Add group-component and NVR tags when mirroring to art-images-share

[redhat-chai-bot]

Summary

When mirroring images to art-images-share, add two new tag types so consumers can look up images more easily:

• Floating <group>-<component> tag using the delivery.repo_name from ocp-build-data (e.g. openshift-4.17-ose-ansible-operator) — always points to the latest build of a component for a given OCP version, enabling stable lookups that map directly to the ocp-build-data image config.
• NVR tag(s) (e.g. ose-ansible-operator-container-v4.17.0-202506300104.p0.g1234567.assembly.stream.el9) — enables precise build identification by NVR.

Changes

1. doozer/doozerlib/backend/konflux_image_builder.py

Adds delivery_repo_name to the Konflux build record, sourced from metadata.config.delivery.repo_name with a fallback to metadata.distgit_key when not configured.

2. pyartcd/pyartcd/pipelines/ocp4_konflux.py

In mirror_images() → sync_build(), uses delivery_repo_name (with fallback to name) for the group-component tag, and splits build["nvrs"] into individual NVR tags.

3. pyartcd/tests/pipelines/test_ocp4_konflux.py

9 new tests covering:

• Group-component tag uses delivery_repo_name when present
• Falls back to build["name"] when delivery_repo_name is absent
• Single and multiple comma-separated NVR tags
• Empty NVR string handling
• Whitespace trimming on NVRs
• Non-stream assembly and embargoed build skip behavior

Resolves: ART-23164

---

AI-generated. Review for accuracy.

@ashwindasr requested in Slack thread

Summary by CodeRabbit

• New Features
  • Build records now include the configured delivery repository name when available.
  • Image mirroring adds delivery repository group tags and individual NVR tags while retaining existing image and version tags.
• Bug Fixes
  • Improved handling of multiple, trimmed, or empty NVR values.
  • Non-stream and embargoed builds are correctly excluded from image synchronization.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign locriandev for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift-eng/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 0dae255e-6c2f-43e7-a317-11af944ce2ec

📥 Commits

Reviewing files that changed from the base of the PR and between 40e12a1 and e608f21.

📒 Files selected for processing (1)

• doozer/doozerlib/backend/konflux_image_builder.py

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

Konflux build records now include delivery repository metadata. Image mirroring uses this metadata and NVR values to create additional Quay tags while preserving existing tags and skip conditions.

Changes

Konflux image mirroring

Layer / File(s)	Summary
Build record delivery repository metadata doozer/doozerlib/backend/konflux_image_builder.py	Build records include the configured delivery repository name, with the distgit key as fallback.
Mirroring tag generation pyartcd/pyartcd/pipelines/ocp4_konflux.py	Image mirroring adds a delivery repository group/component tag and one tag for each nonempty, trimmed NVR.
Mirroring behavior validation pyartcd/tests/pipelines/test_ocp4_konflux.py	Tests cover tag fallbacks, NVR formatting, tag preservation, and skipped assemblies or embargoed builds.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to e608f

The change adds group-component and NVR tags for mirrored images with defined fallbacks and test coverage; no actionable merge-blocking risk remains beyond normal checks and review.

Suggested reviewers: lgarciaaco, ashwindasr, thegreyd

Sequence Diagram(s)

sequenceDiagram
  participant KonfluxImageBuilder
  participant KonfluxOcpPipeline
  participant Quay
  KonfluxImageBuilder->>KonfluxOcpPipeline: provide delivery_repo_name and NVRs
  KonfluxOcpPipeline->>Quay: sync image with repository, NVR, image, and version tags

Loading

🚥 Pre-merge checks | ✅ 10 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Ai-Attribution	⚠️ Warning	AI use is explicit in the PR text (AI-generated), and the pull-request commit e608f21 contains Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>. The commit has no Assisted-by or `Generat…	Amend the pull-request commit message. Remove the AI Co-Authored-By trailer and add the required Assisted-by or Generated-by trailer for Claude Opus 4.6. Apply the same correction to any other pull-request commit that attributes an AI…

✅ Passed checks (10 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the main change: adding group-component and NVR tags when mirroring images to art-images-share.
Docstring Coverage	✅ Passed	Docstring coverage is 80.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 15 functions across 3 files.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No-Weak-Crypto	✅ Passed	PASS. The pull request adds delivery-repository name extraction and image tag construction only. The changed files contain no MD5, SHA1, DES, RC4, 3DES, Blowfish, or ECB usage, no crypto-library impor…
Container-Privileges	✅ Passed	PASS: The pull request changes only Python source and test files. The added code handles build-record fields and image tags. No added manifest or security setting contains privileged, hostPID, hostNet…
No-Sensitive-Data-In-Logs	✅ Passed	No sensitive-data logging failure was introduced. The diff adds delivery_repo_name to the existing build record and passes derived repository-name and NVR values as image tags. RecordLogger serial…
No-Hardcoded-Secrets	✅ Passed	No hardcoded secrets were introduced. The parent-to-HEAD diff adds only repository/tag data and test fixtures. The added URLs contain no credentials, and no added variable named api_key, secret, token…
No-Injection-Vectors	✅ Passed	No stated injection vector is introduced. The PR only derives tag strings from metadata and build records, then passes them as arguments to sync_to_quay. The downstream helper uses `asyncio.create_s…

Full details: No-Weak-Crypto

Explanation

PASS. The pull request adds delivery-repository name extraction and image tag construction only. The changed files contain no MD5, SHA1, DES, RC4, 3DES, Blowfish, or ECB usage, no crypto-library imports or calls, no custom crypto implementation, and no secret or token comparisons. The sha256 strings in test image references are digests, not weak-crypto usage.

Full details: Container-Privileges

Explanation

PASS: The pull request changes only Python source and test files. The added code handles build-record fields and image tags. No added manifest or security setting contains privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, or allowPrivilegeEscalation. Existing privilege declarations are outside the pull-request diff.

Full details: No-Sensitive-Data-In-Logs

Explanation

No sensitive-data logging failure was introduced. The diff adds delivery_repo_name to the existing build record and passes derived repository-name and NVR values as image tags. RecordLogger serializes the record to record.log, and sync_to_quay logs the resulting tags, but these values are component repository names and build identifiers. They are not passwords, tokens, API keys, PII, session IDs, customer data, or hostnames. No new logging of credentials or sensitive URLs was added.

Full details: No-Hardcoded-Secrets

Explanation

No hardcoded secrets were introduced. The parent-to-HEAD diff adds only repository/tag data and test fixtures. The added URLs contain no credentials, and no added variable named api_key, secret, token, or password receives a string literal. The added literals contain no private key, credential, or base64 string longer than 32 characters.

Full details: No-Injection-Vectors

Explanation

No stated injection vector is introduced. The PR only derives tag strings from metadata and build records, then passes them as arguments to sync_to_quay. The downstream helper uses asyncio.create_subprocess_exec(*cmd) and does not use shell=True. The exact PR additions contain no SQL concatenation, eval/exec, pickle.loads, unsafe yaml.load, os.system, or dangerouslySetInnerHTML.

Full details: Ai-Attribution

Explanation

AI use is explicit in the PR text (AI-generated), and the pull-request commit e608f21 contains Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>. The commit has no Assisted-by or Generated-by trailer. This directly matches the check's prohibited attribution condition.

Resolution

Amend the pull-request commit message. Remove the AI Co-Authored-By trailer and add the required Assisted-by or Generated-by trailer for Claude Opus 4.6. Apply the same correction to any other pull-request commit that attributes an AI tool with Co-Authored-By.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

@redhat-chai-bot: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/art-pre-commit-check	e608f21	link	false	/test art-pre-commit-check
ci/prow/security	e608f21	link	false	/test security

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.