Merge branch 'development' into pubtools-sign-blob

Author: midnightercz

.github/scripts/tkn_check_compute_resources.sh

@@ -44,14 +44,22 @@ for file in ${CHANGED_FILES}; do
       fail=1
     fi
 
+    # Ensure limits.cpu equals requests.cpu
+    limits_cpu=$(yq '.cpu' <<< "$limits")
+    requests_cpu=$(yq '.cpu' <<< "$requests")
+    if [[ "$limits_cpu" == "null" || "$requests_cpu" == "null" || "$limits_cpu" != "$requests_cpu" ]]; then
+      echo "ERROR: $file step $step_name (index $i) limits.cpu and requests.cpu must be defined and equal"
+      fail=1
+    fi
+
     # Check no other keys exist in computeResources (order-agnostic)
     if ! yq -e 'keys | contains(["limits","requests"]) and length == 2' <<< "$compute_resources" > /dev/null 2>&1; then
       echo "ERROR: $file step $step_name (index $i) computeResources has extra or missing keys"
       fail=1
     else
-      # Check that limits only has memory and/or cpu, requests only has cpu and memory (order-agnostic)
-      if ! yq -e 'keys - ["cpu","memory"] | length == 0' <<< "$limits" > /dev/null 2>&1; then
-        echo "ERROR: $file step $step_name (index $i) computeResources.limits has keys other than memory and cpu"
+      # Check that limits has exactly cpu and memory, requests only has cpu and memory (order-agnostic)
+      if ! yq -e 'keys | contains(["cpu","memory"]) and length == 2' <<< "$limits" > /dev/null 2>&1; then
+        echo "ERROR: $file step $step_name (index $i) computeResources.limits must have exactly cpu and memory"
         fail=1
       fi
       if ! yq -e 'keys | contains(["cpu","memory"]) and length == 2' <<< "$requests" > /dev/null 2>&1; then

.github/workflows/pr-ai-labeler.yaml

@@ -0,0 +1,21 @@
+---
+name: PR AI Labeler
+
+on:
+  pull_request_target:
+    types: [opened, synchronize]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  label-pr:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Label PR using shared action
+        uses: konflux-ci/release-service-automations/pr-ai-labeler@26b8ead8ea7af6dabb73ba72b238b7757ccddb56  # main
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          pr-number: ${{ github.event.pull_request.number }}
+          repository: ${{ github.repository }}

CONTRIBUTING.md

@@ -114,13 +114,17 @@ All steps in the [managed](tasks/managed) and [internal](tasks/internal) tasks h
 If you are contributing a new managed or internal task (or adding a step to an existing one), you must provide appropriate `computeResources`. If you do not do this, your PR will fail
 the linting check due to the check defined in [this script](.github/scripts/tkn_check_compute_resources.sh).
 
-When setting `computeResources`, you should set the `limits.memory` and `requests.memory` to the same value. No `limits.cpu` should be defined, but a `requests.cpu` should be.
-Here is an example
+When setting `computeResources`, you should set:
+- `limits.memory` and `requests.memory` to the same value
+- `limits.cpu` and `requests.cpu` to the same value
+
+Here is an example:
 ```yaml
 - name: my-new-step
   computeResources:
     limits:
       memory: 256Mi
+      cpu: 250m
     requests:
       memory: 256Mi
       cpu: 250m

tasks/internal/check-embargoed-cves-task/check-embargoed-cves-task.yaml

@@ -56,6 +56,7 @@ spec:
       computeResources:
         limits:
           memory: 32Mi
+          cpu: 20m
         requests:
           memory: 32Mi
           cpu: 20m

tasks/internal/check-fbc-opt-in/check-fbc-opt-in.yaml

@@ -77,6 +77,7 @@ spec:
       computeResources:
         limits:
           memory: 512Mi
+          cpu: 200m
         requests:
           memory: 512Mi
           cpu: 200m

tasks/internal/check-signing-certificates/check-signing-certificates.yaml

@@ -41,6 +41,7 @@ spec:
       computeResources:
         limits:
           memory: 128Mi
+          cpu: 100m
         requests:
           memory: 128Mi
           cpu: 100m

tasks/internal/collect-blob-signing-params/collect-blob-signing-params.yaml

@@ -38,6 +38,7 @@ spec:
       computeResources:
         limits:
           memory: 64Mi
+          cpu: 25m
         requests:
           memory: 64Mi
           cpu: 25m

tasks/internal/collect-simple-signing-params/collect-simple-signing-params.yaml

@@ -70,6 +70,7 @@ spec:
       computeResources:
         limits:
           memory: 64Mi
+          cpu: 25m
         requests:
           memory: 64Mi
           cpu: 25m

tasks/internal/create-advisory-oci-artifact-task/create-advisory-oci-artifact-task.yaml

@@ -66,6 +66,7 @@ spec:
       computeResources:
         limits:
           memory: 256Mi
+          cpu: 150m
         requests:
           memory: 256Mi
           cpu: 150m

tasks/internal/create-advisory-task/create-advisory-task.yaml

@@ -90,9 +90,10 @@ spec:
       computeResources:
         limits:
           memory: 256Mi
+          cpu: '1'
         requests:
           memory: 256Mi
-          cpu: '1'  # 1 is the max allowed by at least the staging cluster
+          cpu: '1'
       volumeMounts:
         - name: advisory-secret
           mountPath: /mnt/advisory_secret