chore(release): Add start Y release script - #179
Open
mtodor wants to merge 2 commits into
Open
Conversation
E2E Test ResultsCommit: d8d039e |
❌ 2 Tests Failed:
View the full list of 2 ❄️ flaky test(s)
To view more test analytics, go to the Test Analytics Dashboard |
Contributor
📝 WalkthroughSummary by CodeRabbit
WalkthroughChangesThe PR adds a Bash Y-stream release orchestrator that validates inputs, updates parent repository Tekton configuration, generates Konflux stage and production release resources, validates kustomize output, and supports dry-run execution without remote pushes. Y-stream release workflow
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant ReleaseScript
participant ParentRepository
participant KonfluxReleaseData
participant BuildSingle
ReleaseScript->>ParentRepository: Create release branch and update Tekton configuration
ReleaseScript->>ParentRepository: Commit and optionally push changes
ReleaseScript->>KonfluxReleaseData: Generate release admissions and kustomization
KonfluxReleaseData->>BuildSingle: Validate tenant configuration
ReleaseScript->>KonfluxReleaseData: Commit and optionally push release-data branch
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/start-y-stream-release.sh`:
- Around line 106-114: The release branch creation in
prepare_stackrox_mcp_branch and prepare_konflux_data_branch is not rerun-safe.
In scripts/start-y-stream-release.sh lines 106-114 and 155-163, replace each git
checkout -b invocation with checkout -B using the same branch name and
origin/main base, and add a brief comment noting that reruns reset and discard
local unpushed commits on the existing release branch.
- Line 203: Remove the `select(. == "*")` filter from the `.patches[0].patch`
update in the release-generation command, and apply `sub("release-X.Y", ...)`
directly to the patch text. Preserve the existing VERSION substitution and match
the direct substitution pattern used by the nearby `.transformers[0]` update.
- Around line 132-136: Replace the fragile shell quote-splicing in the yq
expressions within the release script, including the repeated occurrences around
the metadata, service account, and extra-label updates, with yq’s env(NAME)
variable access. First verify that the yq version pinned by validate_inputs
supports the required env() string-concatenation semantics, then apply the
consistent expression style to all affected VERSION and VERSION_DASHED usages.
- Around line 189-190: Replace the hard-coded tags[2] and tags[3] assignments in
the release update flow with the same pattern-based sub() approach used by
create_release_kustomization, targeting the intended tag values by their
existing content rather than array position while preserving the VERSION and
timestamp substitutions.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: 4d1dca25-8ef9-46ed-95ee-ace21a4cbd19
📒 Files selected for processing (4)
scripts/start-y-stream-release.shscripts/templates/release-kustomization.yamlscripts/templates/release-plan-admission-prod.yamlscripts/templates/release-plan-admission-stage.yaml
mtodor
force-pushed
the
mtodor/add-script-to-start-y-release
branch
from
July 29, 2026 09:00
6995c2d to
d8d039e
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/start-y-stream-release.sh`:
- Around line 106-114: Update prepare_stackrox_mcp_branch and the Konflux
checkout flow to run git status --porcelain and abort before either checkout
when the respective worktree is non-empty. In the release staging step, replace
broad git add -A with explicit staging of only the expected generated Konflux
files and directories.
In `@scripts/templates/release-plan-admission-stage.yaml`:
- Around line 39-42: Replace the mutable production branch revision for
release-service-catalog with an immutable commit SHA or tag in
scripts/templates/release-plan-admission-stage.yaml at lines 39-42 and
scripts/templates/release-plan-admission-prod.yaml at lines 39-42, keeping both
imported pipeline references pinned consistently.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: 3d8ef9b6-53f7-4be7-8fc8-96ca05cc80a4
📒 Files selected for processing (4)
scripts/start-y-stream-release.shscripts/templates/release-kustomization.yamlscripts/templates/release-plan-admission-prod.yamlscripts/templates/release-plan-admission-stage.yaml
janisz
approved these changes
Jul 29, 2026
| fi | ||
|
|
||
| log "Adding release-${VERSION} to parent kustomization.yaml..." | ||
| yq -i '.resources += ["release-" + env(VERSION)]' "${parent_kustomization}" |
Contributor
There was a problem hiding this comment.
+= blindly appends without checking if the entry already exists. If the script is re-run after a previous PR was merged (e.g. to fix a typo), checkout -B resets to origin/main (which now contains the merged entry), then this appends a duplicate. kustomize will reject the duplicate resource declaration with an "already visited" error, blocking the release.
Consider guarding with something like:
yq -i '.resources |= (. + ["release-" + env(VERSION)] | unique)' "${parent_kustomization}"| yq -i '.spec.applications[0] = "agentic-cluster-security-suite-" + env(VERSION_DASHED)' "${target}" | ||
| yq -i '.spec.data.releaseNotes.product_version = env(VERSION)' "${target}" | ||
| yq -i '.spec.data.mapping.components[0].name = "acs-mcp-server-" + env(VERSION_DASHED)' "${target}" | ||
| yq -i '(.spec.data.mapping.defaults.tags[] | select(test("X.Y"))) |= sub("X.Y", env(VERSION))' "${target}" |
Contributor
There was a problem hiding this comment.
The dot in "X.Y" is an unescaped regex wildcard — it matches any character between X and Y, not just a literal period. Compare with line 136 which correctly escapes:
select(test("X\\.Y"))) |= sub("X\\.Y", env(VERSION))Same issue on line 204 with sub("release-X.Y", ...). All call sites should use consistent escaping.
| local branch="agentic-suite-release-${VERSION_DASHED}" | ||
|
|
||
| log "Committing all changes in konflux-release-data..." | ||
| git -C "${KONFLUX_DATA_REPO}" add -A |
Contributor
There was a problem hiding this comment.
Suggestion: This operates on a user-provided path to a separately cloned repository. git add -A stages everything including untracked files (editor swap files, test outputs, notes). Line 145 in the stackrox-mcp part correctly uses targeted staging (git add .tekton/). Consider staging only the specific paths the script modifies:
git -C "${KONFLUX_DATA_REPO}" add \
config/kflux-prd-rh02.0fk9.p1/product/ReleasePlanAdmission/ \
tenants-config/cluster/kflux-prd-rh02/tenants/agentic-cluster-security-suite-tenant/|
|
||
| # -B resets the branch if it already exists, so reruns discard local unpushed commits. | ||
| log "Creating branch ${branch} from origin/main..." | ||
| git -C "${SCRIPT_DIR}/.." checkout -B "${branch}" origin/main |
Contributor
There was a problem hiding this comment.
Suggestion: The comment on line 113 documents this as intentional, which is good. But if someone made manual adjustments to the branch and re-runs the script, their work is silently lost. A pre-check for unpushed commits with a warning would make re-runs safer:
if git -C "${repo}" log --oneline "origin/main..${branch}" 2>/dev/null | grep -q .; then
log "WARNING: Branch ${branch} has unpushed commits that will be discarded"
fi| yq -i --yaml-compact-seq-indent '.metadata.labels."appstudio.openshift.io/application" = "agentic-cluster-security-suite-" + env(VERSION_DASHED)' "${file}" | ||
| yq -i --yaml-compact-seq-indent '.metadata.labels."appstudio.openshift.io/component" = "acs-mcp-server-" + env(VERSION_DASHED)' "${file}" | ||
| yq -i --yaml-compact-seq-indent '.spec.taskRunTemplate.serviceAccountName = "build-pipeline-acs-mcp-server-" + env(VERSION_DASHED)' "${file}" | ||
| yq -i --yaml-compact-seq-indent '(.spec.params[] | select(.name == "extra-labels") | .value[] | select(test("X\\.Y"))) |= sub("X\\.Y", env(VERSION))' "${file}" |
Contributor
There was a problem hiding this comment.
Good — the escaped dot here (X\\.Y) is the correct pattern. The other call sites (lines 191, 204) should match this.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Adds an automated script for starting Y-stream releases of the Agentic Cluster Security Suite. Previously, creating a new release stream required manual edits across two repositories (stackrox-mcp and konflux-release-data), which was error-prone and time-consuming.
The script
scripts/start-y-stream-release.shtakes a version (e.g.,1.5) and the path to the konflux-release-data repo, then:In stackrox-mcp:
release-x.ybranch fromorigin/mainyqIn konflux-release-data:
agentic-suite-release-x-ybranch fromorigin/mainbuild-single.shto validate kustomize buildYAML templates with
X.Y/X-Yplaceholders are stored inscripts/templates/. A--dry-runflag allows local-only execution without pushing.Validation
yqversion check works (requires >= 4.52.1 for--yaml-compact-seq-indent)--dry-runto verify all file modifications without pushingbuild-single.shkustomize build succeedsAI-assisted development prompts
This PR was developed with AI assistance. Below are the prompts used: