Skip to content

Automate CPE label update in release branch setup script #3536

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dheerajodha wants to merge 6 commits into
base: main
Choose a base branch
from
+35 −1
Open

Automate CPE label update in release branch setup script #3536

Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
39fffcc
Automate CPE label update in release branch setup script
dheerajodha Sep 3, 2026
9f5f176
Validate CPE_VERSION format before sed interpolation
dheerajodha Sep 3, 2026
fb51af7
Rename CPE_VERSION to TAS_VERSION for clarity
dheerajodha Sep 8, 2026
71a1275
Verify sed substitution succeeded in Dockerfile.dist
dheerajodha Sep 8, 2026
3818448
Use portable sed -i and fix echo to match inserted form
dheerajodha Sep 8, 2026
02c82ba
Split sed into two commands for readability and portability
dheerajodha Sep 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 35 additions & 1 deletion hack/release-branch-pipeline-patch.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,6 +91,40 @@ EOT
awk "$awk_query" <(git show main:$MAIN_PR_PIPELINE) > $RELEASE_PR_PIPELINE
awk "$awk_query" <(git show main:$MAIN_PUSH_PIPELINE) > $RELEASE_PUSH_PIPELINE

# Set the CPE and name labels in Dockerfile.dist for the release branch.
# The TAS (Trusted Artifact Signer) version doesn't necessarily follow
# the Conforma version, so it must be provided explicitly.
TAS_VERSION="${TAS_VERSION:-}"
if [[ -z "$TAS_VERSION" ]]; then
read -rp "Enter the TAS version for this release (e.g. 1.5): " TAS_VERSION

@fullsend-ai-review fullsend-ai-review Bot Sep 8, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] error-handling

read -rp runs unguarded under set -o errexit. In a non-interactive context (CI, stdin closed) read returns non-zero on EOF, which under errexit terminates the script immediately with no output; the intended echo Error: TAS version is required at line 103 is never reached. Callers see a bare non-zero exit with no explanation.

Suggested fix: read -rp "..." TAS_VERSION || true, or guard with if [[ -t 0 ]]; then read -rp ...; fi, so the subsequent [[ -z "$TAS_VERSION" ]] check runs and emits the informative error.

fi

if [[ -z "$TAS_VERSION" ]]; then
echo "Error: TAS version is required"
exit 1
fi

if [[ ! "$TAS_VERSION" =~ ^[0-9]+\.[0-9]+$ ]]; then
echo "Error: TAS version must be in MAJOR.MINOR format (e.g. 1.5), got: ${TAS_VERSION}"
exit 1
fi

sed -i.bak -e 's|name="ec"|name="rhtas/ec-rhel9"|' Dockerfile.dist
rm -f Dockerfile.dist.bak
sed -i.bak -e "/name=\"rhtas\/ec-rhel9\"/a\\
cpe=\"cpe:/a:redhat:trusted_artifact_signer:${TAS_VERSION}::el9\" \\\\" Dockerfile.dist
rm -f Dockerfile.dist.bak

grep -q "cpe:/a:redhat:trusted_artifact_signer:${TAS_VERSION}::el9" Dockerfile.dist || {

@fullsend-ai-review fullsend-ai-review Bot Sep 8, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] correctness

grep -q cpe:/a:redhat:trusted_artifact_signer:${TAS_VERSION}::el9 interpolates ${TAS_VERSION} (containing a literal .) into a BRE, where . matches any character. The ^[0-9]+.[0-9]+$ validator makes a false positive essentially impossible in practice, but defensive scripting prefers fixed-string matching.

Suggested fix: Use grep -qF to treat the pattern as a fixed string.

echo "Error: failed to update Dockerfile.dist labels (pattern not found — file may already be patched, or the label format changed)"
exit 1
}

echo "Updated Dockerfile.dist labels:"
echo " name=\"rhtas/ec-rhel9\" \\"
echo " cpe=\"cpe:/a:redhat:trusted_artifact_signer:${TAS_VERSION}::el9\""
echo ""

echo "To review the new pipeline definitions:"
echo " vimdiff <(git show main:$MAIN_PR_PIPELINE) $RELEASE_PR_PIPELINE"
echo " vimdiff <(git show main:$MAIN_PUSH_PIPELINE) $RELEASE_PUSH_PIPELINE"
Expand All @@ -100,4 +134,4 @@ echo " vimdiff <(git show release-v$OLD_VERSION:$OLD_RELEASE_PUSH_PIPELINE) $RE
echo ""
echo "If the above comparisons look good then you probably want to do this:"
echo " git rm $MAIN_PR_PIPELINE $MAIN_PUSH_PIPELINE"
echo " git add $RELEASE_PR_PIPELINE $RELEASE_PUSH_PIPELINE"
echo " git add $RELEASE_PR_PIPELINE $RELEASE_PUSH_PIPELINE Dockerfile.dist"
Loading