Repository navigation
Conversation
Document the tenant enforcement feature across the operator-facing docs: - config.md: server.tenant.* field reference, env vars, CLI flags, and validation rules - deployment.md: Helm values for tenant enforcement plus schema-enforced invariants and existingConfigMap behavior - authentication.md: trust model (gateway-injected headers, not JWT claims) and request behavior (403/404) - api-operator-guide.md: operator overview, config example, and runtime behavior with troubleshooting entries - api-resources.md: API-visible tenant scoping and the read-only tenancy field - runbook.md: tenant enforcement troubleshooting procedures - database.md: tenancy column, containment-based scoping, fail-closed behavior, and uniqueness vs. visibility
…1531-document-tenant-enforcement HYPERFLEET-1531 - docs: document tenant enforcement
Signed-off-by: red-hat-konflux-kflux-prd-rh02 <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com>
…/konflux/references/main Update Konflux references digest
…1789040808 Signed-off-by: red-hat-konflux-kflux-prd-rh02 <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com>
…/konflux/mintmaker/main/trusted-docker-image-updates Update registry.access.redhat.com/ubi9/go-toolset Docker tag to v9.8-1789040808
…lux-yq-pin HYPERFLEET-1651 - fix: pin Helm chart task to working digest
The push and tag pipelines prefetch only the root Go module, but make build runs the code generator through go tool -modfile=tools/go.mod. Hermeto points GOPROXY at its prefetch output, so oapi-codegen is missing and every on-push build has failed since the prefetch was added. Prefetch the tools module as a second gomod path so the generator resolves and its packages carry Hermeto attribution. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018EkLeTwdmrofNMwKRpDCWG
…eto-prefetch-tools HYPERFLEET-1651 - ci: prefetch tools module for Hermeto
…-1298 HYPERFLEET-1298 - fix: reject search tautologies and unvalidated table.column joins
HYPERFLEET-871 - feat: move write transactions from middleware to services
HYPERFLEET-892 - feat: Align API handler with shared slog config package
Signed-off-by: red-hat-konflux-kflux-prd-rh02 <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com>
…/konflux/references/main Update Konflux references digest
…-1491 HYPERFLEET-1491 - fix: compute observed_generation from adapter reports
…reference invariants
HYPERFLEET-1662 - fix: Prevent force-delete from violating reference invariants
…-1715 HYPERFLEET-1715 - fix: set GOFIPS140=off for boringcrypto builds
Signed-off-by: red-hat-konflux-kflux-prd-rh02 <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com>
…/konflux/references/main Update Konflux references 0.x
Signed-off-by: red-hat-konflux-kflux-prd-rh02 <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com>
…1790174511 Signed-off-by: red-hat-konflux-kflux-prd-rh02 <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com>
…1377-name-length-validation HYPERFLEET-1377 - fix: enforce resource name database limit
…/HYPERFLEET-1744 HYPERFLEET-1744 - fix: re-pin Konflux task bundles to valid digests
…-1740 HYPERFLEET-1740 - fix: enforce FIPS-compliant build flags
Signed-off-by: red-hat-konflux-kflux-prd-rh02 <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com>
…/konflux/references/main Update Konflux references 0.x
…1791479310 Signed-off-by: red-hat-konflux-kflux-prd-rh02 <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com>
Signed-off-by: red-hat-konflux-kflux-prd-rh02 <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com>
…/konflux/mintmaker/main/gomod-non-major Update gomod non-major
…/konflux/mintmaker/main/trusted-docker-image-updates Update registry.access.redhat.com/ubi9/go-toolset Docker tag to v9.8-1791479310
…1679 HYPERFLEET-1679 - fix: advertise https Service/container port when AP…
…ET-1200-owners-files HYPERFLEET-1762 - chore: narrow OWNERS to area owners and aliases
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [quay.io/konflux-ci/tekton-catalog/task-build-helm-chart-oci-ta](https://redirect.github.com/konflux-ci/tekton-tools/tree/cf53f00bb0b2b6a52999d31d9411c9cf18ddb233/tasks/build-helm-chart-oci-ta/0.4) ([source](https://redirect.github.com/konflux-ci/tekton-tools/tree/HEAD/task/build-helm-chart-oci-ta), [changelog](https://redirect.github.com/konflux-ci/tekton-tools/blob/main/task/build-helm-chart-oci-ta/CHANGELOG.md)) | tekton-bundle | digest | `9149087` → `60153fc` | | [quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta](https://redirect.github.com/konflux-ci/container-build-catalog/tree/73412d8905f04013b2e89a4d707f2787d20fd637/task/buildah-oci-ta) ([source](https://redirect.github.com/konflux-ci/container-build-catalog/tree/HEAD/task/buildah-oci-ta), [changelog](https://redirect.github.com/konflux-ci/container-build-catalog/blob/main/task/buildah-oci-ta/CHANGELOG.md)) | tekton-bundle | minor | `0.13.0` → `0.14.0` | | [quay.io/konflux-ci/tekton-catalog/task-clamav-scan](https://redirect.github.com/konflux-ci/konflux-test-tasks/tree/62d088763ce201dc610cc758dcb41059de828433/task/clamav-scan/0.3) ([source](https://redirect.github.com/konflux-ci/konflux-test-tasks/tree/HEAD/task/clamav-scan), [changelog](https://redirect.github.com/konflux-ci/konflux-test-tasks/blob/main/task/clamav-scan/CHANGELOG.md)) | tekton-bundle | digest | `6fe7e04` → `6c7e4e2` | | [quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks](https://redirect.github.com/konflux-ci/build-definitions/tree/84409b2cfb5cadd19bb6b5b28873569d34ef72fd/task/ecosystem-cert-preflight-checks/0.2) ([source](https://redirect.github.com/konflux-ci/build-definitions/tree/HEAD/task/ecosystem-cert-preflight-checks), [changelog](https://redirect.github.com/konflux-ci/build-definitions/blob/main/task/ecosystem-cert-preflight-checks/CHANGELOG.md)) | tekton-bundle | digest | `4390141` → `cc7d71d` | | [quay.io/konflux-ci/tekton-catalog/task-init](https://redirect.github.com/konflux-ci/build-definitions/tree/fa51c97e2792750a8c3a055205455f1b1cd1b224/task/init/0.4) ([source](https://redirect.github.com/konflux-ci/build-definitions/tree/HEAD/task/init), [changelog](https://redirect.github.com/konflux-ci/build-definitions/blob/main/task/init/CHANGELOG.md)) | tekton-bundle | digest | `7854d7b` → `5197c2d` | | [quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta](https://redirect.github.com/konflux-ci/container-build-catalog/tree/73412d8905f04013b2e89a4d707f2787d20fd637/task/prefetch-dependencies-oci-ta) ([source](https://redirect.github.com/konflux-ci/container-build-catalog/tree/HEAD/task/prefetch-dependencies-oci-ta), [changelog](https://redirect.github.com/konflux-ci/container-build-catalog/blob/main/task/prefetch-dependencies-oci-ta/CHANGELOG.md)) | tekton-bundle | minor | `0.10.3` → `0.11.0` | | [quay.io/konflux-ci/tekton-catalog/task-roxctl-scan](https://redirect.github.com/konflux-ci/konflux-test-tasks/tree/2aaa5a3fccbf553b98ed01bb1f37a585833f1fde/task/roxctl-scan/0.1) ([source](https://redirect.github.com/konflux-ci/konflux-test-tasks/tree/HEAD/task/roxctl-scan), [changelog](https://redirect.github.com/konflux-ci/konflux-test-tasks/blob/main/task/roxctl-scan/CHANGELOG.md)) | tekton-bundle | patch | `0.1` → `0.1.1` | | [quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan](https://redirect.github.com/konflux-ci/tekton-tools/tree/cf53f00bb0b2b6a52999d31d9411c9cf18ddb233/tasks/rpms-signature-scan/0.2) ([source](https://redirect.github.com/konflux-ci/tekton-tools/tree/HEAD/task/rpms-signature-scan), [changelog](https://redirect.github.com/konflux-ci/tekton-tools/blob/main/task/rpms-signature-scan/CHANGELOG.md)) | tekton-bundle | digest | `f72e0ba` → `f3d7323` | | [quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta](https://redirect.github.com/konflux-ci/konflux-sast-tasks/tree/b601167eddf740199af2dbfdef4aa823f429740e/task/sast-shell-check-oci-ta/0.1,!task/sast-shell-check-oci-ta/0.1/recipe.yaml) ([source](https://redirect.github.com/konflux-ci/konflux-sast-tasks/tree/HEAD/task/sast-shell-check-oci-ta), [changelog](https://redirect.github.com/konflux-ci/konflux-sast-tasks/blob/main/task/sast-shell-check-oci-ta/CHANGELOG.md)) | tekton-bundle | digest | `a3bcbf0` → `8372228` | | [quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta](https://redirect.github.com/konflux-ci/konflux-sast-tasks/tree/45ff1ec08d11036e73c265484d17323019076cf6/task/sast-snyk-check-oci-ta/0.5,!task/sast-snyk-check-oci-ta/0.5/recipe.yaml) ([source](https://redirect.github.com/konflux-ci/konflux-sast-tasks/tree/HEAD/task/sast-snyk-check-oci-ta), [changelog](https://redirect.github.com/konflux-ci/konflux-sast-tasks/blob/main/task/sast-snyk-check-oci-ta/CHANGELOG.md)) | tekton-bundle | digest | `d01cd72` → `53443fe` | | [quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta](https://redirect.github.com/konflux-ci/konflux-sast-tasks/tree/b9014148aba1a21c0395bd315f4d7b2eac3f971a/task/sast-unicode-check-oci-ta/0.4,!task/sast-unicode-check-oci-ta/0.4/recipe.yaml) ([source](https://redirect.github.com/konflux-ci/konflux-sast-tasks/tree/HEAD/task/sast-unicode-check-oci-ta), [changelog](https://redirect.github.com/konflux-ci/konflux-sast-tasks/blob/main/task/sast-unicode-check-oci-ta/CHANGELOG.md)) | tekton-bundle | digest | `ec176a3` → `2ee8973` | | [quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta](https://redirect.github.com/konflux-ci/container-build-catalog/tree/73412d8905f04013b2e89a4d707f2787d20fd637/task/source-build-oci-ta) ([source](https://redirect.github.com/konflux-ci/container-build-catalog/tree/HEAD/task/source-build-oci-ta), [changelog](https://redirect.github.com/konflux-ci/container-build-catalog/blob/main/task/source-build-oci-ta/CHANGELOG.md)) | tekton-bundle | minor | `0.3.2` → `0.4.0` | --- ### Release Notes <details> <summary>konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta)</summary> ### [`v0.14.0`](https://redirect.github.com/konflux-ci/container-build-catalog/blob/HEAD/task/buildah-oci-ta/CHANGELOG.md#0140) ##### Changed - Renamed Trusted Artifact parameter `CACHI2_ARTIFACT` to `PREFETCH_ARTIFACT`. - Renamed Trusted Artifact path `/var/workdir/cachi2` to `/var/workdir/prefetch`. Recommended to use `prefetch-dependencies-oci-ta` >= 0.11.0 for naming consistency of the parameter. </details> <details> <summary>konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta)</summary> ### [`v0.11.0`](https://redirect.github.com/konflux-ci/container-build-catalog/blob/HEAD/task/prefetch-dependencies-oci-ta/CHANGELOG.md#0110) ##### Changed - Renamed Trusted Artifact result `CACHI2_ARTIFACT` to `PREFETCH_ARTIFACT`. - Renamed Trusted Artifact path `/var/workdir/cachi2` to `/var/workdir/prefetch`. Recommended to use `buildah-oci-ta` >= 0.14.0 and `source-build-oci-ta` >= 0.4.0 for naming consistency of the result. ### [`v0.10.4`](https://redirect.github.com/konflux-ci/container-build-catalog/blob/HEAD/task/prefetch-dependencies-oci-ta/CHANGELOG.md#0104) <!-- Hermeto's minor reflects a Python version bump -> does not warrant a task minor version bump. --> - Hermeto release - <https://github.com/hermetoproject/hermeto/releases/tag/0.63.0> </details> <details> <summary>konflux-ci/konflux-test-tasks (quay.io/konflux-ci/tekton-catalog/task-roxctl-scan)</summary> ### [`v0.1.1`](https://redirect.github.com/konflux-ci/konflux-test-tasks/blob/HEAD/task/roxctl-scan/CHANGELOG.md#011) ##### Changed - Updated rox-image-scan and exchange-service-account-token steps image to version *4.11.5* by following digest registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel9\@​sha256:98f01d623e119acbbc211bdeb36192b619969aa149d9c66bab8034eeef84c861 </details> <details> <summary>konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta)</summary> ### [`v0.4.0`](https://redirect.github.com/konflux-ci/container-build-catalog/blob/HEAD/task/source-build-oci-ta/CHANGELOG.md#040) ##### Changed - Renamed Trusted Artifact parameter `CACHI2_ARTIFACT` to `PREFETCH_ARTIFACT`. - Renamed Trusted Artifact path `/var/workdir/cachi2` to `/var/workdir/prefetch`. Recommended to use `prefetch-dependencies-oci-ta` >= 0.11.0 for naming consistency of the parameter. </details> --- ### Configuration 📅 **Schedule**: (in timezone UTC) - Branch creation - Only on Saturday (`* * * * 6`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- To execute skipped test pipelines write comment `/ok-to-test`. --- ### Documentation Find out how to configure dependency updates in [MintMaker documentation](https://konflux-ci.dev/docs/mintmaker/user/) or see all available configuration options in [Renovate documentation](https://docs.renovatebot.com/configuration-options/). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC43MS4wLXJwbSIsInVwZGF0ZWRJblZlciI6IjQ0LjcxLjAtcnBtIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJhcHByb3ZlZCIsImxndG0iLCJtYW51YWwtcmV2aWV3LXJlcXVpcmVkIiwib2stdG8tdGVzdCJdfQ==--> Signed-off-by: red-hat-konflux-kflux-prd-rh02 <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com> Co-authored-by: red-hat-konflux-kflux-prd-rh02[bot] <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com>
…1792010711 (openshift-hyperfleet#400) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | registry.access.redhat.com/ubi9/go-toolset | stage | patch | `9.8-1791479310` → `9.8-1792010711` | --- ### Configuration 📅 **Schedule**: (in timezone UTC) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- To execute skipped test pipelines write comment `/ok-to-test`. --- ### Documentation Find out how to configure dependency updates in [MintMaker documentation](https://konflux-ci.dev/docs/mintmaker/user/) or see all available configuration options in [Renovate documentation](https://docs.renovatebot.com/configuration-options/). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC43MS4wLXJwbSIsInVwZGF0ZWRJblZlciI6IjQ0LjcxLjAtcnBtIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJhcHByb3ZlZCIsImxndG0iLCJvay10by10ZXN0Il19--> Signed-off-by: red-hat-konflux-kflux-prd-rh02 <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com> Co-authored-by: red-hat-konflux-kflux-prd-rh02[bot] <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com>
…leet#401) This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp](https://redirect.github.com/open-telemetry/opentelemetry-go-contrib) | `v0.71.0` → `v0.72.0` |  |  | | [go.opentelemetry.io/contrib/propagators/autoprop](https://redirect.github.com/open-telemetry/opentelemetry-go-contrib) | `v0.71.0` → `v0.72.0` |  |  | --- ### Configuration 📅 **Schedule**: (in timezone UTC) - Branch creation - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- To execute skipped test pipelines write comment `/ok-to-test`. --- ### Documentation Find out how to configure dependency updates in [MintMaker documentation](https://konflux-ci.dev/docs/mintmaker/user/) or see all available configuration options in [Renovate documentation](https://docs.renovatebot.com/configuration-options/). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC43MS4wLXJwbSIsInVwZGF0ZWRJblZlciI6IjQ0LjcxLjAtcnBtIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJtYW51YWwtcmV2aWV3LXJlcXVpcmVkIiwib2stdG8tdGVzdCJdfQ==--> Signed-off-by: red-hat-konflux-kflux-prd-rh02 <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com> Co-authored-by: red-hat-konflux-kflux-prd-rh02[bot] <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com>
…penshift-hyperfleet#402) ## What Renames the nine nested `CLAUDE.md` files to `AGENTS.md` with `git mv` (content unchanged except reference updates) and adds a sibling one-line `CLAUDE.md` pointer (`@AGENTS.md`) next to each, mirroring the root pattern. References updated: - `AGENTS.md` (root): package doc index — 8 refs - `CONTRIBUTING.md`: repo tree and resources list now describe `AGENTS.md`; the root `CLAUDE.md` is shown as the pointer it is - `charts/.helmignore`: ignores `AGENTS.md` alongside `CLAUDE.md` - `pkg/db/README.md`: points to `pkg/db/migrations/AGENTS.md` - Cross-references between the renamed files ("Related ... Files" sections) ## Why `AGENTS.md` is the cross-tool standard (OpenCode, Codex, and Claude Code read it directly). Claude Code's default instruction setting skips nested `AGENTS.md` files when a root `CLAUDE.md` exists, so each nested `AGENTS.md` keeps a sibling `CLAUDE.md` pointer — verified empirically with Claude Code v2.1.291 that the pointer lazy-loads and expands the import (same pattern already merged for hyperfleet-applier in openshift-hyperfleet#67). Jira: https://redhat.atlassian.net/browse/HYPERFLEET-1775 ## Verification - Every `CLAUDE.md` in the repo is exactly the one-line `@AGENTS.md` pointer (root + 9 nested) - `grep -rn "CLAUDE"` returns only the intentional entries: `charts/.helmignore` (ignores both names) and the `CONTRIBUTING.md` tree line documenting the root pointer - `pre-commit run` passes on all changed files; pre-push hooks (gofmt, golangci-lint, go vet) pass
…rfleet#403) ### What Align the existing hook revisions and migrate every remote ref to the frozen format (`rev: <full SHA> # frozen: <tag>`), preserving the existing hook selection. - HyperFleet hooks v0.3.0: annotated tag SHA `d9aab6d723c9246bd2f63a982bf1d9cf0805b3a4`, resolving to the validated commit `0c42dbf10d4087ac8c788b19b9d29afd7bccdd4a`. - LeakTK v0.3.12 and pre-commit-hooks v6.0.0, both full-SHA pinned. ### Why Renovate recognizes release/digest pairs through `# frozen:`; the previous `# v...` comments do not activate SHA-preserving extraction. This addresses the SHA-to-tag rewrite seen in hyperfleet-api commit 312f4fa without disabling dependency automation. See [Renovate frozen digest support](renovatebot/renovate#36693). [HYPERFLEET-1812](https://redhat.atlassian.net/browse/HYPERFLEET-1812); coordinated with the four open adoption PRs in [HYPERFLEET-1805](https://redhat.atlassian.net/browse/HYPERFLEET-1805). No dependency on those merges or a new hooks release. ### Validation - `GOTOOLCHAIN=go1.26.0 pre-commit run --all-files`: passed. - `pre-commit validate-config`: passed; valid commit message accepted and invalid message rejected through the commit-msg hook. - Renovate 44.71.0 native extraction recognizes every remote ref as a version plus digest; native replacement tests preserve SHA pinning for both release and digest-only updates. - `go test -p 2 ./pkg/... ./cmd/...`: passed. ### Deployment verification The production GitOps definition for `kflux-prd-rh02` inherits [this MintMaker base](https://github.com/redhat-appstudio/infra-deployments/blob/main/components/mintmaker/production/base/kustomization.yaml), pinning image `bab7f6da3c2178e3d8e3446b4cdd8ca8e5a9a3a1`. [Its Dockerfile](https://github.com/konflux-ci/mintmaker-renovate-image/blob/bab7f6da3c2178e3d8e3446b4cdd8ca8e5a9a3a1/Dockerfile) fixes Renovate 44.71.0-rpm / fork revision `6a2542ca879a3e0945f3090c6c3507de5345cbf7`, which contains frozen extraction support. Tests used upstream 44.71.0, not a live MintMaker run. Confirm rollout and the first automated frozen update before closing the ticket. No auto-approval or automerge policy is introduced. ### Baseline hygiene The full hook run found preexisting trailing whitespace/EOF issues. Only those automatic fixes are included outside the config/guide; a whitespace-insensitive diff confirms no additional semantic changes. Files: - `LICENSE` [HYPERFLEET-1812]: https://redhat.atlassian.net/browse/HYPERFLEET-1812?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ [HYPERFLEET-1805]: https://redhat.atlassian.net/browse/HYPERFLEET-1805?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ ### Additional test results - Integration: `go test -p 1 -timeout 4m ./test/integration` passed (Docker-backed). - Working tree remains clean after the checks.
…om the Dockerfile (openshift-hyperfleet#404) ## Why The Dockerfile ran `dnf install -y make` in the builder stage, with a comment saying UBI9 go-toolset doesn't include make. `ubi9/go-toolset:9.8-1792010711` already ships `make-4.3-8.el9`, so the step installed nothing. It still refreshed the dnf repo metadata over the network on every build. [HYPERFLEET-1790](https://redhat.atlassian.net/browse/HYPERFLEET-1790). ## What changed - Removed the `dnf install -y make && dnf clean all` line. - Kept the `USER root` block that creates `/build` and hands it to user 1001, and updated its comment to say only that. Built the builder stage locally: `make build` and both FIPS checks pass. The container image standard is updated in openshift-hyperfleet/architecture#251. [HYPERFLEET-1790]: https://redhat.atlassian.net/browse/HYPERFLEET-1790?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ
…hyperfleet#405) ### What Add `args: [--markdown-linebreak-ext=md]` to the existing `trailing-whitespace` hook. One line only; preserve hook selection, existing configuration and full-SHA frozen refs. No hook implementation or release change is needed. ### Why Two trailing spaces can encode a Markdown hard line break. The default fixer removes them; this argument preserves them in `.md` files while retaining ordinary whitespace cleanup elsewhere. [HYPERFLEET-1815](https://redhat.atlassian.net/browse/HYPERFLEET-1815). Architecture is handled separately in [architecture#250](openshift-hyperfleet/architecture#250). ### Cleanup audit Audited the merged baseline cleanup in openshift-hyperfleet#403, comparing commit `b945b752c02f` with its first parent and checking current content. No Markdown prose hard breaks were lost in that change. The rollout audit found no lost rendered hard breaks outside the already-corrected architecture PR, so this PR does not reintroduce cosmetic whitespace, code-block whitespace or blank lines. ### Validation - `GOTOOLCHAIN=go1.26.0 pre-commit run --all-files`: passed twice without additional changes. - Isolated fixture using this exact config and pinned hook: Markdown two-space hard break preserved (renders `<br />`), `.txt` trailing whitespace removed, second run clean. - `pre-commit validate-config`, YAML lint, and `git diff --check`: passed. - Parsed-config comparison confirms the only change is the added argument; all refs, hooks and other options are preserved. No runtime source changed. Application integration/live E2E suites were not rerun; the hook itself was exercised end to end with the fixture above. No Markdown files are modified. [HYPERFLEET-1815]: https://redhat.atlassian.net/browse/HYPERFLEET-1815?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ
Owner
Author
|
Closing without merge at Rafael's request, following the team discussion to pause work pending the epic review. EPD now supports Prow, and the choice of CI implementation should be reconsidered before adding parallel GitHub Actions workflows. The LeakTK investigation and existing CI results remain useful evidence for HYPERFLEET-1819; a clean scan does not complete the outstanding negative-control CI validation. The branch is retained for reference. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Validation run for the pilot in upstream PR openshift-hyperfleet#408.
Same-repo PR so the new workflow file triggers normally (fork PRs do not trigger brand-new workflows until the workflow has run once from a base-repo ref — the same limitation hit and resolved during HYPERFLEET-1806).
This PR exists only to exercise the workflow end to end. Do not merge.