ART-23827: Add layered product prod FBC validations to prevent wipeouts

artcommon/artcommonlib/util.py

@@ -715,6 +715,25 @@ def find_condition(obj, condition_type: str, _default: Optional["KubeCondition"]
         return _default
 
 
+_LP_FBC_OCP_VERSION_RE = re.compile(r'\.ocp(\d+\.\d+)')
+
+
+def extract_ocp_version_from_fbc_nvr(nvr: str) -> Optional[str]:
+    """Extract the target OCP version from a layered-product FBC NVR.
+
+    Layered-product FBC NVRs encode the target version in their release field
+    as ``.ocp{major}.{minor}``.
+
+    Args:
+        nvr: Layered-product FBC NVR.
+
+    Returns:
+        The ``major.minor`` OCP version, or ``None`` when the marker is absent.
+    """
+    match = _LP_FBC_OCP_VERSION_RE.search(nvr)
+    return match.group(1) if match else None
+
+
 def is_cachito_enabled(metadata, group_config, logger):
     """
     Cachito will be configured if `cachito.enabled` is True in image metadata or `cachito.enabled` is True in group config.

doozer/doozerlib/backend/konflux_client.py

@@ -637,6 +637,23 @@ async def _get(self, api_version: str, kind: str, name: str, namespace: Optional
                 raise
         return resource
 
+    async def list_releases(self, namespace: Optional[str] = None) -> list[resource.ResourceInstance]:
+        """List Konflux Release resources in a namespace.
+
+        Args:
+            namespace: Namespace to inspect. Defaults to the client's namespace.
+
+        Returns:
+            Release resources returned by the Kubernetes API.
+        """
+        api = await self._get_api(API_VERSION, KIND_RELEASE)
+        resources = await exectools.to_thread(
+            api.get,
+            namespace=namespace or self.default_namespace,
+            _request_timeout=self.request_timeout,
+        )
+        return list(resources.items)
+
     @alru_cache
     async def _get__caching(
         self, api_version: str, kind: str, name: str, namespace: Optional[str] = None, strict: bool = True

doozer/tests/backend/test_konflux_client.py

@@ -1,5 +1,6 @@
 import json
 import logging
+from types import SimpleNamespace
 from unittest import IsolatedAsyncioTestCase, TestCase
 from unittest.mock import AsyncMock, MagicMock, patch
 
@@ -104,6 +105,24 @@ def test_resource_url(self):
         self.assertEqual(actual, expected)
 
 
+class TestListReleases(IsolatedAsyncioTestCase):
+    """Tests for namespace-scoped Konflux Release listing."""
+
+    async def test_list_releases_uses_default_namespace(self):
+        client = KonfluxClient.__new__(KonfluxClient)
+        client.default_namespace = 'art-logging-tenant'
+        client.request_timeout = 30
+        api = MagicMock()
+        releases = [MagicMock(), MagicMock()]
+        api.get.return_value = SimpleNamespace(items=releases)
+        client._get_api = AsyncMock(return_value=api)
+
+        result = await client.list_releases()
+
+        self.assertEqual(result, releases)
+        api.get.assert_called_once_with(namespace='art-logging-tenant', _request_timeout=30)
+
+
 class TestParseGitHubApiUrl(TestCase):
     """Tests for parse_github_api_url function."""
 

elliott/elliottlib/cli/__main__.py

@@ -56,6 +56,7 @@
 from elliottlib.cli.get_golang_versions_cli import get_golang_versions_cli
 from elliottlib.cli.get_network_mode_cli import get_network_mode_cli
 from elliottlib.cli.konflux_release_cli import konflux_release_cli
+from elliottlib.cli.konflux_release_validate_lp_prod_cli import validate_lp_prod_cli
 from elliottlib.cli.konflux_release_watch_cli import watch_release_cli
 from elliottlib.cli.move_builds_cli import move_builds_cli
 from elliottlib.cli.pin_builds_cli import assembly_pin_builds_cli