CNTRLPLANE-3050: feat(ci): use Konflux-built image for GitHub Actions runners#8092
Conversation
CNTRLPLANE-3050 Switch the ARC runner image from the manually-built personal registry image (quay.io/rh_ee_brcox/arc-runner) to the Konflux-built image (quay.io/redhat-user-workloads/crt-redhat-acm-tenant/hypershift-gh-actions-runner). The image is now automatically built on every push to main that modifies Dockerfile.github-actions-runner, producing multi-arch images (amd64 + arm64) with pre-built golangci-lint and kube-api-linter plugin. Update the README to reflect the new automated build workflow and remove manual podman build instructions. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
openshift-ci-robot
added
the
jira/valid-reference
|
Skipping CI for Draft Pull Request. |
|
@celebdor: This pull request references CNTRLPLANE-3050 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "4.22.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
Bot
added
do-not-merge/needs-area
area/ci-tooling
📝 WalkthroughWalkthroughUpdated the GitHub Actions runner configuration to reflect automated image builds and publishing via Konflux/Tekton instead of manual ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
Scheduling tests matching the |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: bryan-cox, celebdor The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
Test Resultse2e-aws
e2e-aks
|
openshift-ci
Bot
removed
the
do-not-merge/work-in-progress
|
@celebdor: This pull request references CNTRLPLANE-3050 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "4.22.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/override "ci/prow/e2e-aks" |
|
@celebdor: Overrode contexts on behalf of celebdor: ci/prow/e2e-aks, ci/prow/e2e-aws, ci/prow/e2e-azure-self-managed, ci/prow/e2e-kubevirt-aws-ovn-reduced DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@hack/github-actions-runner/values.yaml`:
- Line 11: The image reference in the Helm values (key "image" in values.yaml)
uses the mutable tag ":latest"; replace it with an immutable reference by
pinning to a specific tag or preferably an image digest (e.g. use
quay.io/...@sha256:...) so deployments are deterministic and supply-chain
secure; update the "image" value in values.yaml (and any related image/tag
fields if present) to the chosen tag or digest and document the release/tag used
for future roll-forward via Helm.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: 02a44da2-a651-4779-86fb-5dd948418893
📒 Files selected for processing (2)
hack/github-actions-runner/README.mdhack/github-actions-runner/values.yaml
| containers: | ||
| - name: runner | ||
| image: quay.io/rh_ee_brcox/arc-runner@sha256:897c2265433960b2011a1fac3a39d0ce82e8e6ead8bd317b56715896ef16c368 | ||
| image: quay.io/redhat-user-workloads/crt-redhat-acm-tenant/hypershift-gh-actions-runner:latest |
There was a problem hiding this comment.
Use an immutable image reference instead of :latest.
Line 11 uses a mutable tag, which makes runner behavior non-deterministic and weakens supply-chain control for CI infrastructure. Prefer pinning to a Konflux commit tag (or digest) and rolling forward intentionally via Helm.
Proposed change
- image: quay.io/redhat-user-workloads/crt-redhat-acm-tenant/hypershift-gh-actions-runner:latest
+ image: quay.io/redhat-user-workloads/crt-redhat-acm-tenant/hypershift-gh-actions-runner:<commit-sha>
+# or:
+# image: quay.io/redhat-user-workloads/crt-redhat-acm-tenant/hypershift-gh-actions-runner@sha256:<digest>🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@hack/github-actions-runner/values.yaml` at line 11, The image reference in
the Helm values (key "image" in values.yaml) uses the mutable tag ":latest";
replace it with an immutable reference by pinning to a specific tag or
preferably an image digest (e.g. use quay.io/...@sha256:...) so deployments are
deterministic and supply-chain secure; update the "image" value in values.yaml
(and any related image/tag fields if present) to the chosen tag or digest and
document the release/tag used for future roll-forward via Helm.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #8092 +/- ##
=======================================
Coverage ? 26.56%
=======================================
Files ? 1087
Lines ? 105041
Branches ? 0
=======================================
Hits ? 27901
Misses ? 74731
Partials ? 2409 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
|
/override ci/prow/e2e-azure-self-managed |
|
@celebdor: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
4 participants
What this PR does / why we need it:
Switches the ARC runner image from the manually-built personal registry
image (
quay.io/rh_ee_brcox/arc-runner) to the Konflux-built image(
quay.io/redhat-user-workloads/crt-redhat-acm-tenant/hypershift-gh-actions-runner:latest).The image is now automatically built on every push to
mainthat modifiesDockerfile.github-actions-runner, producing multi-arch images (amd64 +arm64) with pre-built golangci-lint and kube-api-linter plugin.
Updates the README to reflect the new automated build workflow and removes
the manual podman build instructions.
Which issue(s) this PR fixes:
Fixes CNTRLPLANE-3050
Special notes for your reviewer:
The Helm upgrade has already been applied to the live ARC runner set. This
PR updates the checked-in values file and documentation to match.
Checklist:
🤖 Generated with Claude Code
Summary by CodeRabbit
Documentation
Chores