Skip to content

Handle the mirror release-policy reference #3727

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
st3penta wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Handle the mirror release-policy reference #3727

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d22d31c
Handle the mirror release-policy reference
st3penta Nov 13, 2026
c091305
Replace each floating policy reference independently
st3penta Nov 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
48 changes: 34 additions & 14 deletions hack/pin-konflux-policy-bundle.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,10 @@
# SPDX-License-Identifier: Apache-2.0
#
# This script resolves a policy configuration and replaces the release
# policy OCI tag reference with a digest-pinned reference. It requires
# policy OCI tag references with a digest-pinned reference. Both the
# conforma repository and its enterprise-contract mirror are handled: the
# release process retags both in the same step, so either reference
# identifies the same policy image. It requires
# the following environment variables:
#
# - POLICY_CONFIGURATION: Policy reference (k8s name, inline JSON, or file path).
Expand Down Expand Up @@ -75,25 +78,42 @@ else
fi
fi

ORIGINAL="oci::quay.io/conforma/release-policy:konflux"
REPLACEMENT="oci::quay.io/conforma/release-policy@${POLICY_BUNDLE_DIGEST}"

if ! grep -q "${ORIGINAL}" "$WORKING_POLICY"; then
echo "'${ORIGINAL}' not found in policy configuration, nothing to do."
exit 0
fi
# The enterprise-contract repository mirrors the release policy: the
# release process copies the same digest to both tags, so either reference
# can be pinned to the canonical repository.
ORIGINALS=(
"oci::quay.io/conforma/release-policy:konflux"
"oci::quay.io/enterprise-contract/ec-release-policy:konflux"
)

# If the reference is already digest-pinned (e.g. :konflux@sha256:...),
# respect the existing pin rather than overriding it.
if grep -q "${ORIGINAL}@sha256:" "$WORKING_POLICY"; then
echo "'${ORIGINAL}' already has a pinned digest, skipping override."
REPLACED=0
for ORIGINAL in "${ORIGINALS[@]}"; do
if ! grep -q "${ORIGINAL}" "$WORKING_POLICY"; then
continue
fi
# Hide occurrences that are already pinned to a digest behind a marker
# so that only floating references are replaced. A global sed alone
# cannot distinguish them: ORIGINAL@sha256:<old> contains ORIGINAL.
sed -i "s|${ORIGINAL}@sha256:|__PINNED_POLICY_REF__@sha256:|g" "$WORKING_POLICY"
if grep -q "${ORIGINAL}" "$WORKING_POLICY"; then
sed -i "s|${ORIGINAL}|${REPLACEMENT}|g" "$WORKING_POLICY"
echo "Replaced: ${ORIGINAL}"
echo " with: ${REPLACEMENT}"
REPLACED=1
else
echo "'${ORIGINAL}' already has a pinned digest, skipping override."
fi
# Restore the hidden pinned occurrences.
sed -i "s|__PINNED_POLICY_REF__@sha256:|${ORIGINAL}@sha256:|g" "$WORKING_POLICY"
done

if [ "$REPLACED" -eq 0 ]; then
echo "Release policy reference not found in policy configuration, nothing to do."
exit 0
fi

sed -i "s|${ORIGINAL}|${REPLACEMENT}|g" "$WORKING_POLICY"
echo "Replaced: ${ORIGINAL}"
echo " with: ${REPLACEMENT}"

POLICY_PATH="${HOME}/policy-with-pinned-bundle.yaml"
cp "$WORKING_POLICY" "${POLICY_PATH}"
echo "Modified policy written to: ${POLICY_PATH}"
84 changes: 84 additions & 0 deletions hack/pin-konflux-policy-bundle_test.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -223,6 +223,90 @@ else
fi
rm -rf "$TMPDIR"

# -------------------------------------------------------------------
echo "Test 9: mirror tag reference is replaced"
# -------------------------------------------------------------------
TMPDIR="$(mktemp -d)"
export HOME="${TMPDIR}"
POLICY_FILE="${TMPDIR}/policy.json"
cat > "$POLICY_FILE" <<'EOF'
{"sources":[{"policy":["oci::quay.io/enterprise-contract/ec-release-policy:konflux"]}]}
EOF
POLICY_CONFIGURATION="$POLICY_FILE" POLICY_BUNDLE_DIGEST="$NEW_DIGEST" \
bash "$SCRIPT" > /dev/null

assert_contains "${HOME}/policy-with-pinned-bundle.yaml" \
"oci::quay.io/conforma/release-policy@${NEW_DIGEST}" \
"mirror reference replaced with pinned canonical reference"
assert_not_contains "${HOME}/policy-with-pinned-bundle.yaml" \
"ec-release-policy" \
"mirror reference removed"
rm -rf "$TMPDIR"

# -------------------------------------------------------------------
echo "Test 10: already-pinned mirror reference is left alone"
# -------------------------------------------------------------------
TMPDIR="$(mktemp -d)"
export HOME="${TMPDIR}"
POLICY_FILE="${TMPDIR}/policy.json"
cat > "$POLICY_FILE" <<EOF
{"sources":[{"policy":["oci::quay.io/enterprise-contract/ec-release-policy:konflux@${OLD_DIGEST}"]}]}
EOF
POLICY_CONFIGURATION="$POLICY_FILE" POLICY_BUNDLE_DIGEST="$NEW_DIGEST" \
bash "$SCRIPT" > /dev/null

if [[ ! -f "${HOME}/policy-with-pinned-bundle.yaml" ]]; then
echo " PASS: no output file created (existing mirror pin respected)"
(( PASS++ ))
else
echo " FAIL: should not override an already-pinned mirror reference"
(( FAIL++ ))
fi
rm -rf "$TMPDIR"

# -------------------------------------------------------------------
echo "Test 11: pinned canonical plus floating mirror in one config"
# -------------------------------------------------------------------
TMPDIR="$(mktemp -d)"
export HOME="${TMPDIR}"
POLICY_FILE="${TMPDIR}/policy.json"
cat > "$POLICY_FILE" <<EOF
{"sources":[{"policy":["oci::quay.io/conforma/release-policy:konflux@${OLD_DIGEST}","oci::quay.io/enterprise-contract/ec-release-policy:konflux"]}]}
EOF
POLICY_CONFIGURATION="$POLICY_FILE" POLICY_BUNDLE_DIGEST="$NEW_DIGEST" \
bash "$SCRIPT" > /dev/null

assert_contains "${HOME}/policy-with-pinned-bundle.yaml" \
"oci::quay.io/conforma/release-policy:konflux@${OLD_DIGEST}" \
"existing canonical pin unchanged"
assert_contains "${HOME}/policy-with-pinned-bundle.yaml" \
"oci::quay.io/conforma/release-policy@${NEW_DIGEST}" \
"floating mirror reference pinned"
rm -rf "$TMPDIR"

# -------------------------------------------------------------------
echo "Test 12: pinned and floating mirror references in one config"
# -------------------------------------------------------------------
TMPDIR="$(mktemp -d)"
export HOME="${TMPDIR}"
POLICY_FILE="${TMPDIR}/policy.json"
cat > "$POLICY_FILE" <<EOF
{"sources":[
{"policy":["oci::quay.io/enterprise-contract/ec-release-policy:konflux@${OLD_DIGEST}"]},
{"policy":["oci::quay.io/enterprise-contract/ec-release-policy:konflux"]}
]}
EOF
POLICY_CONFIGURATION="$POLICY_FILE" POLICY_BUNDLE_DIGEST="$NEW_DIGEST" \
bash "$SCRIPT" > /dev/null

assert_contains "${HOME}/policy-with-pinned-bundle.yaml" \
"oci::quay.io/enterprise-contract/ec-release-policy:konflux@${OLD_DIGEST}" \
"existing mirror pin preserved"
assert_contains "${HOME}/policy-with-pinned-bundle.yaml" \
"oci::quay.io/conforma/release-policy@${NEW_DIGEST}" \
"floating mirror reference pinned"
rm -rf "$TMPDIR"

# -------------------------------------------------------------------
echo ""
echo "Results: ${PASS} passed, ${FAIL} failed"
Expand Down
Loading