chore(release): Add start Y release script by mtodor · Pull Request #179 · stackrox/stackrox-mcp

mtodor · 2026-07-28T16:39:27Z

Description

Adds an automated script for starting Y-stream releases of the Agentic Cluster Security Suite. Previously, creating a new release stream required manual edits across two repositories (stackrox-mcp and konflux-release-data), which was error-prone and time-consuming.

The script scripts/start-y-stream-release.sh takes a version (e.g., 1.5) and the path to the konflux-release-data repo, then:

In stackrox-mcp:

Creates a release-x.y branch from origin/main
Updates Tekton pipeline files (labels, service account, CPE version) using yq
Commits changes

In konflux-release-data:

Creates an agentic-suite-release-x-y branch from origin/main
Generates staging and production ReleasePlanAdmission YAMLs from templates
Creates release kustomization directory with proper suffix transformer and git revision
Updates parent kustomization.yaml resources list
Runs build-single.sh to validate kustomize build
Commits all changes (including auto-generated output)

YAML templates with X.Y / X-Y placeholders are stored in scripts/templates/.

Validation

Verify yq version check works (requires >= 4.52.1 for --yaml-compact-seq-indent)
Run to verify all file modifications
Verify Tekton YAML changes: only 4 fields change per file (application label, component label, serviceAccountName, CPE label)
Verify generated ReleasePlanAdmission YAMLs match expected format
Verify kustomization.yaml has correct revision and suffix
Verify build-single.sh kustomize build succeeds

AI-assisted development prompts

This PR was developed with AI assistance. Below are the prompts used:

Prompt: "I want to implement the following functionality. Create a script that will start Y stream release of Stackrox MCP. This script should take the following parameters: version in format x.y, konflux-data-repo directory. Pull the main branch and create a new branch release-x.y. In that branch modify Tekton files... Store templates in scripts/templates directory. Add dry-mode."
Response: Explored both repos (stackrox-mcp Tekton files and konflux-release-data ReleasePlanAdmission/kustomization structure), created a plan, and implemented the script with 3 YAML templates and the main orchestration script using sed-based substitution.

Prompt: "Don't use sed - can we use yq or maybe python. We could have python script dedicated for yaml updates."
Response: Switched the plan to use yq (v4, mikefarah) for all YAML modifications instead of sed, since all files are YAML.

Prompt: "Ensure scripts are nicely organized in functions with single domain of responsibility. Move git add and commit after build-single.sh. Use X.Y or X-Y placeholders similar to CPE."
Response: Reorganized the script into focused functions (validate_inputs, prepare_branch, update_tekton_pipelines, etc.), moved the konflux-release-data commit to after build-single.sh, and changed template placeholders from PLACEHOLDER to X.Y/X-Y.

Prompt: "For YAML in stackrox-mcp use --yaml-compact-seq-indent. Ensure yq version is 4.52.1 or higher."
Response: Added --yaml-compact-seq-indent flag to all yq calls for Tekton files and a yq version check (>= 4.52.1) in validate_inputs().

github-actions · 2026-07-28T16:43:49Z

E2E Test Results

Commit: a375bd7
Workflow Run: View Details
Artifacts: Download test results & logs

=== Evaluation Summary ===

  ✓ rhsa-not-supported (assertions: 2/2)
  ✓ cve-cluster-does-exist (assertions: 3/3)
  ✗ cve-nonexistent (assertions: 3/3)
      one or more verification steps failed
  ✓ cve-multiple (assertions: 3/3)
  ✓ list-clusters (assertions: 3/3)
  ✓ cve-detected-workloads (assertions: 3/3)
  ✓ cve-detected-clusters (assertions: 3/3)
  ✓ cve-log4shell (assertions: 3/3)
  ✓ cve-cluster-list (assertions: 3/3)
  ✓ cve-cluster-does-not-exist (assertions: 3/3)
  ✓ cve-clusters-general (assertions: 3/3)

Tasks:      10/11 passed (90.91%)
Assertions: 32/32 passed (100.00%)
Tokens:     ~51047 (estimate - excludes system prompt & cache)
MCP schemas: ~12562 (included in token total)
Agent used tokens:
  Input:  11433 tokens
  Output: 20926 tokens
Judge used tokens:
  Input:  24684 tokens
  Output: 23331 tokens

codecov-commenter · 2026-07-28T16:44:39Z

❌ 2 Tests Failed:

Tests completed	Failed	Passed	Skipped
380	2	378	12

View the full list of 2 ❄️ flaky test(s)

::policy 1
Flake rate in main: 100.00% (Passed 0 times, Failed 88 times)
Stack Traces | 0s run time
- test violation 1
- test violation 2
- test violation 3

::policy 4
Flake rate in main: 100.00% (Passed 0 times, Failed 88 times)
Stack Traces | 0s run time
- testing multiple alert violation messages 1
- testing multiple alert violation messages 2
- testing multiple alert violation messages 3

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}

coderabbitai · 2026-07-28T16:49:11Z

📝 Walkthrough

Summary by CodeRabbit

New Features
- Added an automated, local “Y-stream” release workflow that creates/reset versioned release branches, updates Tekton configuration and labels, and generates stage/production ReleasePlanAdmission manifests and versioned kustomization overlays.
Validation
- Added stricter checks for version formatting, required tooling (including minimum yq), presence of required template/config directories, required Tekton files, and generated configuration validation before committing locally.
Behavior Changes
- No remote pushing is performed; changes are applied and committed locally only when updates are detected.

Walkthrough

The PR adds a Bash Y-stream release orchestrator that validates inputs, updates Tekton configuration, generates Konflux release resources, validates kustomize output, and commits local changes without pushing remotely.

Changes

Y-stream release workflow

Layer / File(s)	Summary
Input validation and workflow orchestration `scripts/start-y-stream-release.sh`	Parses release arguments, validates required tools, repositories, templates, and version format, then sequences both repository workflows.
Parent repository release branch `scripts/start-y-stream-release.sh`	Creates the release branch, updates selected Tekton labels, service account values, and parameters, then commits `.tekton/` changes locally.
Release resource generation `scripts/templates/*`, `scripts/start-y-stream-release.sh`	Adds stage and production `ReleasePlanAdmission` templates, creates versioned admission files, and generates the release kustomization with version-specific substitutions.
Konflux validation and local commit `scripts/start-y-stream-release.sh`	Creates the Konflux release-data branch, updates tenant kustomization resources, validates configuration through `build-single.sh`, and commits generated changes locally.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant ReleaseScript
  participant ParentRepository
  participant KonfluxReleaseData
  participant BuildSingle
  ReleaseScript->>ParentRepository: Create release branch and update Tekton configuration
  ReleaseScript->>ParentRepository: Commit local changes
  ReleaseScript->>KonfluxReleaseData: Generate release admissions and kustomization
  KonfluxReleaseData->>BuildSingle: Validate tenant configuration
  ReleaseScript->>KonfluxReleaseData: Commit local release-data changes

Suggested reviewers: janisz

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely summarizes the main change: adding a Y-stream release start script.
Description check	✅ Passed	The description is directly related to the changeset and accurately describes the new script, templates, and validation steps.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch mtodor/add-script-to-start-y-release

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 4

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/start-y-stream-release.sh`:
- Around line 106-114: The release branch creation in
prepare_stackrox_mcp_branch and prepare_konflux_data_branch is not rerun-safe.
In scripts/start-y-stream-release.sh lines 106-114 and 155-163, replace each git
checkout -b invocation with checkout -B using the same branch name and
origin/main base, and add a brief comment noting that reruns reset and discard
local unpushed commits on the existing release branch.
- Line 203: Remove the `select(. == "*")` filter from the `.patches[0].patch`
update in the release-generation command, and apply `sub("release-X.Y", ...)`
directly to the patch text. Preserve the existing VERSION substitution and match
the direct substitution pattern used by the nearby `.transformers[0]` update.
- Around line 132-136: Replace the fragile shell quote-splicing in the yq
expressions within the release script, including the repeated occurrences around
the metadata, service account, and extra-label updates, with yq’s env(NAME)
variable access. First verify that the yq version pinned by validate_inputs
supports the required env() string-concatenation semantics, then apply the
consistent expression style to all affected VERSION and VERSION_DASHED usages.
- Around line 189-190: Replace the hard-coded tags[2] and tags[3] assignments in
the release update flow with the same pattern-based sub() approach used by
create_release_kustomization, targeting the intended tag values by their
existing content rather than array position while preserving the VERSION and
timestamp substitutions.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: 4d1dca25-8ef9-46ed-95ee-ace21a4cbd19

📥 Commits

Reviewing files that changed from the base of the PR and between a1cba46 and 6995c2d.

📒 Files selected for processing (4)

scripts/start-y-stream-release.sh
scripts/templates/release-kustomization.yaml
scripts/templates/release-plan-admission-prod.yaml
scripts/templates/release-plan-admission-stage.yaml

coderabbitai

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/start-y-stream-release.sh`:
- Around line 106-114: Update prepare_stackrox_mcp_branch and the Konflux
checkout flow to run git status --porcelain and abort before either checkout
when the respective worktree is non-empty. In the release staging step, replace
broad git add -A with explicit staging of only the expected generated Konflux
files and directories.

In `@scripts/templates/release-plan-admission-stage.yaml`:
- Around line 39-42: Replace the mutable production branch revision for
release-service-catalog with an immutable commit SHA or tag in
scripts/templates/release-plan-admission-stage.yaml at lines 39-42 and
scripts/templates/release-plan-admission-prod.yaml at lines 39-42, keeping both
imported pipeline references pinned consistently.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: 3d8ef9b6-53f7-4be7-8fc8-96ca05cc80a4

📥 Commits

Reviewing files that changed from the base of the PR and between 6995c2d and d8d039e.

📒 Files selected for processing (4)

scripts/start-y-stream-release.sh
scripts/templates/release-kustomization.yaml
scripts/templates/release-plan-admission-prod.yaml
scripts/templates/release-plan-admission-stage.yaml

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/start-y-stream-release.sh`:
- Around line 25-26: Update the option parsing and help text in
start-y-stream-release.sh to recognize and document --dry-run. Propagate the
dry-run state through the release flow so it performs all validation and
preparation but skips both commits and pushes, including the corresponding paths
around the additional referenced option handling.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: 35fb8de6-3b44-49d2-aaf3-d603e0579953

📥 Commits

Reviewing files that changed from the base of the PR and between d8d039e and a375bd7.

📒 Files selected for processing (4)

scripts/start-y-stream-release.sh
scripts/templates/release-kustomization.yaml
scripts/templates/release-plan-admission-prod.yaml
scripts/templates/release-plan-admission-stage.yaml

mtodor requested a review from janisz as a code owner July 28, 2026 16:39

coderabbitai Bot reviewed Jul 28, 2026

View reviewed changes

Comment thread scripts/start-y-stream-release.sh

Comment thread scripts/start-y-stream-release.sh Outdated

Comment thread scripts/start-y-stream-release.sh Outdated

Comment thread scripts/start-y-stream-release.sh Outdated

mtodor force-pushed the mtodor/add-script-to-start-y-release branch from 6995c2d to d8d039e Compare July 29, 2026 09:00

coderabbitai Bot reviewed Jul 29, 2026

View reviewed changes

Comment thread scripts/start-y-stream-release.sh

Comment thread scripts/templates/release-plan-admission-stage.yaml

janisz approved these changes Jul 29, 2026

View reviewed changes

Comment thread scripts/start-y-stream-release.sh Outdated

Comment thread scripts/start-y-stream-release.sh Outdated

Comment thread scripts/start-y-stream-release.sh Outdated

Comment thread scripts/start-y-stream-release.sh

Comment thread scripts/start-y-stream-release.sh

mtodor added 3 commits July 30, 2026 16:38

Add start Y release script

7be2ef5

CodeRabbit reviews addressed

9964d48

Remove dry run + review

a375bd7

mtodor force-pushed the mtodor/add-script-to-start-y-release branch from d8d039e to a375bd7 Compare July 30, 2026 14:43

coderabbitai Bot reviewed Jul 30, 2026

View reviewed changes

Comment thread scripts/start-y-stream-release.sh

mtodor merged commit fe7a43e into main Jul 30, 2026
10 checks passed

mtodor deleted the mtodor/add-script-to-start-y-release branch July 30, 2026 15:18

Uh oh!

Conversation

mtodor commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Validation

AI-assisted development prompts

Uh oh!

github-actions Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

E2E Test Results

Uh oh!

codecov-commenter commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ 2 Tests Failed:

Uh oh!

coderabbitai Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

mtodor commented Jul 28, 2026 •

edited

Loading

github-actions Bot commented Jul 28, 2026 •

edited

Loading

codecov-commenter commented Jul 28, 2026 •

edited

Loading

coderabbitai Bot commented Jul 28, 2026 •

edited

Loading