Add workflow to validate UBI images pass RedHat Certification #4035
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #4035 +/- ##
==========================================
- Coverage 86.83% 86.80% -0.04%
==========================================
Files 128 128
Lines 16607 16607
Branches 62 62
==========================================
- Hits 14421 14415 -6
- Misses 2004 2009 +5
- Partials 182 183 +1 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
.github/workflows/ci.yml
Outdated
| openshift-certification: | ||
| name: OpenShift Certification | ||
| needs: [build-oss, build-plus, build-operator] | ||
| if: ${{ inputs.dry_run || false }} |
There was a problem hiding this comment.
If this isn't pushing anything don't need the dry run condition
There was a problem hiding this comment.
However, it also doesn't need to run on every build - maybe only on merges to main and releases
There was a problem hiding this comment.
Sounds good. Just while testing, I'm going to have it run on pull requests as well for this PR.
So it will look like this:
openshift-certification:
name: OpenShift Certification
needs: [build-oss, build-plus, build-operator]
if: >
${{ github.event_name == 'pull_request'
&& github.event.pull_request.base.ref == 'main'
|| (github.event_name == 'push' && github.ref == 'refs/heads/main')
|| (inputs.is_production_release == true)
}}
uses: ./.github/workflows/openshift-certification.yml
with:
runner: ubuntu-24.04
permissions:
contents: read
packages: read
secrets: inherit
| - name: Run preflight for NGINX Gateway Fabric | ||
| env: | ||
| PYXIS_API_TOKEN: ${{ secrets.PYXIS_API_TOKEN }} | ||
| run: preflight check container ghcr.io/nginx/nginx-gateway-fabric:edge-ubi --json > ngf-preflight-result.json |
There was a problem hiding this comment.
Shouldn't the images being tested reflect what was built in this run instead of hardcoding to edge?
There was a problem hiding this comment.
You are right, I added these more to test the pipeline in general. I'll make sure those get updated
There was a problem hiding this comment.
@ciarams87 this should be updated now.
The current approach we're going with is to save the images tagged in the build stage, upload them as artifacts, and then download those for use by the preflight tool.
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
…on in matrix of images
Proposed changes
This change adds a new workflow file,
openshift-certification.ymlwhich is responsible for validating that our UBI based images of NGF, NGINX OSS, and NGF Operator will pass the RedHad certification process.This workflow uses RedHat Openshift Preflight tool to pre-certify images before they are published:
https://github.com/redhat-openshift-ecosystem/openshift-preflight
Closes #3909
Checklist
Before creating a PR, run through this checklist and mark each as complete.
Release notes
If this PR introduces a change that affects users and needs to be mentioned in the release notes,
please add a brief note that summarizes the change.