ROX-34386: Add image labels by mtodor · Pull Request #162 · stackrox/stackrox-mcp

mtodor · 2026-07-21T16:04:39Z

Description

Since we didn't define labels in Dockerfile build - we get default labels from UBI Micro

Validation

Wait for Konflux build
Pull image and check labels

coderabbitai · 2026-07-21T16:06:45Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

📝 Walkthrough

Walkthrough

Tekton now derives a git-based version and passes it to build and SAST tasks. The runtime image uses that version in OCI labels, while pull-request and push PipelineRuns add a CPE extra-labels parameter.

Changes

Release metadata

Layer / File(s)	Summary
Version derivation and propagation `.tekton/basic-component-pipeline.yaml`	Adds a task that computes a git-based version, combines generated and extra labels, and passes the version to container builds and SAST analysis.
Runtime image labels `konflux.Dockerfile`	Adds OCI metadata labels and populates image `version` from `${VERSION}` while setting `release` to `"1"`.
Pipeline label parameters `.tekton/acs-mcp-server-pull-request.yaml`, `.tekton/acs-mcp-server-push.yaml`	Adds `extra-labels` with a CPE label value and version-stream update guidance.

Estimated code review effort: 2 (Simple) | ~10 minutes

Sequence Diagram(s)

sequenceDiagram
  participant clone-repository
  participant determine-version
  participant build-container
  participant sast-coverity-check
  clone-repository->>determine-version: provide SOURCE_ARTIFACT
  determine-version->>determine-version: derive git version
  determine-version->>build-container: pass VERSION and labels
  determine-version->>sast-coverity-check: pass VERSION

Suggested reviewers: janisz

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly matches the main change: adding image labels and related metadata.
Description check	✅ Passed	The description is directly related to the PR's label changes and validation steps.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch mtodor/ROX-34386-add-labels

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@konflux.Dockerfile`:
- Line 73: Redeclare the VERSION build argument in the final Dockerfile stage
immediately before the label that uses it. Ensure the existing version label
receives the supplied VERSION value instead of relying on the out-of-scope ARG
declared before the first FROM.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: dc783983-b071-4a82-977b-45506eb5c8fa

📥 Commits

Reviewing files that changed from the base of the PR and between 0b298ff and bbc7460.

📒 Files selected for processing (1)

konflux.Dockerfile

codecov-commenter · 2026-07-21T16:09:50Z

❌ 2 Tests Failed:

Tests completed	Failed	Passed	Skipped
380	2	378	12

View the full list of 2 ❄️ flaky test(s)

::policy 1
Flake rate in main: 100.00% (Passed 0 times, Failed 66 times)
Stack Traces | 0s run time
- test violation 1
- test violation 2
- test violation 3

::policy 4
Flake rate in main: 100.00% (Passed 0 times, Failed 66 times)
Stack Traces | 0s run time
- testing multiple alert violation messages 1
- testing multiple alert violation messages 2
- testing multiple alert violation messages 3

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}

github-actions · 2026-07-21T16:10:44Z

E2E Test Results

Commit: d078e6d
Workflow Run: View Details
Artifacts: Download test results & logs

=== Evaluation Summary ===

  ✓ cve-clusters-general (assertions: 3/3)
  ✓ cve-cluster-does-exist (assertions: 3/3)
  ✓ cve-cluster-list (assertions: 3/3)
  ✓ cve-cluster-does-not-exist (assertions: 3/3)
  ✓ cve-multiple (assertions: 3/3)
  ✓ rhsa-not-supported (assertions: 2/2)
  ✓ cve-log4shell (assertions: 3/3)
  ✓ cve-detected-clusters (assertions: 3/3)
  ~ cve-nonexistent (assertions: 2/3)
      - MaxToolCalls: Too many tool calls: expected <= 5, got 12
  ✓ list-clusters (assertions: 3/3)
  ✓ cve-detected-workloads (assertions: 3/3)

Tasks:      11/11 passed (100.00%)
Assertions: 31/32 passed (96.88%)
Tokens:     ~62369 (estimate - excludes system prompt & cache)
MCP schemas: ~12562 (included in token total)
Agent used tokens:
  Input:  14484 tokens
  Output: 23565 tokens
Judge used tokens:
  Input:  51814 tokens
  Output: 42962 tokens

coderabbitai

Actionable comments posted: 4

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.tekton/basic-component-pipeline.yaml:
- Around line 178-190: Define explicit CPU and memory requests and limits for
the new use-trusted-artifact and determine-version steps by adding
computeResources to their stepTemplate or individual step definitions. Keep the
resource values consistent with the pipeline’s existing resource conventions.
- Line 195: Update the VERSION assignment in the pipeline to use only git
describe --tags --always, removing the || echo "dev" fallback so repository or
setup failures are not masked and bogus build versions are not propagated.
- Around line 183-189: Parameterize the images used by the inline taskSpec steps
use-trusted-artifact and determine-version instead of embedding them directly.
Add task parameters for these image references and update each step’s image
field to consume the corresponding parameter, preserving the existing pinned
image values as defaults and complying with the .tekton image policy.
- Around line 249-252: Update the BUILD_ARGS list in the pipeline so
$(params.build-args[*]) appears before
VERSION=$(tasks.determine-version.results.VERSION). Ensure the generated VERSION
remains the final argument, preserving its precedence over any caller-supplied
VERSION value in both BUILD_ARGS lists.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: 95e6005e-ba96-421b-841c-e6f8599b583b

📥 Commits

Reviewing files that changed from the base of the PR and between 721ced8 and 460cddd.

📒 Files selected for processing (2)

.tekton/basic-component-pipeline.yaml
konflux.Dockerfile

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.tekton/basic-component-pipeline.yaml:
- Around line 188-193: Add a limits.cpu value alongside the existing memory
limit in the computeResources configuration for the inline task steps, using the
pipeline’s established standard CPU-limit value. Preserve the current CPU
request and memory settings.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: d87056a7-e4c8-4661-86c7-b7c6329195ce

📥 Commits

Reviewing files that changed from the base of the PR and between 460cddd and 876db12.

📒 Files selected for processing (2)

.tekton/basic-component-pipeline.yaml
konflux.Dockerfile

coderabbitai · 2026-07-22T14:08:49Z

+        computeResources:
+          requests:
+            cpu: 100m
+            memory: 256Mi
+          limits:
+            memory: 512Mi


🚀 Performance & Scalability | 🟠 Major | ⚡ Quick win

Set a CPU limit for the inline task steps.

Line 188-193 defines a CPU request and memory limit, but no limits.cpu; both steps can still consume unbounded CPU on shared CI workers. Add a CPU limit using the pipeline’s standard value.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.tekton/basic-component-pipeline.yaml around lines 188 - 193, Add a limits.cpu value alongside the existing memory limit in the computeResources configuration for the inline task steps, using the pipeline’s established standard CPU-limit value. Preserve the current CPU request and memory settings.

Source: Path instructions

mtodor · 2026-07-22T16:51:48Z

Check labels and they look good.

Version is: "version": "v0.1.0-77-gd078e6d" - but that is expected, since we don't have 0.2 tag yet.

Add labels

bbc7460

mtodor requested a review from janisz as a code owner July 21, 2026 16:04

coderabbitai Bot reviewed Jul 21, 2026

View reviewed changes

Comment thread konflux.Dockerfile Outdated

mtodor added 3 commits July 22, 2026 10:35

Fix version in Labels

cef568a

Add correct CPE

721ced8

Fix version

460cddd

coderabbitai Bot reviewed Jul 22, 2026

View reviewed changes

Comment thread .tekton/basic-component-pipeline.yaml

Comment thread .tekton/basic-component-pipeline.yaml Outdated

Comment thread .tekton/basic-component-pipeline.yaml Outdated

Comment thread .tekton/basic-component-pipeline.yaml

Review comments

876db12

coderabbitai Bot reviewed Jul 22, 2026

View reviewed changes

kurlov reviewed Jul 22, 2026

View reviewed changes

Comment thread .tekton/acs-mcp-server-pull-request.yaml

Comment thread .tekton/basic-component-pipeline.yaml

Comment thread konflux.Dockerfile Outdated

kurlov approved these changes Jul 22, 2026

View reviewed changes

Fix release label

d078e6d

mtodor merged commit 3dd6a3a into release-0.2 Jul 22, 2026
11 checks passed

mtodor deleted the mtodor/ROX-34386-add-labels branch July 22, 2026 16:52

Uh oh!

Conversation

mtodor commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Validation

Uh oh!

coderabbitai Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

codecov-commenter commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ 2 Tests Failed:

Uh oh!

github-actions Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

E2E Test Results

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Jul 22, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mtodor commented Jul 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

mtodor commented Jul 21, 2026 •

edited

Loading

coderabbitai Bot commented Jul 21, 2026 •

edited

Loading

codecov-commenter commented Jul 21, 2026 •

edited

Loading

github-actions Bot commented Jul 21, 2026 •

edited

Loading