CNTRLPLANE-3737: Add find-push-pipelinerun script - #8851
Conversation
Add a helper script to find Konflux on-push PipelineRun(s) triggered by a merged GitHub PR. Accepts a bare PR number (repo inferred via gh), a full URL, or owner/repo#number format. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
PipelineRuns get archived quickly by the kube archiver and are typically not available via oc get. Query the KubeArchive REST API as a fallback when no live PipelineRuns are found. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Extract the pipelinesascode.tekton.dev/log-url annotation from each PipelineRun to display a clickable link to the Konflux web UI. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add unit tests for the pure functions: resolve_pr (input parsing), format_pipelineruns (JSON to table), and filter_by_component (row filtering). Add a source guard so the script can be sourced without running main. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
openshift-ci-robot
added
the
jira/valid-reference
|
@celebdor: This pull request references CNTRLPLANE-3737 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (2)
📝 WalkthroughWalkthroughAdds a Bash script that resolves merged PR references, fetches the merge commit SHA, queries live or archived Tekton PipelineRuns, formats and filters tabular output, and supports watch refreshes. Adds Bats tests for PR parsing, formatting, pending detection, and component filtering. Sequence Diagram(s)sequenceDiagram
participant User
participant Script
participant gh
participant oc
participant curl
participant KubeArchive
participant filter_by_component
User->>Script: provide PR reference and options
Script->>gh: resolve PR and fetch mergeCommit.oid
gh-->>Script: PR metadata
Script->>oc: query live PipelineRuns by sha and push label
alt live query fails
Script->>oc: whoami -t
oc-->>Script: token
Script->>curl: request archived PipelineRuns
curl->>KubeArchive: GET matching PipelineRuns
KubeArchive-->>curl: archived JSON
curl-->>Script: archived results
end
opt component prefix provided
Script->>filter_by_component: keep matching TSV rows
filter_by_component-->>Script: filtered table
end
Script->>Script: repeat while pending runs remain
Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error)
✅ Passed checks (10 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
openshift-ci
Bot
added
area/ci-tooling
|
/verified by celebdor |
openshift-ci-robot
added
the
verified
|
@celebdor: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@celebdor: This pull request references CNTRLPLANE-3737 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/jira refresh |
|
@celebdor: This pull request references CNTRLPLANE-3737 which is a valid jira issue. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #8851 +/- ##
==========================================
+ Coverage 43.01% 43.19% +0.17%
==========================================
Files 766 767 +1
Lines 94769 94914 +145
==========================================
+ Hits 40765 40998 +233
+ Misses 51185 51052 -133
- Partials 2819 2864 +45 see 15 files with indirect coverage changes
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
hack/tools/scripts/find-push-pipelinerun.sh (2)
123-124: 🩺 Stability & Availability | 🔵 Trivial | 💤 Low valueConsider URL-encoding the label selector.
The selector embeds
,and=directly into the query string. The Kubernetes-style API generally tolerates raw values, but encoding viacurl -G --data-urlencodeis more robust against future selector values containing reserved characters.♻️ Suggested approach
- response="$(curl -sf -H "Authorization: Bearer ${token}" \ - "${ka_host}/apis/tekton.dev/v1/namespaces/${namespace}/pipelineruns?labelSelector=${selector}")" || { + response="$(curl -sf -G -H "Authorization: Bearer ${token}" \ + --data-urlencode "labelSelector=${selector}" \ + "${ka_host}/apis/tekton.dev/v1/namespaces/${namespace}/pipelineruns")" || { printf "Error: KubeArchive query failed (is %s reachable?)\n" "${ka_host}" >&2 return 1 }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@hack/tools/scripts/find-push-pipelinerun.sh` around lines 123 - 124, The pipelinerun lookup in find-push-pipelinerun.sh builds the query string with a raw labelSelector value, which can break if the selector contains reserved characters. Update the curl call that fetches the Tekton pipelineruns to send the selector as URL-encoded data instead of interpolating it directly, using the existing selector variable and the request around the response assignment.
132-145: 🎯 Functional Correctness | 🔵 Trivial | 💤 Low value
grep "^${component}"treats the filter as a regex.
componentis interpreted as a basic regex anchored at line start. For current component names (alphanumeric + hyphen) this is harmless, but a value containing regex metacharacters would match unexpectedly. If literal prefix matching is intended, escape the input or document the regex behavior.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@hack/tools/scripts/find-push-pipelinerun.sh` around lines 132 - 145, The prefix filter in filter_by_component currently uses grep with "^${component}", which treats component as a regex instead of a literal string. Update the matching logic in filter_by_component to either escape the component before passing it to grep or switch to literal prefix matching, and keep the existing header/filtered output behavior unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@hack/tools/scripts/find-push-pipelinerun.sh`:
- Around line 61-66: The `gh pr view` call in `find-push-pipelinerun.sh` is
capturing stderr into `pr_json`, which can corrupt the JSON payload before `jq
-r '.state'` parses it. Change the `gh` invocation so stderr is handled
separately from the JSON output, and keep the success path assigned only clean
JSON while preserving the existing failure message behavior in the
`pr_number`/`repo` lookup block.
---
Nitpick comments:
In `@hack/tools/scripts/find-push-pipelinerun.sh`:
- Around line 123-124: The pipelinerun lookup in find-push-pipelinerun.sh builds
the query string with a raw labelSelector value, which can break if the selector
contains reserved characters. Update the curl call that fetches the Tekton
pipelineruns to send the selector as URL-encoded data instead of interpolating
it directly, using the existing selector variable and the request around the
response assignment.
- Around line 132-145: The prefix filter in filter_by_component currently uses
grep with "^${component}", which treats component as a regex instead of a
literal string. Update the matching logic in filter_by_component to either
escape the component before passing it to grep or switch to literal prefix
matching, and keep the existing header/filtered output behavior unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 544a7291-59b1-4bde-8be8-4d041f1ca0be
📒 Files selected for processing (2)
hack/tools/scripts/find-push-pipelinerun.shhack/tools/scripts/find-push-pipelinerun_test.bats
- Add -w/--watch flag to poll until all PipelineRuns complete - Show IMAGE_URL@IMAGE_DIGEST for completed PipelineRuns - Fix readonly re-sourcing issue for testability - Fix gh stderr being captured into JSON parsing - Move set -euo pipefail into main() to avoid affecting sourcing shell - Add has_pending tests and image output tests Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
openshift-ci-robot
removed
the
verified
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@hack/tools/scripts/find-push-pipelinerun.sh`:
- Around line 203-205: The missing-PR-argument path in find-push-pipelinerun.sh
currently returns success after calling usage, which makes callers think the
lookup completed; update the argument validation branch in the main
positional-argument handling so it returns a non-zero status when positional is
empty, while keeping the explicit help path in usage/--help behavior at zero.
Use the existing usage function and the positional array check to locate the
fix, and ensure only the missing required argument case fails.
- Around line 141-143: Add bounded timeouts to the KubeArchive fetch in
find-push-pipelinerun.sh so the curl call cannot hang forever on a stalled API
connection. Update the request that builds response from
`${ka_host}/apis/tekton.dev/v1/namespaces/${namespace}/pipelineruns` to include
both a connect timeout and an overall timeout, and keep the existing
fallback/error handling so the lookup and --watch refresh fail fast instead of
blocking indefinitely.
- Around line 90-97: The jq expression in format_pipelineruns() is malformed
because the fallback is applied in a way that prevents parsing and causes jq to
exit before rendering the table. Update the image construction in
find-push-pipelinerun.sh so the default empty string is applied inside the image
value or directly on the IMAGE_URL lookup, keeping the IMAGE_DIGEST append logic
intact and ensuring the expression parses correctly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: c630d181-1d1d-4a38-8be6-b20c0ccc0750
📒 Files selected for processing (2)
hack/tools/scripts/find-push-pipelinerun.shhack/tools/scripts/find-push-pipelinerun_test.bats
jparrill
left a comment
jparrill
left a comment
There was a problem hiding this comment.
Clean dev tool — well-decomposed functions, good error handling, 14 bats tests covering the key paths. LGTM.
/approve
|
Scheduling tests matching the |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: celebdor, jparrill The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
Test Resultse2e-aws
e2e-aks
|
AI Test Failure AnalysisJob: Generated by hypershift-analyze-e2e-failure post-step using Claude claude-opus-4-6 |
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
673dc1f to
238ccf1
Compare
|
/override ci/prow/e2e-aks |
|
@celebdor: Overrode contexts on behalf of celebdor: ci/prow/e2e-aks, ci/prow/e2e-aws, ci/prow/e2e-aws-upgrade-hypershift-operator, ci/prow/e2e-azure-v2-self-managed, ci/prow/e2e-kubevirt-aws-ovn-reduced, ci/prow/e2e-v2-aws, ci/prow/e2e-v2-gke DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
I now have all the evidence. Here is the complete analysis: Test Failure Analysis CompleteJob Information
Test Failure AnalysisErrorSummaryThe Root CauseThe root cause is CI infrastructure resource exhaustion on the The pod was configured by the multi-arch scheduling system (labels show
The pod remained in This is a transient CI infrastructure issue. The Recommendations
Evidence
|
| _set_default() { declare -g -r "$1"="$2" 2>/dev/null || true; } | ||
| _set_default DEFAULT_NAMESPACE "crt-redhat-acm-tenant" | ||
| _set_default DEFAULT_KA_HOST "https://kubearchive-api-server-product-kubearchive.apps.stone-prd-rh01.pg1f.p1.openshiftapps.com" | ||
| _set_default LOG_URL_ANNOTATION "pipelinesascode.tekton.dev/log-url" | ||
| _set_default WATCH_INTERVAL 15 |
There was a problem hiding this comment.
The script fails when bash version is less than 4.2. For better portability purposes, it can be replaced using below declaration:
I tested it and it worked well on Mac as well.
| _set_default() { declare -g -r "$1"="$2" 2>/dev/null || true; } | |
| _set_default DEFAULT_NAMESPACE "crt-redhat-acm-tenant" | |
| _set_default DEFAULT_KA_HOST "https://kubearchive-api-server-product-kubearchive.apps.stone-prd-rh01.pg1f.p1.openshiftapps.com" | |
| _set_default LOG_URL_ANNOTATION "pipelinesascode.tekton.dev/log-url" | |
| _set_default WATCH_INTERVAL 15 | |
| : "${DEFAULT_NAMESPACE:=crt-redhat-acm-tenant}" | |
| : "${DEFAULT_KA_HOST:=https://kubearchive-api-server-product-kubearchive.apps.stone-prd-rh01.pg1f.p1.openshiftapps.com}" | |
| : "${LOG_URL_ANNOTATION:=pipelinesascode.tekton.dev/log-url}" | |
| : "${WATCH_INTERVAL:=15}" |
There was a problem hiding this comment.
I would prefer to keep the readonly protection from more modern bash. I recommend using mac os brew to upgrade your bash
There was a problem hiding this comment.
then, current config looks ok.
|
/override "ci/prow/okd-scos-images" |
|
@celebdor: Overrode contexts on behalf of celebdor: ci/prow/okd-scos-images DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/lgtm |
|
Tests from second stage were triggered manually. Pipeline can be controlled only manually, until HEAD changes. Use command to trigger second stage. |
|
/verified by dhgautam99 |
openshift-ci-robot
added
the
verified
|
@celebdor: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@celebdor: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
5 participants
Summary
hack/tools/scripts/find-push-pipelinerun.shto find Konflux on-push PipelineRun(s) triggered by a merged GitHub PRgh), full GitHub URL, orowner/repo#numberformatoc get, falls back to KubeArchive REST API for archived runspipelinesascode.tekton.dev/log-urlannotation)Example
Test plan
shellcheckpasses cleanbatsunit tests pass (14/14)owner/repo#number, full URL🤖 Generated with Claude Code
Summary by CodeRabbit
PipelineRunrecords for a merged pull request, resolving PR references from common GitHub URL formats.PipelineRunfields (e.g., conditions or log annotations) are missing.