Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion .dockerignore
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,8 @@ tests/
.idea/

# git
.git/
# .git/ is intentionally NOT ignored: the Dockerfile needs it to resolve the
# code-server git submodule (COPY .git ...). Ensure CI uses a shallow clone.
.gitignore
.gitkeep

Expand Down
4 changes: 4 additions & 0 deletions .github/workflows/build-notebooks-TEMPLATE.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -272,6 +272,10 @@ jobs:
# Hermetic builds: when the target ships a prefetch-input/ directory,
# download all dependencies into cachi2/output/ so the Dockerfile can
# build fully offline. Targets without prefetch-input/ are unaffected.
# For RHDS/AIPCC builds (subscription: true), the --rhds flag selects the
# downstream lockfiles and the SUBSCRIPTION_* env vars supply the RHEL
# credentials for RPM downloads from cdn.redhat.com — secrets never
# appear on the command line.
- name: "Prefetch hermetic build dependencies"
id: prefetch
run: |
Expand Down
1 change: 1 addition & 0 deletions .tekton/multiarch-combined-pipeline.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -263,6 +263,7 @@ spec:
value:
- $(params.build-platforms)
name: build-images
timeout: 4h
params:
- name: IMAGE
value: $(params.output-image)
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,13 @@ metadata:
pipelinesascode.tekton.dev/max-keep-runs: '3'
pipelinesascode.tekton.dev/on-comment: ^/kfbuild\s+(all|odh\-workbench\-codeserver\-datascience\-cpu\-py312\-ubi9|codeserver/ubi9\-python\-3\.12)
pipelinesascode.tekton.dev/on-cel-expression: |
event == "pull_request" && target_branch == "main" && !("manifests/base/params-latest.env".pathChanged()) && ( ".tekton/odh-workbench-codeserver-datascience-cpu-py312-ubi9-pull-request.yaml".pathChanged() || "codeserver/ubi9-python-3.12/**".pathChanged() || "codeserver/ubi9-python-3.12/build-args/cpu.conf".pathChanged() )
&& body.repository.full_name == "opendatahub-io/notebooks"
event == "pull_request" && target_branch == "main" &&
!("manifests/base/params-latest.env".pathChanged()) &&
(
".tekton/odh-workbench-codeserver-datascience-cpu-py312-ubi9-pull-request.yaml".pathChanged() ||
"codeserver/ubi9-python-3.12/**".pathChanged() ||
"codeserver/ubi9-python-3.12/build-args/cpu.conf".pathChanged()
) && body.repository.full_name == "opendatahub-io/notebooks"
labels:
appstudio.openshift.io/application: opendatahub-release
appstudio.openshift.io/component: odh-workbench-codeserver-datascience-cpu-py312-ubi9
Expand All @@ -27,6 +32,8 @@ spec:
params:
- name: event-type
value: '{{event_type}}'
- name: enable-cache-proxy
value: "true"
- name: git-url
value: '{{source_url}}'
- name: revision
Expand All @@ -47,6 +54,124 @@ spec:
value: .
- name: build-args-file
value: codeserver/ubi9-python-3.12/build-args/cpu.conf
- name: hermetic
value: "true"
- name: prefetch-input
value:
- path: codeserver/ubi9-python-3.12/prefetch-input/odh
type: rpm
- path: codeserver/ubi9-python-3.12/prefetch-input/odh
type: generic
- path: codeserver/ubi9-python-3.12
type: pip
binary:
arch: "x86_64,aarch64,ppc64le"
requirements_files: ["requirements.cpu.txt"]
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/.vscode/extensions/vscode-selfhost-import-aid
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/.vscode/extensions/vscode-selfhost-test-provider
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/build
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/build/npm/gyp
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/configuration-editing
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/css-language-features
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/css-language-features/server
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/debug-auto-launch
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/debug-server-ready
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/emmet
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/extension-editing
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/git
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/git-base
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/github
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/github-authentication
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/grunt
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/gulp
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/html-language-features
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/html-language-features/server
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/ipynb
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/jake
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/json-language-features
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/json-language-features/server
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/markdown-language-features
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/markdown-math
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/media-preview
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/merge-conflict
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/mermaid-chat-features
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/notebook-renderers
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/npm
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/php-language-features
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/references-view
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/simple-browser
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/tunnel-forwarding
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/typescript-language-features
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/vscode-api-tests
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/vscode-colorize-perf-tests
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/vscode-colorize-tests
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/vscode-test-resolver
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/remote
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/remote/web
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/test/automation
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/test/integration/browser
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/test/mcp
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/test/monaco
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/test/smoke
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/test/e2e/extensions/test-extension
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server
type: npm
# patches/
- path: codeserver/ubi9-python-3.12/prefetch-input/patches/code-server-v4.106.3/lib/vscode
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/patches/code-server-v4.106.3/test
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/patches/code-server-v4.106.3/lib/vscode/extensions/microsoft-authentication
type: npm
pipelineRef:
name: multiarch-combined-pipeline
taskRunTemplate:
Expand Down
132 changes: 131 additions & 1 deletion .tekton/odh-workbench-codeserver-datascience-cpu-py312-ubi9-push.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,13 @@ metadata:
pipelinesascode.tekton.dev/cancel-in-progress: "false"
pipelinesascode.tekton.dev/max-keep-runs: "3"
build.appstudio.openshift.io/build-nudge-files: "manifests/base/params-latest.env"
pipelinesascode.tekton.dev/on-cel-expression: event == "push" && target_branch == "main" && !("manifests/base/params-latest.env".pathChanged()) && ( ".tekton/odh-workbench-codeserver-datascience-cpu-py312-ubi9-push.yaml".pathChanged() || "codeserver/ubi9-python-3.12/**".pathChanged() || "codeserver/ubi9-python-3.12/build-args/cpu.conf".pathChanged() )
pipelinesascode.tekton.dev/on-cel-expression: |
event == "push" && target_branch == "main" &&
!("manifests/base/params-latest.env".pathChanged()) &&
(
".tekton/odh-workbench-codeserver-datascience-cpu-py312-ubi9-push.yaml".pathChanged() ||
"codeserver/ubi9-python-3.12/**".pathChanged()
)
creationTimestamp:
labels:
appstudio.openshift.io/application: opendatahub-release
Expand All @@ -17,9 +23,13 @@ metadata:
name: odh-workbench-codeserver-datascience-cpu-py312-ubi9-on-push
namespace: open-data-hub-tenant
spec:
timeouts:
pipeline: 6h
params:
- name: event-type
value: '{{event_type}}'
- name: enable-cache-proxy
value: "true"
- name: git-url
value: '{{source_url}}'
- name: revision
Expand All @@ -30,6 +40,8 @@ spec:
value: codeserver/ubi9-python-3.12/Dockerfile.cpu
- name: build-args-file
value: codeserver/ubi9-python-3.12/build-args/cpu.conf
- name: hermetic
value: "true"
- name: path-context
value: .
- name: additional-tags
Expand All @@ -40,6 +52,124 @@ spec:
value:
- linux-d160-m4xlarge/amd64
- linux-d160-m4xlarge/arm64
- linux/ppc64le
- name: prefetch-input
value:
- path: codeserver/ubi9-python-3.12/prefetch-input/odh
type: rpm
- path: codeserver/ubi9-python-3.12/prefetch-input/odh
type: generic
- path: codeserver/ubi9-python-3.12
type: pip
binary:
arch: "x86_64,aarch64,ppc64le"
requirements_files: ["requirements.cpu.txt"]
Comment on lines 56 to 66
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify hermetic parameter presence in both Tekton YAMLs
echo "=== Pull-request YAML ==="
rg -n 'hermetic' .tekton/odh-workbench-codeserver-datascience-cpu-py312-ubi9-pull-request.yaml || echo "NOT FOUND"

echo ""
echo "=== Push YAML ==="
rg -n 'hermetic' .tekton/odh-workbench-codeserver-datascience-cpu-py312-ubi9-push.yaml || echo "NOT FOUND"

echo ""
echo "=== Check for all push YAMLs with hermetic ==="
rg -l 'hermetic' .tekton/*push*.yaml 2>/dev/null || echo "No push YAMLs have hermetic"

echo ""
echo "=== Display relevant section of push YAML around lines 49-59 ==="
sed -n '45,65p' .tekton/odh-workbench-codeserver-datascience-cpu-py312-ubi9-push.yaml

Repository: opendatahub-io/notebooks

Length of output: 1112


Add missing hermetic: "true" parameter to push pipeline configuration.

The pull-request YAML includes hermetic: "true" (line 57), but the push YAML omits it entirely. Without this parameter, Konflux/Tekton won't enforce network isolation during the build, making the prefetch-input block ineffective — the build will still have network access and won't consume prefetched dependencies.

🐛 Proposed fix
   - name: build-args-file
     value: codeserver/ubi9-python-3.12/build-args/cpu.conf
+  - name: hermetic
+    value: "true"
   - name: prefetch-input
     value:
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.tekton/odh-workbench-codeserver-datascience-cpu-py312-ubi9-push.yaml around
lines 49 - 59, The push pipeline configuration is missing the hermetic: "true"
parameter which disables network access and makes the prefetch-input block
effective; update the push YAML to add hermetic: "true" alongside the
prefetch-input spec (the same location where prefetch-input and its paths/types
are declared) so the build runs in hermetic mode and consumes prefetched
artifacts; ensure the hermetic key is a top-level field in that task/pipeline
step (matching how hermetic was added in the PR for the other YAML) and keep the
prefetch-input entries unchanged.

- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/.vscode/extensions/vscode-selfhost-import-aid
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/.vscode/extensions/vscode-selfhost-test-provider
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/build
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/build/npm/gyp
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/configuration-editing
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/css-language-features
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/css-language-features/server
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/debug-auto-launch
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/debug-server-ready
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/emmet
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/extension-editing
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/git
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/git-base
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/github
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/github-authentication
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/grunt
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/gulp
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/html-language-features
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/html-language-features/server
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/ipynb
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/jake
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/json-language-features
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/json-language-features/server
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/markdown-language-features
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/markdown-math
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/media-preview
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/merge-conflict
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/mermaid-chat-features
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/notebook-renderers
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/npm
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/php-language-features
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/references-view
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/simple-browser
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/tunnel-forwarding
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/typescript-language-features
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/vscode-api-tests
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/vscode-colorize-perf-tests
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/vscode-colorize-tests
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/extensions/vscode-test-resolver
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/remote
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/remote/web
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/test/automation
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/test/integration/browser
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/test/mcp
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/test/monaco
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/lib/vscode/test/smoke
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server/test/e2e/extensions/test-extension
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/code-server
type: npm
# patches/
- path: codeserver/ubi9-python-3.12/prefetch-input/patches/code-server-v4.106.3/lib/vscode
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/patches/code-server-v4.106.3/test
type: npm
- path: codeserver/ubi9-python-3.12/prefetch-input/patches/code-server-v4.106.3/lib/vscode/extensions/microsoft-authentication
type: npm

pipelineRef:
name: multiarch-combined-pipeline
taskRunTemplate:
Expand Down
7 changes: 6 additions & 1 deletion Makefile
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,7 @@ INDEX_MODE ?= auto
# KONFLUX: whether to build images from Dockerfile.konflux.* (default: no)
KONFLUX ?= no


# OS dependant: Generate date, select appropriate cmd to locate container engine
ifdef OS
ifeq ($(OS), Windows_NT)
Expand Down Expand Up @@ -84,10 +85,14 @@ define build_image
awk -F= '!/^#/ && NF {gsub(/^[ \t]+|[ \t]+$$/, "", $$1); gsub(/^[ \t]+|[ \t]+$$/, "", $$2); printf "--build-arg %s=%s ", $$1, $$2}' $(CONF_FILE); \
fi))

# Hermetic local build: when cachi2/output/ exists AND this target has a
# prefetch-input/ directory, mount pre-downloaded deps and set LOCAL_BUILD=true.
$(eval CACHI2_VOLUME := $(if $(and $(wildcard cachi2/output),$(wildcard $(BUILD_DIR)prefetch-input)),--volume $(ROOT_DIR)cachi2/output:/cachi2/output:Z --build-arg LOCAL_BUILD=true,))

$(info # Building $(IMAGE_NAME) using $(DOCKERFILE_NAME) with $(CONF_FILE) and $(BUILD_ARGS)...)

$(ROOT_DIR)/scripts/sandbox.py --dockerfile '$(2)' --platform '$(BUILD_ARCH)' -- \
$(CONTAINER_ENGINE) build $(CONTAINER_BUILD_CACHE_ARGS) --platform=$(BUILD_ARCH) --label release=$(RELEASE) --tag $(IMAGE_NAME) --file '$(2)' $(BUILD_ARGS) {}\;
$(CONTAINER_ENGINE) build $(CONTAINER_BUILD_CACHE_ARGS) $(CACHI2_VOLUME) --platform=$(BUILD_ARCH) --label release=$(RELEASE) --tag $(IMAGE_NAME) --file '$(2)' $(BUILD_ARGS) {}\;
endef

# Push function for the notebook image:
Expand Down
Loading
Loading