From 226dc388fd4658484c95c65abee050eaf12622f0 Mon Sep 17 00:00:00 2001 From: Shaun Smith <51304449+smith-xyz@users.noreply.github.com> Date: Thu, 6 Aug 2026 09:59:17 -0400 Subject: [PATCH] ci(check-payload): pass release tag names to payload-scan smoke tests --- .../openshift-check-payload-main.yaml | 40 +++++++++++-------- 1 file changed, 24 insertions(+), 16 deletions(-) diff --git a/ci-operator/config/openshift/check-payload/openshift-check-payload-main.yaml b/ci-operator/config/openshift/check-payload/openshift-check-payload-main.yaml index 7334b1f5e46c5..3fc5b5af61807 100644 --- a/ci-operator/config/openshift/check-payload/openshift-check-payload-main.yaml +++ b/ci-operator/config/openshift/check-payload/openshift-check-payload-main.yaml @@ -78,19 +78,21 @@ tests: if [[ -z "$PULLSPEC" ]]; then echo "ERROR: empty pullSpec" >&2; exit 1; fi echo "Release: $PULLSPEC" IMAGES=$(oc adm release info "$PULLSPEC" -a "$REGISTRY_AUTH_FILE" --pullspecs -o json \ - | jq -r '[.references.spec.tags[] | select(.from.name != null) | .from.name] | .[0:15] | .[]') + | jq -r '[.references.spec.tags[] | select(.from.name != null) | "\(.name // "")=\(.from.name)"] | .[0:15] | .[]') if [[ -z "$IMAGES" ]]; then echo "ERROR: no images resolved" >&2; exit 1; fi total=0 failed=0 - for img in $IMAGES; do + for entry in $IMAGES; do + tag="${entry%%=*}" + img="${entry#*=}" total=$((total+1)) - echo "--- [$total] Scanning: $img" + echo "--- [$total] Scanning: $tag ($img)" rm -rf /tmp/unpacked && mkdir -p /tmp/unpacked if ! oc image extract "$img" -a "$REGISTRY_AUTH_FILE" --path /:/tmp/unpacked --confirm; then echo "ERROR: failed to extract $img" >&2 failed=$((failed+1)) continue fi - /check-payload scan local --path=/tmp/unpacked -V "$VERSION" -v=1 || failed=$((failed+1)) + /check-payload scan local --path=/tmp/unpacked --tag "$tag" -V "$VERSION" -v=1 || failed=$((failed+1)) done echo "Result: scanned $total images, $failed failed" if [[ $failed -gt 0 ]]; then exit 1; fi @@ -112,19 +114,21 @@ tests: if [[ -z "$PULLSPEC" ]]; then echo "ERROR: empty pullSpec" >&2; exit 1; fi echo "Release: $PULLSPEC" IMAGES=$(oc adm release info "$PULLSPEC" -a "$REGISTRY_AUTH_FILE" --pullspecs -o json \ - | jq -r '[.references.spec.tags[] | select(.from.name != null) | .from.name] | .[0:15] | .[]') + | jq -r '[.references.spec.tags[] | select(.from.name != null) | "\(.name // "")=\(.from.name)"] | .[0:15] | .[]') if [[ -z "$IMAGES" ]]; then echo "ERROR: no images resolved" >&2; exit 1; fi total=0 failed=0 - for img in $IMAGES; do + for entry in $IMAGES; do + tag="${entry%%=*}" + img="${entry#*=}" total=$((total+1)) - echo "--- [$total] Scanning: $img" + echo "--- [$total] Scanning: $tag ($img)" rm -rf /tmp/unpacked && mkdir -p /tmp/unpacked if ! oc image extract "$img" -a "$REGISTRY_AUTH_FILE" --path /:/tmp/unpacked --confirm; then echo "ERROR: failed to extract $img" >&2 failed=$((failed+1)) continue fi - /check-payload scan local --path=/tmp/unpacked -V "$VERSION" -v=1 || failed=$((failed+1)) + /check-payload scan local --path=/tmp/unpacked --tag "$tag" -V "$VERSION" -v=1 || failed=$((failed+1)) done echo "Result: scanned $total images, $failed failed" if [[ $failed -gt 0 ]]; then exit 1; fi @@ -146,19 +150,21 @@ tests: if [[ -z "$PULLSPEC" ]]; then echo "ERROR: empty pullSpec" >&2; exit 1; fi echo "Release: $PULLSPEC" IMAGES=$(oc adm release info "$PULLSPEC" -a "$REGISTRY_AUTH_FILE" --pullspecs -o json \ - | jq -r '[.references.spec.tags[] | select(.from.name != null) | .from.name] | .[0:15] | .[]') + | jq -r '[.references.spec.tags[] | select(.from.name != null) | "\(.name // "")=\(.from.name)"] | .[0:15] | .[]') if [[ -z "$IMAGES" ]]; then echo "ERROR: no images resolved" >&2; exit 1; fi total=0 failed=0 - for img in $IMAGES; do + for entry in $IMAGES; do + tag="${entry%%=*}" + img="${entry#*=}" total=$((total+1)) - echo "--- [$total] Scanning: $img" + echo "--- [$total] Scanning: $tag ($img)" rm -rf /tmp/unpacked && mkdir -p /tmp/unpacked if ! oc image extract "$img" -a "$REGISTRY_AUTH_FILE" --path /:/tmp/unpacked --confirm; then echo "ERROR: failed to extract $img" >&2 failed=$((failed+1)) continue fi - /check-payload scan local --path=/tmp/unpacked -V "$VERSION" -v=1 || failed=$((failed+1)) + /check-payload scan local --path=/tmp/unpacked --tag "$tag" -V "$VERSION" -v=1 || failed=$((failed+1)) done echo "Result: scanned $total images, $failed failed" if [[ $failed -gt 0 ]]; then exit 1; fi @@ -180,19 +186,21 @@ tests: if [[ -z "$PULLSPEC" ]]; then echo "ERROR: empty pullSpec" >&2; exit 1; fi echo "Release: $PULLSPEC" IMAGES=$(oc adm release info "$PULLSPEC" -a "$REGISTRY_AUTH_FILE" --pullspecs -o json \ - | jq -r '[.references.spec.tags[] | select(.from.name != null) | .from.name] | .[0:15] | .[]') + | jq -r '[.references.spec.tags[] | select(.from.name != null) | "\(.name // "")=\(.from.name)"] | .[0:15] | .[]') if [[ -z "$IMAGES" ]]; then echo "ERROR: no images resolved" >&2; exit 1; fi total=0 failed=0 - for img in $IMAGES; do + for entry in $IMAGES; do + tag="${entry%%=*}" + img="${entry#*=}" total=$((total+1)) - echo "--- [$total] Scanning: $img" + echo "--- [$total] Scanning: $tag ($img)" rm -rf /tmp/unpacked && mkdir -p /tmp/unpacked if ! oc image extract "$img" -a "$REGISTRY_AUTH_FILE" --path /:/tmp/unpacked --confirm; then echo "ERROR: failed to extract $img" >&2 failed=$((failed+1)) continue fi - /check-payload scan local --path=/tmp/unpacked -V "$VERSION" -v=1 || failed=$((failed+1)) + /check-payload scan local --path=/tmp/unpacked --tag "$tag" -V "$VERSION" -v=1 || failed=$((failed+1)) done echo "Result: scanned $total images, $failed failed" if [[ $failed -gt 0 ]]; then exit 1; fi