ROX-34007: Make `create-custom-snapshot` always run by msugakov · Pull Request #20016 · stackrox/stackrox

msugakov · 2026-04-15T09:26:24Z

Description

but skip real tasks if in PRs where Konflux is not enabled. This is alternative way to do #19892.

With the help of https://pipelinesascode.com/docs/guides/creating-pipelines/cel-expressions/.

User-facing documentation

CHANGELOG.md is updated OR update is not needed
documentation PR is created and is linked above OR is not needed

Testing and quality

the change is production ready: the change is GA, or otherwise the functionality is gated by a feature flag
CI results are inspected

Automated testing

No change.

How I validated my change

What I haven't tested is how it works with tags but I'm sure it should work as expected given that testing with branches went fine.

PR without activation

#20026 - everything gets quickly skipped and the pipeline succeeds.

PR with `konflux` in the branch name

#20027 - the tasks get really executed after determine-actual-build gives a green light.
Though I cancel Konflux builds after I see that happening to save on resources.

PR with `konflux-build` label

#20122 - initially no activation without a label (run), then tasks get really executed after the label is placed.
Though I cancelled pipelines to save resources.

Then, upon removal of konflux-build, the pipeline does not start at all. It would be nice if it activated but one can anyway push a commit or do something else to trigger the pipeline.

Branch pushes (no PRs)

No pipeline at all on pushing to non-matching branch https://github.com/stackrox/stackrox/commits/misha-test-ccs-no-activation
Activated on pushing to release-* branch (https://github.com/stackrox/stackrox/commits/release-misha-test-cel/) - https://konflux-ui.apps.stone-prd-rh01.pg1f.p1.openshiftapps.com/ns/rh-acs-tenant/applications/acs/pipelineruns/create-custom-snapshot-nbx4h/logs?task=determine-actual-build
Activated on /test comment in release-* branch (35c634a#commitcomment-183018739) https://konflux-ui.apps.stone-prd-rh01.pg1f.p1.openshiftapps.com/ns/rh-acs-tenant/applications/acs/taskruns/create-custom-snapshot-2j2ft-determine-actual-build

openshift-ci · 2026-04-15T09:26:29Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

codecov · 2026-04-15T09:41:15Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 49.76%. Comparing base (0584c42) to head (e5a23c7).
⚠️ Report is 4 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master   #20016   +/-   ##
=======================================
  Coverage   49.76%   49.76%           
=======================================
  Files        2767     2767           
  Lines      209544   209544           
=======================================
+ Hits       104275   104284    +9     
+ Misses      97573    97569    -4     
+ Partials     7696     7691    -5

Flag	Coverage Δ
go-unit-tests	`49.76% <ø> (+<0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

github-actions · 2026-04-15T09:42:45Z

🚀 Build Images Ready

Images are ready for commit 01e624c. To use with deploy scripts:

export MAIN_IMAGE_TAG=4.11.x-685-g01e624c2b5

msugakov · 2026-04-15T12:37:25Z

Doesn't seem to work. Requested Konflux support https://redhat-internal.slack.com/archives/C04PZ7H0VA8/p1776256616552199

tommartensen · 2026-04-16T11:38:05Z

+            }
+
+            is_pull_request="false"
+            [[ "{{ pull_request_number }}" == "" ]] || is_pull_request="true"


I also saw that the pull request number was literally "{{ pull_request_number }}"

I learned when it's literally "{{ pull_request_number }}" it means this pipeline runs for branch (or tag) push. Checking for empty string is unnecessary in this case but I'd still keep it.

tommartensen · 2026-04-16T11:38:39Z

+            [[ "{{ pull_request_number }}" == "" ]] || is_pull_request="true"
+            assert_boolean is_pull_request "pull_request_number: {{ pull_request_number }}"
+
+            is_matching_target_branch='{{ cel: target_branch.startsWith("release-") }}'


This is interesting. Can {{ cel: ...}} be used anywhere? Are there other templating sources documented?

It can be used in params and in step body. See https://pipelinesascode.com/docs/guides/creating-pipelines/cel-expressions/

tommartensen · 2026-04-16T11:39:49Z

    - name: post-metric-start
      taskRef: *post-bigquery-metrics-ref

+    # TODO: event_type=on-comment and the rest


What is "the rest"?

This is a leftover from the time before I did the full round of testing. Now this comment is gone.

tommartensen

This is interesting, if you want, please continue investigating!

msugakov · 2026-04-21T11:31:32Z

Had to rebase because Style GHA job wasn't happy for unrelated reason.

tommartensen · 2026-04-21T13:54:41Z

Then, upon removal of konflux-build, the pipeline does not start at all. It would be nice if it activated but one can anyway push a commit or do something else to trigger the pipeline.

Scenario: PR with konflux-build label. Full Konflux pipelines fail and create-custom-snapshot is red. Engineer decides they don't want Konflux builds after all and remove label konflux-build. Where can we tell them that re-running the pipeline will make it green?

openshift-ci · 2026-04-21T14:04:45Z

@msugakov: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/gke-ui-e2e-tests	`e5a23c7`	link	true	`/test gke-ui-e2e-tests`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

msugakov added do-not-merge/work-in-progress konflux-build Run Konflux in PR. Push commit to trigger it. labels Apr 15, 2026

msugakov force-pushed the misha/change-ccs-activation-cel branch from 1e7d7bc to fec0285 Compare April 15, 2026 09:28

msugakov changed the title ~~Try use CEL in task~~ build: Make create-custom-snapshot always run Apr 15, 2026

msugakov changed the title ~~build: Make create-custom-snapshot always run~~ ROX-34007: Make create-custom-snapshot always run Apr 15, 2026

stackrox deleted a comment from red-hat-konflux bot Apr 15, 2026

This was referenced Apr 15, 2026

*DNM* testing of create-custom-snapshot #20026

Draft

*DNM* testing of create-custom-snapshot - 2 #20027

Draft

*DNM* testing of create-custom-snapshot - 3 #20029

Closed

tommartensen reviewed Apr 16, 2026

View reviewed changes

msugakov mentioned this pull request Apr 21, 2026

*DNM* testing of create-custom-snapshot - 3 #20122

Draft

msugakov force-pushed the misha/change-ccs-activation-cel branch from 566de28 to 01e624c Compare April 21, 2026 11:25

msugakov added 2 commits April 21, 2026 13:30

Try use CEL in task

251a491

Try with env

9fac60c

msugakov added 19 commits April 21, 2026 13:30

try see what's pull_request_number

483e630

Output body

1634df0

Try find label through issue

5776f0d

fix

a12c4f5

Try translate to bash

578183a

fix boolean

12f40ed

Try resolve is_pull_request

2b610b8

try reduce code

6c2f786

Refine and plug the task

6022140

fix newline

6cdc69e

describe, add label activation

9b0d436

Move description

a8334f8

beautify

5776eb6

remove obsolete comment

36bb7fc

adjust pull-request detection

7b50b1d

split multi-line expression

4596440

explain why the label is looked up differently

5fe6a60

remove body diagnostics

0fc821f

Refine comment

e5a23c7

msugakov force-pushed the misha/change-ccs-activation-cel branch from 01e624c to e5a23c7 Compare April 21, 2026 11:30

msugakov marked this pull request as ready for review April 21, 2026 11:30

msugakov requested review from a team and rhacs-bot as code owners April 21, 2026 11:31

openshift-ci bot removed the do-not-merge/work-in-progress label Apr 21, 2026

rhacs-bot requested a review from a team April 21, 2026 11:31

msugakov requested a review from tommartensen April 21, 2026 11:31

Conversation

msugakov commented Apr 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

User-facing documentation

Testing and quality

Automated testing

How I validated my change

PR without activation

PR with konflux in the branch name

PR with konflux-build label

Branch pushes (no PRs)

Uh oh!

openshift-ci bot commented Apr 15, 2026

Uh oh!

codecov bot commented Apr 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions bot commented Apr 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚀 Build Images Ready

Uh oh!

msugakov commented Apr 15, 2026

Uh oh!

tommartensen Apr 16, 2026

Choose a reason for hiding this comment

Uh oh!

msugakov Apr 21, 2026

Choose a reason for hiding this comment

Uh oh!

tommartensen Apr 16, 2026

Choose a reason for hiding this comment

Uh oh!

msugakov Apr 21, 2026

Choose a reason for hiding this comment

Uh oh!

tommartensen Apr 16, 2026

Choose a reason for hiding this comment

Uh oh!

msugakov Apr 21, 2026

Choose a reason for hiding this comment

Uh oh!

tommartensen left a comment

Choose a reason for hiding this comment

Uh oh!

msugakov commented Apr 21, 2026

Uh oh!

tommartensen commented Apr 21, 2026

Uh oh!

openshift-ci bot commented Apr 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

msugakov commented Apr 15, 2026 •

edited

Loading

PR with `konflux` in the branch name

PR with `konflux-build` label

codecov bot commented Apr 15, 2026 •

edited

Loading

github-actions bot commented Apr 15, 2026 •

edited

Loading