ART-14748

artcommon/artcommonlib/constants.py

@@ -60,6 +60,9 @@
 REDHAT_GITLAB_URL = "https://gitlab.cee.redhat.com"
 SHIPMENT_DATA_URL_TEMPLATE = "https://gitlab.cee.redhat.com/hybrid-platforms/art/ocp-shipment-data"
 SHIPMENT_CONFIG_KINDS = ("image", "extras", "metadata", "fbc", "microshift-bootc")
+SHIPMENT_CONFIG_KINDS_WITH_COMPOUNDS = SHIPMENT_CONFIG_KINDS + tuple(
+    f"{kind}-el{rhel_version}" for kind in SHIPMENT_CONFIG_KINDS if kind != "fbc" for rhel_version in (8, 9, 10)
+)
 
 # Redis related vars
 REDIS_HOST = 'master.redis.gwprhd.use1.cache.amazonaws.com'

doozer/doozerlib/cli/release_gen_assembly.py

@@ -947,18 +947,43 @@ def _get_default_shipment(self, env: str = None) -> dict:
         if env and env not in ['stage', 'prod']:
             raise ValueError(f"Invalid environment: {env}")
 
+        shipment_kinds = ['image', 'extras', 'metadata']
+        rhel_versions = self._get_rhel_versions()
+        if len(rhel_versions) > 1:
+            shipment_kinds = [
+                f'{kind}-el{rhel_version}' for kind in shipment_kinds for rhel_version in sorted(rhel_versions)
+            ]
+
         default_shipment = {
             'advisories': [
-                {'kind': 'image'},
-                {'kind': 'extras'},
-                {'kind': 'metadata'},
+                *({'kind': kind} for kind in shipment_kinds),
                 {'kind': 'fbc'},
             ],
         }
         if env:
             default_shipment['env'] = env
         return default_shipment
 
+    def _get_rhel_versions(self) -> Set[int]:
+        """
+        Get the RHEL versions represented by the selected Konflux image builds.
+
+        Return Value(s):
+            Set[int]: The detected RHEL major versions.
+        """
+        if self.runtime.build_system != 'konflux':
+            return set()
+
+        rhel_versions = set()
+        for build_inspector in self.component_image_builds.values():
+            release = build_inspector.get_release()
+            if not release:
+                continue
+            rhel_version = isolate_el_version_in_release(release)
+            if rhel_version is not None:
+                rhel_versions.add(rhel_version)
+        return rhel_versions
+
     def _get_previous_shipment_info(self) -> dict:
         """
         if this assembly is (e|r)c.X, then check if there is a previously defined (e|r)c.X-1

doozer/tests/cli/test_gen_assembly.py

@@ -376,6 +376,75 @@ def test_get_shipment_info(self):
         }
         self.assertEqual(expected, shipment)
 
+    def test_get_shipment_info_mixed_rhel_versions_uses_detected_compound_kinds(self):
+        """Mixed image RHEL streams generate one shipment reference per stream."""
+        runtime = MagicMock(build_system='konflux')
+        runtime.get_releases_config.return_value = Model({'releases': {}})
+        gacli = GenAssemblyCli(runtime=runtime, gen_assembly_name='4.23.52')
+        for index, release in enumerate(('1.el9', '2.el8', '3.el9')):
+            build = MagicMock()
+            build.get_release.return_value = release
+            gacli.component_image_builds[f'image-{index}'] = build
+
+        shipment = gacli._get_shipment_info()
+
+        self.assertEqual(
+            shipment,
+            {
+                'advisories': [
+                    {'kind': 'image-el8'},
+                    {'kind': 'image-el9'},
+                    {'kind': 'extras-el8'},
+                    {'kind': 'extras-el9'},
+                    {'kind': 'metadata-el8'},
+                    {'kind': 'metadata-el9'},
+                    {'kind': 'fbc'},
+                ],
+            },
+        )
+
+    def test_get_shipment_info_detects_rhel_versions_without_allowlist(self):
+        """The detected stream names are not limited to a hardcoded RHEL version list."""
+        runtime = MagicMock(build_system='konflux')
+        runtime.get_releases_config.return_value = Model({'releases': {}})
+        gacli = GenAssemblyCli(runtime=runtime, gen_assembly_name='4.23.1')
+        for index, release in enumerate(('1.el10', '2.el9')):
+            build = MagicMock()
+            build.get_release.return_value = release
+            gacli.component_image_builds[f'image-{index}'] = build
+
+        self.assertEqual(
+            gacli._get_shipment_info()['advisories'],
+            [
+                {'kind': 'image-el9'},
+                {'kind': 'image-el10'},
+                {'kind': 'extras-el9'},
+                {'kind': 'extras-el10'},
+                {'kind': 'metadata-el9'},
+                {'kind': 'metadata-el10'},
+                {'kind': 'fbc'},
+            ],
+        )
+
+    def test_get_shipment_info_single_rhel_version_keeps_plain_kinds(self):
+        """A single detected RHEL stream does not require compound shipment kinds."""
+        runtime = MagicMock(build_system='konflux')
+        runtime.get_releases_config.return_value = Model({'releases': {}})
+        gacli = GenAssemblyCli(runtime=runtime, gen_assembly_name='4.23.1')
+        build = MagicMock()
+        build.get_release.return_value = '1.el9'
+        gacli.component_image_builds['image'] = build
+
+        self.assertEqual(
+            gacli._get_shipment_info()['advisories'],
+            [
+                {'kind': 'image'},
+                {'kind': 'extras'},
+                {'kind': 'metadata'},
+                {'kind': 'fbc'},
+            ],
+        )
+
     def test_get_shipment_info_ec0(self):
         runtime = MagicMock(build_system='konflux')
         runtime.get_releases_config.return_value = Model({'releases': {}})

elliott/elliottlib/cli/attach_cve_flaws_cli.py

@@ -23,12 +23,12 @@
     is_rhcos_pscomponent,
     sort_cve_bugs,
 )
-from elliottlib.cli.common import cli, click_coroutine, find_default_advisory, use_default_advisory_option
+from elliottlib.cli.common import cli, click_coroutine, find_default_advisory
 from elliottlib.errata import is_security_advisory
 from elliottlib.errata_async import AsyncErrataAPI, AsyncErrataUtils
 from elliottlib.runtime import Runtime
 from elliottlib.shipment_model import CveAssociation, ReleaseNotes
-from elliottlib.shipment_utils import get_shipment_config_from_mr, set_bugzilla_bug_ids
+from elliottlib.shipment_utils import get_base_shipment_kind, get_shipment_config_from_mr, set_bugzilla_bug_ids
 from elliottlib.util import (
     get_advisory_boilerplate,
     get_component_by_delivery_repo,
@@ -195,7 +195,7 @@ def __init__(
         self.errata_config = self.runtime.get_errata_config()
 
         if default_advisory_type:
-            self.advisory_kind = default_advisory_type
+            self.advisory_kind = get_base_shipment_kind(default_advisory_type)
         elif advisory_id:
             self.advisory_kind = next(
                 (k for k, v in self.runtime.group_config.advisories.items() if v == self.advisory_id), None
@@ -698,7 +698,13 @@ def get_updated_advisory_rhsa(self, cve_boilerplate: dict, advisory: Erratum, fl
     is_flag=True,
     help="Print what would change, but don't change anything",
 )
-@use_default_advisory_option
+@click.option(
+    "--use-default-advisory",
+    "default_advisory_type",
+    metavar="ADVISORY_TYPE",
+    type=click.STRING,
+    help="Use the default value from [group|releases].yml for ADVISORY_TYPE.",
+)
 @click.option(
     "--into-default-advisories", is_flag=True, help='Run for all advisories values defined in [group|releases].yml'
 )

elliott/elliottlib/cli/find_bugs_sweep_cli.py

@@ -1,4 +1,5 @@
 import json
+import re
 import sys
 from datetime import datetime, timezone
 from typing import Dict, List, Optional, Set
@@ -29,6 +30,76 @@
 type_bug_set = Set[Bug]
 yaml = new_roundtrip_yaml_handler()
 
+_COMPOUND_SHIPMENT_KIND_PATTERN = re.compile(r"^(?P<base>.+)-el\d+$")
+
+
+def _get_base_shipment_kind(kind: str) -> str:
+    """
+    Return the unqualified shipment kind for a base or RHEL-qualified kind.
+
+    Args:
+        kind: Shipment kind such as ``image`` or ``image-el9``.
+    Returns:
+        The base shipment kind.
+    """
+    match = _COMPOUND_SHIPMENT_KIND_PATTERN.fullmatch(kind)
+    return match.group("base") if match else kind
+
+
+def _get_compound_kinds(builds_by_advisory_kind: Dict[str, List[str]], base_kind: str) -> list[str]:
+    """
+    Find configured RHEL-qualified variants for a base shipment kind.
+
+    Args:
+        builds_by_advisory_kind: Build NVRs keyed by shipment kind.
+        base_kind: Unqualified shipment kind.
+    Returns:
+        Sorted RHEL-qualified shipment kinds.
+    """
+    return sorted(
+        kind for kind in builds_by_advisory_kind if _get_base_shipment_kind(kind) == base_kind and kind != base_kind
+    )
+
+
+def _distribute_bugs_to_compound_kinds(
+    bugs: type_bug_set,
+    base_kind: str,
+    builds_by_advisory_kind: Dict[str, List[str]],
+    runtime: Runtime,
+) -> Dict[str, type_bug_set]:
+    """
+    Distribute non-tracker bugs to RHEL variants using their attached builds.
+
+    Bugs whose component matches one variant's build package are routed to that
+    variant. Ambiguous bugs are retained in every variant so that a bug is not
+    silently omitted from a shipment.
+
+    Args:
+        bugs: Bugs already categorized for the base advisory kind.
+        base_kind: Unqualified advisory kind.
+        builds_by_advisory_kind: Build NVRs keyed by shipment kind.
+        runtime: Elliott runtime used for component normalization.
+    Returns:
+        Bug sets keyed by the configured RHEL-qualified shipment kind.
+    """
+    compound_kinds = _get_compound_kinds(builds_by_advisory_kind, base_kind)
+    if not compound_kinds:
+        return {base_kind: bugs}
+
+    packages_by_kind = {
+        kind: {parse_nvr(nvr)["name"] for nvr in builds_by_advisory_kind.get(kind, [])} for kind in compound_kinds
+    }
+    distributed = {kind: set() for kind in compound_kinds}
+    for bug in bugs:
+        component = getattr(bug, "component", "") or ""
+        normalized_component = normalize_component_by_ocp_delivery_repo(runtime, component) if component else component
+        matching_kinds = [kind for kind, packages in packages_by_kind.items() if normalized_component in packages]
+        if not matching_kinds:
+            matching_kinds = compound_kinds
+        for kind in matching_kinds:
+            distributed[kind].add(bug)
+    return distributed
+
 
 class FindBugsMode:
     def __init__(self, status: List, cve_only: bool = False, art_managed_trackers_only: bool = False):
@@ -512,6 +583,14 @@ def categorize_bugs_by_type(
         operator_bundle_advisory: set(),
         "microshift": set(),
     }
+    compound_bases = {
+        _get_base_shipment_kind(kind)
+        for kind in (builds_by_advisory_kind or {})
+        if _get_base_shipment_kind(kind) != kind
+    }
+    for base_kind in compound_bases:
+        for compound_kind in _get_compound_kinds(builds_by_advisory_kind, base_kind):
+            bugs_by_type[compound_kind] = set()
 
     # for 3.x, all bugs should go to the rpm advisory
     if int(major_version) < 4:
@@ -553,6 +632,17 @@ def categorize_bugs_by_type(
     # remaining non-tracker bugs go to image advisory
     bugs_by_type["image"] = non_tracker_bugs
 
+    # Keep non-tracker bugs aligned with the shipment snapshot that contains
+    # their build when a base advisory has been split by RHEL.
+    for base_kind in ("extras", "image", operator_bundle_advisory):
+        if base_kind not in compound_bases or base_kind not in bugs_by_type:
+            continue
+        distributed = _distribute_bugs_to_compound_kinds(
+            bugs_by_type[base_kind], base_kind, builds_by_advisory_kind, runtime
+        )
+        bugs_by_type[base_kind] = set()
+        bugs_by_type.update(distributed)
+
     # Complain about fake trackers
     if fake_trackers:
         sorted_ids = sorted([t.id for t in fake_trackers])
@@ -604,12 +694,12 @@ def categorize_bugs_by_type(
     logger.info("Validating tracker bugs with builds in advisories..")
     found = set()
     for kind in bugs_by_type.keys():
-        if len(found) == len(tracker_bugs):
-            break
+        if _get_base_shipment_kind(kind) in compound_bases and kind == _get_base_shipment_kind(kind):
+            continue
         attached_nvrs = builds_by_advisory_kind.get(kind, [])
         packages = {parse_nvr(nvr)["name"] for nvr in attached_nvrs}
         exception_packages = []
-        if kind == 'image':
+        if _get_base_shipment_kind(kind) == 'image':
             # golang builder is a special tracker component
             # which applies to all our golang images
             exception_packages.append(constants.GOLANG_BUILDER_CVE_COMPONENT)