuild-single.shto validate kustomize buildYAML templates with
X.Y/X-Yplaceholders are stored inscripts/templates/. A--dry-runflag allows local-only execution without pushing.Validation
yqversion check works (requires >= 4.52.1 for--yaml-compact-seq-indent)--dry-runto verify all file modifications without pushingbuild-single.shkustomize build succeedsAI-assisted development prompts
This PR was developed with AI assistance. Below are the prompts used: