/konflux-build

name: konflux-build
description: Create a manual Konflux build from a PR with configurable image expiry (default 30 days)

Create a manual Konflux build from a PR

Given a PR and a component name, create a manual PipelineRun that produces a container image. By default the image expires after 30 days. Use `--non-expiring` to produce a permanent image.

Usage Examples

1. **Build a specific component from a PR number** (expires in 30 days): `/konflux-build 7813 hypershift-release-mce-26`

2. **Build from a PR URL** (will prompt for component): `/konflux-build https://github.com/openshift/hypershift/pull/7813`

3. **Build a non-expiring image for a hotfix**: `/konflux-build 7813 hypershift-operator --non-expiring`

4. **Build using a specific pipeline template**: `/konflux-build 7813 .tekton/hypershift-release-mce-26-push.yaml`

5. **Build the main operator from a PR**: `/konflux-build 7500 hypershift-operator`

What This Command Does

1. Verifies you are logged into the Konflux cluster (`stone-prd-rh01`) 2. Resolves the PR to get its head commit SHA and base branch 3. Finds the matching push pipeline template from `.tekton/` on the base branch 4. Generates a manual PipelineRun YAML with template variables resolved 5. Sets image expiry to 30 days (or removes it if `--non-expiring` is specified) 6. Creates the PipelineRun and polls until completion 7. Reports the final image reference with `@sha256:` digest

Input

• **PR**: $ARGUMENTS (GitHub PR URL or number for openshift/hypershift)
• **Component or pipeline file**: either a component name (e.g., `hypershift-operator`) or a path to a specific pipeline template (e.g., `.tekton/hypershift-release-mce-26-push.yaml`). If not specified, ask the user which component to build.
• If `--non-expiring` is present in the arguments, produce a permanent image; otherwise set `image-expires-after: 30d`

Steps

0. Pre-check: verify OpenShift login

Before doing anything else, verify the user is logged in to the correct cluster and project:

1. Run `oc whoami --show-server` and confirm it returns `https://api.stone-prd-rh01.pg1f.p1.openshiftapps.com:6443`. If not, stop and tell the user to log in:

   oc login https://api.stone-prd-rh01.pg1f.p1.openshiftapps.com:6443

2. Run `oc project -q` and confirm it returns `crt-redhat-acm-tenant`. If not, switch to it:

   oc project crt-redhat-acm-tenant

If the switch fails, stop and tell the user they don't have access to the required namespace.

Only proceed to the next steps once both checks pass.

1. Resolve the PR

Use `gh pr view <PR> --json headRefOid,headRefName,baseRefName,url` to get:

• The commit SHA (`headRefOid`)
• The base branch (`baseRefName`) — this determines which push template to use
• The PR URL for reference

2. Find the push pipeline template

If the user provided a specific pipeline file path (e.g., `.tekton/hypershift-release-mce-26-push.yaml`), use that template directly via `git show <baseRef>:<pipeline-file>`.

Otherwise, look in the `.tekton/` directory of the PR's base branch for `*-push.yaml` files. Match by component name if provided, or list the available components and let the user pick.

The template lives on the **base branch** of the PR. Use `git show <baseRef>:.tekton/` to list available templates, then `git show <baseRef>:.tekton/<template-file>` to read the chosen one.

3. Generate the PipelineRun YAML

Take the push pipeline template and resolve it into a concrete PipelineRun:

• Replace `name` with `generateName` based on the template's `name` field, replacing `-on-push` with `-manual-push-`
• Remove all `pipelinesascode.tekton.dev/*` annotations (these are PaC trigger annotations, not needed for manual runs)
• Replace `{{revision}}` and `{{source_url}}` with actual values:
• `{{revision}}` → the PR's head commit SHA
• `{{source_url}}` → `https://github.com/openshift/hypershift.git`
• `{{target_branch}}` → the PR's base branch
• **Image expiry handling:**
• If `--non-expiring` was specified: remove `image-expires-after` param entirely
• Otherwise: ensure an `image-expires-after` param is present with value `30d` (add it if the template doesn't have one, or update it if it does)
• Replace the git-auth workspace secret reference (`{{ git_auth_secret }}`) with `git-auth-empty`
• If `pipelineRef` uses a `resolver: git`, keep it as-is. If it uses `name:`, keep it as-is.
• Write the YAML to `/tmp/<component>-manual-push.yaml`

4. Ensure the git-auth-empty secret exists

The git-clone Tekton task requires the `git-auth` workspace to be a `kubernetes.io/basic-auth` typed secret. Since openshift/hypershift is a public repo, we use an empty secret instead of real credentials (which would be visible to all tenant users):

oc get secret git-auth-empty -n crt-redhat-acm-tenant 2>/dev/null || \
oc create secret generic git-auth-empty \
  --type=kubernetes.io/basic-auth \
  --from-literal=username='' \
  --from-literal=password='' \
  -n crt-redhat-acm-tenant

5. Show the user the PipelineRun YAML and confirm

Display the generated YAML and ask for confirmation before applying. Clearly indicate whether the image will expire (and when) or be permanent.

6. Apply the PipelineRun

oc create -f /tmp/<component>-manual-push.yaml

Report the PipelineRun name.

7. Wait for the image and report the digest

Poll `oc get pipelinerun <name>` every 30 seconds until it completes or disappears (archived).

Once done (or if the PipelineRun gets archived before we can check), use `skopeo` to get the image digest:

skopeo inspect --no-tags docker://<output-image-url>

Report the final image reference in `@sha256:` digest form, e.g.:

quay.io/redhat-user-workloads/crt-redhat-acm-tenant/<component>@sha256:<digest>

Also show per-architecture digests from the manifest list if it's a multi-arch build.

Remind the user whether the image expires (and when) or is p