konflux-tekton-updates

Name: konflux-tekton-updates
Author: redhat-developer

15stars31forks

How to install konflux-tekton-updates?

redhat-developer/rhdh-skill/konflux-tekton-updates

$npx -y skills add redhat-developer/rhdh-skill --skill konflux-tekton-updates

Installs into the current project.

Summary

Bumps Konflux Tekton task digests with .tekton/updateDigests.sh --minor --no-push, applies konflux-ci/build-definitions MIGRATION.md pipeline fixes, and regenerates PipelineRuns. Use for rhdh-plugin-catalog, RHDH midstream (4-rhdh), Konflux task minor bumps, prefetch-dependencies

Files · 1

View on GitHub

SKILL.md

1	# Konflux Tekton updates
2
3	## Goal
4
5	After a minor Konflux task tag bump, update `.tekton` pipelines and generators so builds keep working. Apply what each `MIGRATION.md` says; do not add drift tests that block future Konflux updates.
6
7	## Prerequisites
8
9	`skopeo`, `jq` (>= 1.7), `yq`. Optional: `gh` for PR creation from scripts.
10
11	## Commit locally; never push without human review
12
13	\| Script \| Flag \| Effect \|
14	\|--------\|------\|--------\|
15	\| `updateDigests.sh` \| `--no-push` / `--nopush` (`-p`) \| Commit locally; no push/PR \|
16	\| `updateDigests.sh` \| `--minor` \| Disables push; use with `--no-push` for clarity \|
17	\| `updateDigests.sh` \| `--no-commit` / `-n` \| Preview only \|
18	\| `generatePipelineRunsForPlugins.sh` \| `--nopush` \| Commit locally; no push \|
19	\| `generatePipelineRunsForPlugins.sh` \| `--nocommit` \| Write YAML only \|
20
21	`generatePipelineRuns.sh` does not commit or push.
22
23	Do not run digest/generator scripts without `--no-push` / `--nopush` unless the user explicitly requests a push.
24
25	## Detect repo layout
26
27	\| Marker in repo \| Read \|
28	\|----------------\|------\|
29	\| `.tekton/generatePipelineRunsForPlugins.sh` \| [references/plugin-catalog.md](references/plugin-catalog.md) \|
30	\| `.tekton-templates/rhdh-pipeline.yaml` \| [references/rhdh-midstream.md](references/rhdh-midstream.md) — variant A (unified) \|
31	\| `.tekton-templates/rhdh-hub.yaml` (no `rhdh-pipeline.yaml`) \| [references/rhdh-midstream.md](references/rhdh-midstream.md) — variant B (1.9 shared build-pipeline) \|
32
33	If both plugin-catalog and midstream markers exist, apply changes only for the repo/branch you are on.
34
35	## Workflow
36
37	### 1. Bump digests
38
39	```bash
40	cd .tekton
41	./updateDigests.sh --minor --no-push
42	```
43
44	- Updates `tag@sha256` in `.tekton/.yaml` and `.tekton-templates/.yaml` (via `TEMPLATEPATH`).
45	- On variant B, also updates `.tekton/build-pipeline-rhdh-*.yaml`.
46	- Tag changes list `MIGRATION.md` URLs under `konflux-ci/build-definitions`.
47	- Digest-only (no tag bump): `./updateDigests.sh --no-push -q`
48
49	Review `git diff` for `quay.io/konflux-ci/tekton-catalog/task-*` changes.
50
51	### 2. Apply migrations
52
53	For each URL from `updateDigests.sh` (or from the diff):
54
55	1. Read `MIGRATION.md`.
56	2. Apply only documented user actions in templates and shared pipelines (see [references/rhdh-midstream.md](references/rhdh-midstream.md) for per-variant file list).
57	3. Skip “no action required” sections.
58
59	If PLRs still contain removed params (e.g. `dev-package-managers`) but templates are fixed, migrations are incomplete until step 3.
60
61	### 3. Regenerate PipelineRuns
62
63	Always run after template or shared-pipeline migration edits (not optional when params changed):
64
65	```bash
66	cd .tekton
67	./generatePipelineRuns.sh -t <version>
68	```
69
70	\| Branch example \| `-t` value \| PLR suffix \|
71	\|----------------\|------------\|------------\|
72	\| `rhdh-1-rhel-9` \| `1` \| `rhdh-hub-1-push.yaml` \|
73	\| `rhdh-1.9-rhel-9` \| `1.9` \| `rhdh-hub-1-9-push.yaml` \|
74	\| `rhdh-1.10-rhel-9` \| `1.10` \| `rhdh-hub-1-10-push.yaml` \|
75
76	- Variant A: also patch `rhdh-rag-content-<N>-{push,pull}.yaml` by hand (inline `pipelineSpec`, not generated).
77	- Variant B: hub/operator PLRs regenerate from `rhdh-hub.yaml` / `rhdh-operator.yaml`; `build-pipeline-*.yaml` is edited directly, not by the generator.
78
79	Commit migration + regen locally when ready; do not push until human review.
80
81	### 4. Human review and push
82
83	Human reviews the full diff (digest commit plus any migration/regen commits), then `git push` or opens a PR.
84
85	## Known migration patterns
86
87	Use live `MIGRATION.md` as source of truth. Common cases:
88
89	\| Task \| Action \|
90	\|------\|--------\|
91	\| `prefetch-dependencies-oci-ta` 0.2→0.3 \| Remove `dev-package-managers`; add pipeline param `enable-package-registry-proxy` (default `"true"`) and pass to prefetch task. Variant B: also add param on `build-pipeline-rhdh-{hub,operator}.yaml` tasks `prefetch-dependencies-hub` / `prefetch-dependencies-operator`, and on PLR `spec.params` in `rhdh-hub.yaml` / `rhdh-operator.yaml`. \|
92	\| `build-image-index` 0.2→0.3 \| Remove `COMMIT_SHA` / `IMAGE_EXPIRES_AFTER` from build-image-index task only; keep on buildah (`build-container`) and prefetch \|
93	\| `init` 0.3→0.4 \| No pipeline changes \|
94	\| `init` 0.4.1→0.4.2 \| Remove broken auto-added `sast-target-dirs` pipeline param if present \|
95
96	## Anti-patterns
97
98	- Pushing without `--no-push` / `--nopush` and human sign-off.
99	- Leaving removed task params (`dev-package-managers`, `COMMIT_SHA` on `build-image-index`).
100	- Skipping `generatePipelineRuns.sh` after fixing templates while PLRs still reference old params.
101	- Editing only PLRs when templates or `build-pipeline-*.yaml` ar

People who liked this also viewed

6 picks

Type

konflux-tekton-updates

15stars31forks

View on GitHub

How to install konflux-tekton-updates?

redhat-developer/rhdh-skill/konflux-tekton-updates

$npx -y skills add redhat-developer/rhdh-skill --skill konflux-tekton-updates

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Konflux Tekton updates
2
3	## Goal
4
5	After a minor Konflux task tag bump, update `.tekton` pipelines and generators so builds keep working. Apply what each `MIGRATION.md` says; do not add drift tests that block future Konflux updates.
6
7	## Prerequisites
8
9	`skopeo`, `jq` (>= 1.7), `yq`. Optional: `gh` for PR creation from scripts.
10
11	## Commit locally; never push without human review
12
13	\| Script \| Flag \| Effect \|
14	\|--------\|------\|--------\|
15	\| `updateDigests.sh` \| `--no-push` / `--nopush` (`-p`) \| Commit locally; no push/PR \|
16	\| `updateDigests.sh` \| `--minor` \| Disables push; use with `--no-push` for clarity \|
17	\| `updateDigests.sh` \| `--no-commit` / `-n` \| Preview only \|
18	\| `generatePipelineRunsForPlugins.sh` \| `--nopush` \| Commit locally; no push \|
19	\| `generatePipelineRunsForPlugins.sh` \| `--nocommit` \| Write YAML only \|
20
21	`generatePipelineRuns.sh` does not commit or push.
22
23	Do not run digest/generator scripts without `--no-push` / `--nopush` unless the user explicitly requests a push.
24
25	## Detect repo layout
26
27	\| Marker in repo \| Read \|
28	\|----------------\|------\|
29	\| `.tekton/generatePipelineRunsForPlugins.sh` \| [references/plugin-catalog.md](references/plugin-catalog.md) \|
30	\| `.tekton-templates/rhdh-pipeline.yaml` \| [references/rhdh-midstream.md](references/rhdh-midstream.md) — variant A (unified) \|
31	\| `.tekton-templates/rhdh-hub.yaml` (no `rhdh-pipeline.yaml`) \| [references/rhdh-midstream.md](references/rhdh-midstream.md) — variant B (1.9 shared build-pipeline) \|
32
33	If both plugin-catalog and midstream markers exist, apply changes only for the repo/branch you are on.
34
35	## Workflow
36
37	### 1. Bump digests
38
39	```bash
40	cd .tekton
41	./updateDigests.sh --minor --no-push
42	```
43
44	- Updates `tag@sha256` in `.tekton/.yaml` and `.tekton-templates/.yaml` (via `TEMPLATEPATH`).
45	- On variant B, also updates `.tekton/build-pipeline-rhdh-*.yaml`.
46	- Tag changes list `MIGRATION.md` URLs under `konflux-ci/build-definitions`.
47	- Digest-only (no tag bump): `./updateDigests.sh --no-push -q`
48
49	Review `git diff` for `quay.io/konflux-ci/tekton-catalog/task-*` changes.
50
51	### 2. Apply migrations
52
53	For each URL from `updateDigests.sh` (or from the diff):
54
55	1. Read `MIGRATION.md`.
56	2. Apply only documented user actions in templates and shared pipelines (see [references/rhdh-midstream.md](references/rhdh-midstream.md) for per-variant file list).
57	3. Skip “no action required” sections.
58
59	If PLRs still contain removed params (e.g. `dev-package-managers`) but templates are fixed, migrations are incomplete until step 3.
60
61	### 3. Regenerate PipelineRuns
62
63	Always run after template or shared-pipeline migration edits (not optional when params changed):
64
65	```bash
66	cd .tekton
67	./generatePipelineRuns.sh -t <version>
68	```
69
70	\| Branch example \| `-t` value \| PLR suffix \|
71	\|----------------\|------------\|------------\|
72	\| `rhdh-1-rhel-9` \| `1` \| `rhdh-hub-1-push.yaml` \|
73	\| `rhdh-1.9-rhel-9` \| `1.9` \| `rhdh-hub-1-9-push.yaml` \|
74	\| `rhdh-1.10-rhel-9` \| `1.10` \| `rhdh-hub-1-10-push.yaml` \|
75
76	- Variant A: also patch `rhdh-rag-content-<N>-{push,pull}.yaml` by hand (inline `pipelineSpec`, not generated).
77	- Variant B: hub/operator PLRs regenerate from `rhdh-hub.yaml` / `rhdh-operator.yaml`; `build-pipeline-*.yaml` is edited directly, not by the generator.
78
79	Commit migration + regen locally when ready; do not push until human review.
80
81	### 4. Human review and push
82
83	Human reviews the full diff (digest commit plus any migration/regen commits), then `git push` or opens a PR.
84
85	## Known migration patterns
86
87	Use live `MIGRATION.md` as source of truth. Common cases:
88
89	\| Task \| Action \|
90	\|------\|--------\|
91	\| `prefetch-dependencies-oci-ta` 0.2→0.3 \| Remove `dev-package-managers`; add pipeline param `enable-package-registry-proxy` (default `"true"`) and pass to prefetch task. Variant B: also add param on `build-pipeline-rhdh-{hub,operator}.yaml` tasks `prefetch-dependencies-hub` / `prefetch-dependencies-operator`, and on PLR `spec.params` in `rhdh-hub.yaml` / `rhdh-operator.yaml`. \|
92	\| `build-image-index` 0.2→0.3 \| Remove `COMMIT_SHA` / `IMAGE_EXPIRES_AFTER` from build-image-index task only; keep on buildah (`build-container`) and prefetch \|
93	\| `init` 0.3→0.4 \| No pipeline changes \|
94	\| `init` 0.4.1→0.4.2 \| Remove broken auto-added `sast-target-dirs` pipeline param if present \|
95
96	## Anti-patterns
97
98	- Pushing without `--no-push` / `--nopush` and human sign-off.
99	- Leaving removed task params (`dev-package-managers`, `COMMIT_SHA` on `build-image-index`).
100	- Skipping `generatePipelineRuns.sh` after fixing templates while PLRs still reference old params.
101	- Editing only PLRs when templates or `build-pipeline-*.yaml` ar

People who liked this also viewed

6 picks

Type