ROX-34386: Backport changes from release branch

[mtodor]

Description

This PR backports changes done in release branch.

• PR that adds labels: ROX-34386: Add image labels #162
• PR that splits main and release pipeline: ROX-34386: Split main and release pipeline to remove image expire #169

Note for reviewer

• specific version related changes should not be included (i.e. CPE, Konflux Application/Component name, etc.)

Validation

• Let Konflux pipeline for PR run
• Trigger Konflux "main push" pipeline with label
• Check labels for build images by PR and main push pipeline are correct
• Check that Snyk step runs

[coderabbitai]

📝 Walkthrough

Walkthrough

Changes

The Tekton manifests separate main and release triggers, add CPE labels, and configure release builds. The component pipeline derives Git-based versions for image and Coverity tasks. The Dockerfile adds versioned runtime image metadata.

Konflux versioned builds

Layer / File(s)	Summary
Main and release trigger manifests .tekton/acs-mcp-server-pull-request.yaml, .tekton/acs-mcp-server-push-main.yaml, .tekton/acs-mcp-server-push-release.yaml	Main, pull request, and release PipelineRuns define event filters, build parameters, CPE labels, pipeline wiring, and execution settings.
Version derivation and build propagation .tekton/basic-component-pipeline.yaml	The pipeline derives VERSION from Git tags and passes it to container and Coverity tasks while combining generated and extra labels.
Runtime image metadata konflux.Dockerfile	The runtime image accepts VERSION and defines container metadata labels.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitEvent
  participant PipelineAsCode
  participant PipelineRun
  participant basic-component-pipeline
  participant determine-version
  participant buildah-remote-oci-ta
  GitEvent->>PipelineAsCode: push or pull_request event
  PipelineAsCode->>PipelineRun: select main or release trigger
  PipelineRun->>basic-component-pipeline: start configured pipeline
  basic-component-pipeline->>determine-version: provide cloned source
  determine-version->>determine-version: run git describe --tags --always
  determine-version->>buildah-remote-oci-ta: provide VERSION and combined LABELS

Loading

Suggested reviewers: janisz

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title accurately summarizes the main change: backporting release-branch changes.
Description check	✅ Passed	The description is clearly related to the changeset and explains the backport scope and validation.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch mtodor/ROX-34386-backport-changes-from-release

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.tekton/acs-mcp-server-pull-request.yaml:
- Around line 57-60: Remove the placeholder extra-labels block from
.tekton/acs-mcp-server-pull-request.yaml lines 57-60,
.tekton/acs-mcp-server-push-main.yaml lines 68-71, and
.tekton/acs-mcp-server-push-release.yaml lines 66-69 so no pipeline publishes
the literal X.Y CPE version.

In @.tekton/basic-component-pipeline.yaml:
- Around line 200-205: Add a suitable limits.cpu value under
computeResources.limits in the shared stepTemplate for the new task steps,
alongside the existing memory limit, so both containers receive CPU limits while
preserving the current CPU request.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: 86d619d4-8f80-42d5-a90e-ec0c06a95890

📥 Commits

Reviewing files that changed from the base of the PR and between c34f9f6 and 6818169.

📒 Files selected for processing (5)

• .tekton/acs-mcp-server-pull-request.yaml
• .tekton/acs-mcp-server-push-main.yaml
• .tekton/acs-mcp-server-push-release.yaml
• .tekton/basic-component-pipeline.yaml
• konflux.Dockerfile

[github-actions]

E2E Test Results

Commit: 6f566b1
Workflow Run: View Details
Artifacts: Download test results & logs

=== Evaluation Summary ===

  ✓ rhsa-not-supported (assertions: 2/2)
  ✓ cve-cluster-does-not-exist (assertions: 3/3)
  ✓ cve-cluster-does-exist (assertions: 3/3)
  ✓ cve-detected-workloads (assertions: 3/3)
  ✓ cve-nonexistent (assertions: 3/3)
  ✓ cve-cluster-list (assertions: 3/3)
  ✓ cve-multiple (assertions: 3/3)
  ✓ cve-clusters-general (assertions: 3/3)
  ✓ cve-log4shell (assertions: 3/3)
  ✓ cve-detected-clusters (assertions: 3/3)
  ✓ list-clusters (assertions: 3/3)

Tasks:      11/11 passed (100.00%)
Assertions: 32/32 passed (100.00%)
Tokens:     ~53389 (estimate - excludes system prompt & cache)
MCP schemas: ~12562 (included in token total)
Agent used tokens:
  Input:  15230 tokens
  Output: 21775 tokens
Judge used tokens:
  Input:  60108 tokens
  Output: 47027 tokens

[codecov-commenter]

❌ 2 Tests Failed:

Tests completed	Failed	Passed	Skipped
380	2	378	12

View the full list of 2 ❄️ flaky test(s)

::policy 1

Flake rate in main: 100.00% (Passed 0 times, Failed 74 times)

Stack Traces | 0s run time

- test violation 1
- test violation 2
- test violation 3

::policy 4

Flake rate in main: 100.00% (Passed 0 times, Failed 74 times)

Stack Traces | 0s run time

- testing multiple alert violation messages 1
- testing multiple alert violation messages 2
- testing multiple alert violation messages 3

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.tekton/acs-mcp-server-push-main.yaml:
- Around line 21-27: Remove the pull_request trigger branch from the push
trigger conditions in .tekton/acs-mcp-server-push-main.yaml lines 21-27,
retaining only the main push trigger. Apply the same change in
.tekton/acs-mcp-server-push-release.yaml lines 21-27, retaining the release and
tag push triggers.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: f66be5cf-29f6-438b-844a-26d5efe2ac34

📥 Commits

Reviewing files that changed from the base of the PR and between 6818169 and 67654a9.

📒 Files selected for processing (5)

• .tekton/acs-mcp-server-pull-request.yaml
• .tekton/acs-mcp-server-push-main.yaml
• .tekton/acs-mcp-server-push-release.yaml
• .tekton/basic-component-pipeline.yaml
• konflux.Dockerfile