test: why did our CI not catch this?

[chmeliik]

Before you complete this pull request ...

Look for any open pull requests in the repository with the title "e2e-tests update" and
see if there are recent e2e-tests updates that will be applicable to your change.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarCloud

[chmeliik]

Hmm, OK, this time it caught the error 😕 https://console-openshift-console.apps.stone-prd-rh01.pg1f.p1.openshiftapps.com/k8s/ns/tekton-ci/tekton.dev~v1beta1~PipelineRun/build-definitions-pull-request-b1qwix/logs/e2e-tests

      container step-merge-cachi2-sbom: 
      Merging contents of sbom-cachi2.json into sbom-cyclonedx.json
      Traceback (most recent call last):
        File "/src/utils/merge_syft_sbom.py", line 152, in <module>
          merged_sbom = merge_sboms(args.cachi2_sbom_path, args.syft_sbom_path)
                        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
        File "/src/utils/merge_syft_sbom.py", line 137, in merge_sboms
          syft_sbom.get("metadata", {}).get("tools", []).extend(
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
      AttributeError: 'dict' object has no attribute 'extend'

[chmeliik]

Ok, I don't see how the syft update without the corresponding cachi2 update would have ever passed CI. Probably not worth investigating at this point

[lcarva]

Ok, I don't see how the syft update without the corresponding cachi2 update would have ever passed CI. Probably not worth investigating at this point

Could it be another case of a branch being merged without having the latest update? Pretty sure that's what happened with the yaml lint checks last week.

[chmeliik]

Ok, I don't see how the syft update without the corresponding cachi2 update would have ever passed CI. Probably not worth investigating at this point

Could it be another case of a branch being merged without having the latest update? Pretty sure that's what happened with the yaml lint checks last week.

This one probably not.

At one point in the lifecycle of #722, the syft image was updated to 0.105.0 but the cachi2 image was still at 0.5.0, and the CI passed. That should have been impossible, any hermetic build pipeline should have failed without the corresponding cachi2 update

That's all within the scope of the buildah task (the cachi2 update was for the SBOM merge script used in the buildah task) so I don't think any branch inconsistencies could have been relevant