ROX-34386: Backport changes from release branch by mtodor · Pull Request #171 · stackrox/stackrox-mcp

mtodor · 2026-07-24T09:31:43Z

Description

This PR backports changes done in release branch.

PR that adds labels: ROX-34386: Add image labels #162
PR that splits main and release pipeline: ROX-34386: Split main and release pipeline to remove image expire #169

Note for reviewer

specific version related changes should not be included (i.e. CPE, Konflux Application/Component name, etc.)

Validation

Let Konflux pipeline for PR run
Trigger Konflux "main push" pipeline with label
Check labels for build images by PR and main push pipeline are correct
Check that Snyk step runs

coderabbitai · 2026-07-24T09:35:38Z

📝 Walkthrough

Walkthrough

Changes

The Tekton manifests separate main and release triggers, add CPE labels, and configure release builds. The component pipeline derives Git-based versions for image and Coverity tasks. The Dockerfile adds versioned runtime image metadata.

Konflux versioned builds

Layer / File(s)	Summary
Main and release trigger manifests `.tekton/acs-mcp-server-pull-request.yaml`, `.tekton/acs-mcp-server-push-main.yaml`, `.tekton/acs-mcp-server-push-release.yaml`	Main, pull request, and release PipelineRuns define event filters, build parameters, CPE labels, pipeline wiring, and execution settings.
Version derivation and build propagation `.tekton/basic-component-pipeline.yaml`	The pipeline derives `VERSION` from Git tags and passes it to container and Coverity tasks while combining generated and extra labels.
Runtime image metadata `konflux.Dockerfile`	The runtime image accepts `VERSION` and defines container metadata labels.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitEvent
  participant PipelineAsCode
  participant PipelineRun
  participant basic-component-pipeline
  participant determine-version
  participant buildah-remote-oci-ta
  GitEvent->>PipelineAsCode: push or pull_request event
  PipelineAsCode->>PipelineRun: select main or release trigger
  PipelineRun->>basic-component-pipeline: start configured pipeline
  basic-component-pipeline->>determine-version: provide cloned source
  determine-version->>determine-version: run git describe --tags --always
  determine-version->>buildah-remote-oci-ta: provide VERSION and combined LABELS

Suggested reviewers: janisz

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title accurately summarizes the main change: backporting release-branch changes.
Description check	✅ Passed	The description is clearly related to the changeset and explains the backport scope and validation.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch mtodor/ROX-34386-backport-changes-from-release

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.tekton/acs-mcp-server-pull-request.yaml:
- Around line 57-60: Remove the placeholder extra-labels block from
.tekton/acs-mcp-server-pull-request.yaml lines 57-60,
.tekton/acs-mcp-server-push-main.yaml lines 68-71, and
.tekton/acs-mcp-server-push-release.yaml lines 66-69 so no pipeline publishes
the literal X.Y CPE version.

In @.tekton/basic-component-pipeline.yaml:
- Around line 200-205: Add a suitable limits.cpu value under
computeResources.limits in the shared stepTemplate for the new task steps,
alongside the existing memory limit, so both containers receive CPU limits while
preserving the current CPU request.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: 86d619d4-8f80-42d5-a90e-ec0c06a95890

📥 Commits

Reviewing files that changed from the base of the PR and between c34f9f6 and 6818169.

📒 Files selected for processing (5)

.tekton/acs-mcp-server-pull-request.yaml
.tekton/acs-mcp-server-push-main.yaml
.tekton/acs-mcp-server-push-release.yaml
.tekton/basic-component-pipeline.yaml
konflux.Dockerfile

github-actions · 2026-07-24T09:36:04Z

E2E Test Results

Commit: 6f566b1
Workflow Run: View Details
Artifacts: Download test results & logs

=== Evaluation Summary ===

  ✓ rhsa-not-supported (assertions: 2/2)
  ✓ cve-cluster-does-not-exist (assertions: 3/3)
  ✓ cve-cluster-does-exist (assertions: 3/3)
  ✓ cve-detected-workloads (assertions: 3/3)
  ✓ cve-nonexistent (assertions: 3/3)
  ✓ cve-cluster-list (assertions: 3/3)
  ✓ cve-multiple (assertions: 3/3)
  ✓ cve-clusters-general (assertions: 3/3)
  ✓ cve-log4shell (assertions: 3/3)
  ✓ cve-detected-clusters (assertions: 3/3)
  ✓ list-clusters (assertions: 3/3)

Tasks:      11/11 passed (100.00%)
Assertions: 32/32 passed (100.00%)
Tokens:     ~53389 (estimate - excludes system prompt & cache)
MCP schemas: ~12562 (included in token total)
Agent used tokens:
  Input:  15230 tokens
  Output: 21775 tokens
Judge used tokens:
  Input:  60108 tokens
  Output: 47027 tokens

codecov-commenter · 2026-07-24T09:36:19Z

❌ 2 Tests Failed:

Tests completed	Failed	Passed	Skipped
380	2	378	12

View the full list of 2 ❄️ flaky test(s)

::policy 1
Flake rate in main: 100.00% (Passed 0 times, Failed 74 times)
Stack Traces | 0s run time
- test violation 1
- test violation 2
- test violation 3

::policy 4
Flake rate in main: 100.00% (Passed 0 times, Failed 74 times)
Stack Traces | 0s run time
- testing multiple alert violation messages 1
- testing multiple alert violation messages 2
- testing multiple alert violation messages 3

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.tekton/acs-mcp-server-push-main.yaml:
- Around line 21-27: Remove the pull_request trigger branch from the push
trigger conditions in .tekton/acs-mcp-server-push-main.yaml lines 21-27,
retaining only the main push trigger. Apply the same change in
.tekton/acs-mcp-server-push-release.yaml lines 21-27, retaining the release and
tag push triggers.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: f66be5cf-29f6-438b-844a-26d5efe2ac34

📥 Commits

Reviewing files that changed from the base of the PR and between 6818169 and 67654a9.

📒 Files selected for processing (5)

.tekton/acs-mcp-server-pull-request.yaml
.tekton/acs-mcp-server-push-main.yaml
.tekton/acs-mcp-server-push-release.yaml
.tekton/basic-component-pipeline.yaml
konflux.Dockerfile

mtodor requested a review from janisz as a code owner July 24, 2026 09:31

mtodor changed the title ~~Mtodor/rox 34386 backport changes from release~~ ROX-34386: Backport changes from release branch Jul 24, 2026

coderabbitai Bot reviewed Jul 24, 2026

View reviewed changes

Comment thread .tekton/acs-mcp-server-pull-request.yaml

Comment thread .tekton/basic-component-pipeline.yaml

mtodor force-pushed the mtodor/ROX-34386-backport-changes-from-release branch from 6818169 to 67654a9 Compare July 24, 2026 09:53

coderabbitai Bot reviewed Jul 24, 2026

View reviewed changes

Comment thread .tekton/acs-mcp-server-push-main.yaml

mtodor added the konflux-build label Jul 27, 2026

mtodor added 2 commits July 27, 2026 13:05

Backport add image labels

0b320e8

Backport split main and release pipeline to remove image expire

6f566b1

mtodor force-pushed the mtodor/ROX-34386-backport-changes-from-release branch from 67654a9 to 6f566b1 Compare July 27, 2026 11:05

janisz approved these changes Jul 27, 2026

View reviewed changes

mtodor merged commit 23a7402 into main Jul 27, 2026
11 checks passed

mtodor deleted the mtodor/ROX-34386-backport-changes-from-release branch July 27, 2026 16:51

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

ROX-34386: Backport changes from release branch - #171

ROX-34386: Backport changes from release branch#171
mtodor merged 2 commits into
mainfrom
mtodor/ROX-34386-backport-changes-from-release

mtodor commented Jul 24, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Jul 24, 2026 •

edited

Loading

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jul 24, 2026 •

edited

Loading

Uh oh!

codecov-commenter commented Jul 24, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

mtodor commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Validation

Uh oh!

coderabbitai Bot commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

E2E Test Results

Uh oh!

codecov-commenter commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ 2 Tests Failed:

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

mtodor commented Jul 24, 2026 •

edited

Loading

coderabbitai Bot commented Jul 24, 2026 •

edited

Loading

github-actions Bot commented Jul 24, 2026 •

edited

Loading

codecov-commenter commented Jul 24, 2026 •

edited

Loading