ci: build Lynx test image with fixed tag - #45
Draft
kycheng wants to merge 56 commits into
Draft
Conversation
…mage Canonical .tekton (build-base-image.yaml, build-image.yaml), repository.yaml CR, GitVersion.yaml, and the typed containerfile-base-rewrite + image-path-rewrite patches for the nexus-ce-base (build-env) and sonatype-nexus3 (server) images. Removes the legacy nexus-image-build.yaml and pr-manage.yaml Tekton resources they replace. Split out of the original combined changes.patch (DEVOPS-44489) so the build (proven green: build-base-image-zd8dv, nexus-image-8gsft pushing registry-dev.alauda.io/alauda-devops-toolchain/nexus/sonatype-nexus3) can be reviewed and merged independently of the still-in-progress integration-test wiring (moved to branch migration-inttest). See migrations/nexus/changes/nexus-build/state.yaml for the split record. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…schedulable resources) The catalog trivy-scanner@0.6 task defaults both its steps (prepare-context, trivy-scan) to cpu:4/memory:4Gi REQUESTS, confirmed live via the pending pod's actual container specs (8 CPU/8Gi total requested for the pod) -- no edge-build node has 4 free CPU, so the scan pod was permanently unschedulable (FailedScheduling / ExceededNodeResources, "0/19 nodes ... 6 Insufficient cpu"), and the build PipelineRun never reached a terminal state even though build-nexus-image itself builds green. Replace the taskRunSpecs top-level computeResources (which only sets limits, not the per-step request defaults) with a stepSpecs (v1) override sized to each step's actual job: prepare-context (light context prep) gets requests cpu:250m/memory:512Mi, limits cpu:1/memory:1Gi; trivy-scan (trivy DB + ~900MB image) gets requests cpu:500m/memory:2Gi, limits cpu:2/memory:4Gi. No proven green trivy-scanner run found anywhere on edge-build to match against (checked cluster-wide); both values are well within a single node's free capacity per kubectl describe nodes. Scan behavior/severity/ blocking posture unchanged -- still a blocking gate.
trivy-scanner is a genuine BLOCKING gate (confirmed live, nexus-image-q77l7: step-trivy-scan exited 1 on 6 HIGH findings after the stepSpecs resource fix let it schedule) -- every routine branch push now fails terminal on pre-existing image findings with no PR to fix them against. Added a `when` guard (pull-request-number notin [""]) so trivy runs ONLY on a PR (PaC leaves pull-request-number empty on a branch push, sets it on a PR). update-chart-values keeps its existing runAfter:[trivy-scanner] unchanged -- it consumes no trivy result, only an ordering dependency, so Tekton's when-skip semantics should let it proceed normally on a branch push where trivy is skipped (verifying live). No change to severity/ignoreUnfixed/ blocking posture when trivy does run on a PR.
migrate(nexus-build): DEVOPS-44489 PaC-ify build-base-image build-image See merge request alauda-devops-toolchain/nexus-build!1
…git-init (DEVOPS-44489)
fix(nexus-build): update-chart-values git-cli baseImage -> reachable git-init (DEVOPS-44489) See merge request alauda-devops-toolchain/nexus-build!3
migrate(nexus-build): integration-test (Option-D ctyun-vm) — WIP, do not merge yet See merge request alauda-devops-toolchain/nexus-build!2
feat(testing): package and import Maven dependencies for Nexus E2E See merge request alauda-devops-toolchain/nexus-build!4
Collaborator
Author
|
/build-lynx-test-image |
Collaborator
Author
|
/build-lynx-test-image |
Collaborator
Author
|
/build-lynx-test-image |
Collaborator
Author
|
/build-lynx-test-image |
Collaborator
Author
|
/build-lynx-test-image |
Collaborator
Author
|
/build-lynx-test-image |
Collaborator
Author
|
/build-lynx-test-image |
Collaborator
Author
|
/build-lynx-test-image |
Collaborator
Author
|
/build-lynx-test-image |
Collaborator
Author
|
/build-lynx-test-image |
Collaborator
Author
|
/build-lynx-test-image |
Collaborator
Author
|
/build-lynx-test-image |
Collaborator
Author
|
/build-lynx-test-image |
Collaborator
Author
|
/build-lynx-test-image |
1 similar comment
Collaborator
Author
|
/build-lynx-test-image |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Build the Nexus Lynx test image directly in the IDC pipeline to avoid a slow cross-registry copy.
alauda-76.0Lynx entrypoint implementationtesting/Containerfilebuild-harbor.alauda.cn/devops/nexus-ce-testv0.1.1-rchotfix.6.31.g1431efc-x-devops-44609-lynx-entrypoint/build-lynx-test-imageThis is a temporary build branch; it does not modify release-config.