Skip to content

CLID-690: Automate invalid related image catalog test (OCP-73784) - #1493

Open
adolfo-ab wants to merge 2 commits into
openshift:mainfrom
adolfo-ab:CLID-690
Open

CLID-690: Automate invalid related image catalog test (OCP-73784)#1493
adolfo-ab wants to merge 2 commits into
openshift:mainfrom
adolfo-ab:CLID-690

Conversation

@adolfo-ab

@adolfo-ab adolfo-ab commented Aug 6, 2026

Copy link
Copy Markdown
Contributor

Description

Add an integration test for OCP-73784 / OCPBUGS-33081, covering an operator catalog whose declarative config contains a bundle with an invalid related image (missing tag/digest, missing name, or unsupported oci:// scheme).

The test mirrors a catalog with one valid bundle and one bundle whose related image has no tag or digest, and documents oc-mirror's current behavior: the whole catalog collection fails (exit code 4) instead of
skipping just the invalid bundle and mirroring the rest. Fixing that behavior is tracked as separate follow-up work; this PR only adds test coverage for the current state.

Adds a new test-catalog-invalid-images fixture under image-builders/operator/catalogs, built and pushed to quay.io/oc-mirror/oc-mirror-dev the same way as the other test catalogs.

Github / Jira issue:

Type of change

Please delete options that are not relevant.

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • Code Improvements (Refactoring, Performance, CI upgrades, etc)
  • Internal repo assets (diagrams / docs on github repo)
  • This change requires a documentation update on openshift docs

How Has This Been Tested?

Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce. Please also list any relevant details for your test configuration.

Expected Outcome

Please describe the outcome expected from the tests.

Summary by CodeRabbit

Bug Fixes

  • Improved handling of operator catalogs with invalid related-image references.
  • Mirroring now reports clear validation errors and avoids creating partial registry content.
  • Improved cleanup during mirroring so registry activity is completed before archive creation.

Tests

  • Added integration coverage for catalogs containing valid and invalid bundles.
  • Added fixtures and documentation describing invalid related-image scenarios and expected behavior.

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Aug 6, 2026
@openshift-ci-robot

openshift-ci-robot commented Aug 6, 2026

Copy link
Copy Markdown

@adolfo-ab: This pull request references CLID-690 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target either version "5.0." or "openshift-5.0.", but it targets "openshift-5.1" instead.

Details

In response to this:

Description

Add an integration test for OCP-73784 / OCPBUGS-33081, covering an
operator catalog whose declarative config contains a bundle with an
invalid related image (missing tag/digest, missing name, or
unsupported oci:// scheme).

The test mirrors a catalog with one valid bundle and one bundle whose
related image has no tag or digest, and documents oc-mirror's current
behavior: the whole catalog collection fails (exit code 4) instead of
skipping just the invalid bundle and mirroring the rest. Fixing that
behavior is tracked as separate follow-up work; this PR only adds test
coverage for the current state.

Adds a new test-catalog-invalid-images fixture under
image-builders/operator/catalogs, built and pushed to
quay.io/oc-mirror/oc-mirror-dev the same way as the other test catalogs.

Github / Jira issue:

Type of change

Please delete options that are not relevant.

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • Code Improvements (Refactoring, Performance, CI upgrades, etc)
  • Internal repo assets (diagrams / docs on github repo)
  • This change requires a documentation update on openshift docs

How Has This Been Tested?

Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce. Please also list any relevant details for your test configuration.

Expected Outcome

Please describe the outcome expected from the tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci
openshift-ci Bot requested a review from aguidirh August 6, 2026 11:12
@openshift-ci

openshift-ci Bot commented Aug 6, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: adolfo-ab

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci
openshift-ci Bot requested a review from r4f4 August 6, 2026 11:12
@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 6, 2026
@coderabbitai

coderabbitai Bot commented Aug 6, 2026

Copy link
Copy Markdown

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 99c75146-c209-4940-87d6-ca56c6e482c5

📥 Commits

Reviewing files that changed from the base of the PR and between 86321c7 and d7f0e9c.

📒 Files selected for processing (2)
  • tests/integration/image-builders/operator/catalogs/README.md
  • tests/integration/operators_test.go
🚧 Files skipped from review as they are similar to previous changes (2)
  • tests/integration/image-builders/operator/catalogs/README.md
  • tests/integration/operators_test.go

Walkthrough

This change adds an invalid related-image operator catalog and integration coverage. It also updates mirror-to-disk archiving to stop the local registry before archiving the working directory and registry log.

Changes

Invalid related-image catalog validation

Layer / File(s) Summary
Invalid related-image catalog validation
tests/integration/image-builders/operator/catalogs/test-catalog-invalid-images/foo/*, tests/integration/image-builders/operator/catalogs/README.md, tests/integration/testdata/imagesetconfigs/operators/isc-operator-invalid-images.yaml, tests/integration/operators_test.go
Adds the foo package, beta channel, valid and invalid bundles, catalog documentation, mirroring configuration, and validation for exit code 4 with no mirrored repositories.

Archive registry shutdown

Layer / File(s) Summary
Registry shutdown before archive completion
internal/pkg/archive/*, internal/pkg/cli/executor.go, internal/pkg/cli/executor_test.go
Adds an optional BuildArchive callback, invokes it after blob gathering, and makes local-registry shutdown idempotent before working-directory archiving.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant RunMirrorToDisk
  participant BuildArchive
  participant LocalRegistry
  participant Archive
  RunMirrorToDisk->>BuildArchive: provide onBlobsGathered callback
  BuildArchive->>BuildArchive: gather image blobs
  BuildArchive->>RunMirrorToDisk: invoke callback
  RunMirrorToDisk->>LocalRegistry: stopLocalRegistry
  BuildArchive->>Archive: archive working directory and registry log
Loading

Suggested reviewers: r4f4, aguidirh

🚥 Pre-merge checks | ✅ 13 | ❌ 2

❌ Failed checks (2 warnings)

Check name Status Explanation Resolution
Microshift Test Compatibility ⚠️ Warning The new unguarded Ginkgo test at operators_test.go:123-134 mirrors an OLM catalog whose bundle embeds operators.coreos.com/v1alpha1 ClusterServiceVersion data. Add an [apigroup:operators.coreos.com] or [Skipped:MicroShift] label to the Describe/test, or guard it with IsMicroShiftCluster and g.Skip().
Ipv6 And Disconnected Network Test Compatibility ⚠️ Warning The new Ginkgo test mirrors catalog quay.io/oc-mirror/oc-mirror-dev, and its bundle fixture also uses quay.io images; this requires public registry access. Add [Skipped:Disconnected] or use an internal mirror. Verify with periodic-ci-openshift-release-master-nightly-4.22-e2e-metal-ipi-ovn-ipv6.
✅ Passed checks (13 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly identifies the main change: automating an integration test for catalogs with invalid related images.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed The added Ginkgo titles are static: Describe("catalog with a bundle containing an invalid related image") and It("handles invalid related image references in a catalog").
Test Structure And Quality ✅ Passed The Ginkgo test has one related scenario, uses BeforeEach/AfterEach cleanup, runs with the suite timeout context, has no indefinite waits, and uses diagnostic assertion helpers.
Single Node Openshift (Sno) Test Compatibility ✅ Passed The operator spec runs oc-mirror against an in-process localhost registry and checks exit code and repository contents; it makes no node, topology, scheduling, or HA assumptions.
Topology-Aware Scheduling Compatibility ✅ Passed The PR changes archive/CLI shutdown logic and integration catalog tests only; it adds no deployment manifests, controllers, operator scheduling code, or topology constraints.
Ote Binary Stdout Contract ✅ Passed The PR adds no process-level stdout writes; the new test emits no output, and existing suite diagnostics use GinkgoWriter inside permitted test hooks.
No-Weak-Crypto ✅ Passed The full PR diff adds no MD5, SHA-1, DES, RC4, Blowfish, ECB, custom crypto, or secret comparisons; changes are archive callbacks, registry shutdown, tests, and catalog fixtures.
Container-Privileges ✅ Passed The PR changes Go code, tests, and README only. No changed container or Kubernetes manifest contains privileged, host namespace, SYS_ADMIN, root, or allowPrivilegeEscalation settings.
No-Sensitive-Data-In-Logs ✅ Passed The change adds no sensitive log fields; its callback only stops the registry. Registry access logs contain request metadata and go to stdout, while fixtures use synthetic references and a project...
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🧹 Nitpick comments (1)
tests/integration/operators_test.go (1)

130-130: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

Bind the error assertion to the invalid image.

Line 130 checks generic collection-error text. It does not prove that registry.example.com/foo/operand-missing-tag or foo.v0.9.9-invalid-related-image caused the failure. Include a fixture-specific token in the expected output, or inspect the collection error directly, so the test cannot pass after it stops exercising this invalid-related-image path.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/integration/operators_test.go` at line 130, Strengthen the assertion in
the test around expectOcMirrorExitCode so the expected error output includes a
token uniquely identifying the invalid image fixture, such as its repository or
tag, alongside the existing collection-error and empty tag checks. Ensure the
test fails if the invalid-related-image path is no longer exercised.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/integration/image-builders/operator/catalogs/README.md`:
- Around line 149-154: Align the fixture documentation with the behavior
asserted by the integration test in operators_test.go: state that this case
reproduces the whole-catalog failure, including exit code 4 and no mirrored
repositories. Do not describe graceful skipping as the expected outcome unless
you also update the corresponding test expectation.

---

Nitpick comments:
In `@tests/integration/operators_test.go`:
- Line 130: Strengthen the assertion in the test around expectOcMirrorExitCode
so the expected error output includes a token uniquely identifying the invalid
image fixture, such as its repository or tag, alongside the existing
collection-error and empty tag checks. Ensure the test fails if the
invalid-related-image path is no longer exercised.
🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 3ceb4e9b-4b48-4f1e-a127-4fecd63e7152

📥 Commits

Reviewing files that changed from the base of the PR and between 75a5e05 and 7b558b6.

📒 Files selected for processing (6)
  • tests/integration/image-builders/operator/catalogs/README.md
  • tests/integration/image-builders/operator/catalogs/test-catalog-invalid-images/foo/bundles.yaml
  • tests/integration/image-builders/operator/catalogs/test-catalog-invalid-images/foo/channels.yaml
  • tests/integration/image-builders/operator/catalogs/test-catalog-invalid-images/foo/operator.yaml
  • tests/integration/operators_test.go
  • tests/integration/testdata/imagesetconfigs/operators/isc-operator-invalid-images.yaml

Comment thread tests/integration/image-builders/operator/catalogs/README.md Outdated

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🧹 Nitpick comments (2)
internal/pkg/archive/archive_test.go (1)

84-84: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick win

Add coverage for the non-nil callback path.

Every changed call passes nil, so these tests verify only the new signature. They do not verify that the callback runs once after addImagesDiff and before working-dir is archived. Add a focused ordering test because this boundary controls registry-log completeness.

Also applies to: 107-107, 136-136, 161-161, 185-185

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/pkg/archive/archive_test.go` at line 84, The archive tests currently
cover only a nil callback; add a focused non-nil callback test around
BuildArchive that records callback execution and verifies it runs exactly once
after addImagesDiff completes but before the working directory is archived.
Update the relevant BuildArchive test setup to pass the callback and assert this
ordering while preserving existing archive behavior.
internal/pkg/cli/executor.go (1)

944-948: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Preserve the global logrus output after registry shutdown.

The callback now runs before BuildArchive finishes. stopLocalRegistry changes the global logrus output to io.Discard and never restores it. Later logrus messages from archive work or other in-process work are silently lost. Restore the previous output after closing registryLogFile, or use a registry-specific logger.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/pkg/cli/executor.go` around lines 944 - 948, Update
stopLocalRegistry to preserve and restore the global logrus output after
shutting down the registry. Capture the previous output before switching to
io.Discard, then restore it after closing registryLogFile so subsequent
BuildArchive and in-process logging remains visible.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@internal/pkg/cli/executor.go`:
- Around line 763-771: The stopLocalRegistry method must only set
registryStopped after LocalStorageService.Shutdown and log-file cleanup complete
successfully. Propagate any shutdown error to the BuildArchive callback and Run
cleanup so archiving stops instead of continuing with an active registry; retain
idempotent behavior for successful prior cleanup.

---

Nitpick comments:
In `@internal/pkg/archive/archive_test.go`:
- Line 84: The archive tests currently cover only a nil callback; add a focused
non-nil callback test around BuildArchive that records callback execution and
verifies it runs exactly once after addImagesDiff completes but before the
working directory is archived. Update the relevant BuildArchive test setup to
pass the callback and assert this ordering while preserving existing archive
behavior.

In `@internal/pkg/cli/executor.go`:
- Around line 944-948: Update stopLocalRegistry to preserve and restore the
global logrus output after shutting down the registry. Capture the previous
output before switching to io.Discard, then restore it after closing
registryLogFile so subsequent BuildArchive and in-process logging remains
visible.
🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: eea6d654-726f-4d5d-a60f-af654acf94d2

📥 Commits

Reviewing files that changed from the base of the PR and between 7b558b6 and 86321c7.

📒 Files selected for processing (5)
  • internal/pkg/archive/archive.go
  • internal/pkg/archive/archive_test.go
  • internal/pkg/archive/interface.go
  • internal/pkg/cli/executor.go
  • internal/pkg/cli/executor_test.go

Comment thread internal/pkg/cli/executor.go
@openshift-ci

openshift-ci Bot commented Aug 11, 2026

Copy link
Copy Markdown

@adolfo-ab: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Comment on lines +767 to +770
if o.registryStopped {
return
}
o.registryStopped = true

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could we use sync.Once to run the function contents only once via a synchronization primitive instead of using a non-mutexed mutable variable?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants