feat: add skip-roxctl-scan for scratch PKO images - #866
Conversation
ACS/roxctl-scan fails on FROM-scratch package images (YAML only, no OS). skip-checks is too broad: it also drops clamav, SAST, and RPM signature scans and then Enterprise Contract fails. Mirror skip-preflight-cert-check with a roxctl-only skip so operators can keep the other image checks. Co-authored-by: Cursor <cursoragent@cursor.com>
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters (2)
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including ⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Enterprise Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: MitaliBhalla The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
CodeRabbit was right that skip-checks also dropped clamav, SAST, and RPM signature scans, which is what failed Enterprise Contract (8 EC failures). Use skip-roxctl-scan from openshift/boilerplate#866 instead, and pin the pipeline git resolver to that commit until it lands on master. Co-authored-by: Cursor <cursoragent@cursor.com>
| - name: skip-roxctl-scan | ||
| default: "false" | ||
| type: string | ||
| description: Skip ACS/roxctl-scan only (keep clamav, SAST, RPM signature, etc.). Use for FROM-scratch PKO/package images that have no OS for ACS to scan. Valid values are false and true. |
There was a problem hiding this comment.
Shouldn't ACS/roxctl just gracefully handle when there is an inability to scan?
There was a problem hiding this comment.
Looks like it's being solved with https://redhat.atlassian.net/browse/KONFLUX-15651
|
/hold |
openshift-ci
Bot
added
the
do-not-merge/hold
2 participants
Summary
skip-roxctl-scanondocker-build-oci-ta, same pattern asskip-preflight-cert-checkroxctl-scan(replaced Clair on 2026-08-28) fails on FROM-scratch PKO/package imagesskip-checks: trueis the wrong workaround: it disables clamav/SAST/RPM scans and Enterprise Contract then failsTest plan
false; operator images still run ACSskip-roxctl-scan: trueand still run clamav/SAST/RPM signatureMade with Cursor