Repository: konflux-ci/release-service-catalog
Pull request #918: feat(RHELWF-12643): add support for importing draft builds
Author: login: hluk
Labels: name: ok-to-test
Created: 2025-04-24T06:34:46Z | Merged: 2025-05-20T10:45:20Z

## Describe your changes

By default, the builds will be imported as draft builds. This can be changed in ReleasePlanAdmission (RPA) data `pushOptions` by setting `koji_import_draft` to `false` (see example below).

This requires Koji 1.34.0 or higher. It needs to be installed in image references in `pipelineImage` parameter for push-rpm-to-koji pipeline.

Additionally, it allows overriding only koji profile configuration instead of the whole command.

Example new RPA configuration:

```yaml
---
apiVersion: appstudio.redhat.com/v1alpha1
kind: ReleasePlanAdmission
spec:
  ...
  data:
    pushOptions:
      koji_profile: koji
      koji_import_draft: true
  ...
```

## Relevant Jira

[RHELWF-12643](https://issues.redhat.com//browse/RHELWF-12643)

## Checklist before requesting a review
- [x] I have marked as draft or added `do not merge` label if there's a dependency PR
  - If you want reviews on your draft PR, you can add reviewers or add the `release-service-maintainers` handle if you are unsure who to tag
- [x] My commit message includes `Signed-off-by: My name <email>`
- [x] I have bumped the task/pipeline version string and updated changelog in the relevant README
- [x] I read CONTRIBUTING.MD and [commit formatting](CONTRIBUTING.md#commit-message-formatting-and-standards)




Diff:
diff --git a/pipelines/managed/push-rpm-to-koji/push-rpm-to-koji.yaml b/pipelines/managed/push-rpm-to-koji/push-rpm-to-koji.yaml
index 1f6c06be0d..fc536435c9 100644
--- a/pipelines/managed/push-rpm-to-koji/push-rpm-to-koji.yaml
+++ b/pipelines/managed/push-rpm-to-koji/push-rpm-to-koji.yaml
@@ -112,6 +112,10 @@ spec:
           value: $(params.snapshot)
         - name: subdirectory
           value: $(context.pipelineRun.uid)
+        - name: taskGitUrl
+          value: "$(params.taskGitUrl)"
+        - name: taskGitRevision
+          value: "$(params.taskGitRevision)"
       workspaces:
         - name: data
           workspace: release-workspace
@@ -139,6 +143,10 @@ spec:
           value: $(tasks.collect-data.results.snapshotNamespace)
         - name: SNAPSHOT_PATH
           value: $(workspaces.data.path)/$(tasks.collect-data.results.snapshotSpec)
+        - name: taskGitUrl
+          value: "$(params.taskGitUrl)"
+        - name: taskGitRevision
+          value: "$(params.taskGitRevision)"
       workspaces:
         - name: data
           workspace: release-workspace
diff --git a/schema/dataKeys.json b/schema/dataKeys.json
index 083a462b3b..de9bc14d93 100644
--- a/schema/dataKeys.json
+++ b/schema/dataKeys.json
@@ -623,9 +623,13 @@
           "type": "array",
           "description": "The koji tags that are attached to rpms after they are pushed into koji"
         },
-        "koji_cmd": {
+        "koji_profile": {
           "type": "string",
-          "description": "The koji command that is used in push-rpm-to-koji tekton task for pushing rpms"
+          "description": "Profile name for koji CLI used for importing and tagging builds"
+        },
+        "koji_import_draft": {
+          "type": "boolean",
+          "description": "Indicates whether build will be imported to Koji as draft or a normal build"
         },
         "components": {
           "type": "array",
diff --git a/tasks/managed/collect-push-rpm-params/tests/test-collect-push-rpm-params.yaml b/tasks/managed/collect-push-rpm-params/tests/test-collect-push-rpm-params.yaml
index 00dbaa960e..89242bcdd8 100644
--- a/tasks/managed/collect-push-rpm-params/tests/test-collect-push-rpm-params.yaml
+++ b/tasks/managed/collect-push-rpm-params/tests/test-collect-push-rpm-params.yaml
@@ -39,8 +39,8 @@ spec:
                   ]
                 },
                 "pushOptions": {
-                  "koji_cmd": "koji",
-                  "koji_env": "stage",
+                  "koji_profile": "koji",
+                  "koji_import_draft": true,
                   "koji_tags": [
                     "test-rpm"
                   ],
diff --git a/tasks/managed/push-rpm-to-koji/README.md b/tasks/managed/push-rpm-to-koji/README.md
index 109f9c62b2..a13ec087c8 100644
--- a/tasks/managed/push-rpm-to-koji/README.md
+++ b/tasks/managed/push-rpm-to-koji/README.md
@@ -10,4 +10,10 @@ Tekton task to push konflux build rpms to koji instance.
 | dataPath             | Path to the JSON file of the merged data to use in the data workspace          | No       | -             |
 | pushSecret           | The secret that for the login of koji instance                                 | No       | -             |
 | subdirectory         | Path to results directory in the data workspace                                | No       | -             |
-| pipelineImage        | The image url with koji, kinit installed for running the push-rpm-to-koji task | No       | -             |
+| pipelineImage        | The image url with koji (1.34 or higher), jq and kinit installed for running the push-rpm-to-koji task | No       | -             |
+
+## Changes in 0.2.0
+* Adds support for importing draft builds
+* Requires Koji 1.34 or higher
+* Replaces `koji_cmd` with `koji_profile` option in RPAs `spec.data.pushOptions`
+* Use new `koji_import_draft` flag in RPAs' `spec.data.pushOptions`
diff --git a/tasks/managed/push-rpm-to-koji/push-rpm-to-koji.yaml b/tasks/managed/push-rpm-to-koji/push-rpm-to-koji.yaml
index e6722e4075..6c462ebe23 100644
--- a/tasks/managed/push-rpm-to-koji/push-rpm-to-koji.yaml
+++ b/tasks/managed/push-rpm-to-koji/push-rpm-to-koji.yaml
@@ -4,7 +4,7 @@ kind: Task
 metadata:
   name: push-rpm-to-koji
   labels:
-    app.kubernetes.io/version: "0.1.0"
+    app.kubernetes.io/version: "0.2.0"
   annotations:
     tekton.dev/pipelines.minVersion: "0.12.1"
     tekton.dev/tags: push-koji
@@ -29,23 +29,27 @@ spec:
     - name: pipelineImage
       type: string
       description: |
-        The image url with koji, kinit installed for running the push-rpm-to-koji task,
-        please make sure you have such image or you build this image first.
+        The image url with koji (1.34 or higher), jq and kinit installed for
+        running the push-rpm-to-koji task, please make sure you have such image
+        or you build this image first.
   steps:
     - name: push-rpm-to-koji
       # The pipelineImage will be fetching from get-secrets task with koji installed there
       image: "$(params.pipelineImage)"
+      env:
+        - name: SNAPSHOT_SPEC_FILE
+          value: $(workspaces.data.path)/$(params.snapshotPath)
+        - name: DATA_FILE
+          value: $(workspaces.data.path)/$(params.dataPath)
       script: |
         #!/usr/bin/env bash
         set -eux
 
-        SNAPSHOT_SPEC_FILE="$(params.snapshotPath)"
         if [ ! -f "${SNAPSHOT_SPEC_FILE}" ] ; then
             echo "No valid snapshot file was provided."
             exit 1
         fi
 
-        DATA_FILE="$(params.dataPath)"
         if [ ! -f "${DATA_FILE}" ] ; then
             echo "No data JSON was provided."
             exit 1
@@ -54,10 +58,15 @@ spec:
         APPLICATION=$(jq -r '.application' "${SNAPSHOT_SPEC_FILE}")
         NUM_COMPONENTS=$(jq '.components | length' "${SNAPSHOT_SPEC_FILE}")
 
-        PRINCIPAL=$(jq -r '.pushOptions.pushKeytab.principal' "${DATA_FILE}")
-        KEYTAB_FILE=$(jq -r '.pushOptions.pushKeytab.name' "${DATA_FILE}")
-        KOJI_CMD=$(jq -r '.pushOptions.koji_cmd' "${DATA_FILE}")
-        KOJI_TAGS=$(jq -r '.pushOptions.koji_tags  | join(" ")' "${DATA_FILE}")
+        PRINCIPAL=$(jq --exit-status -r '.pushOptions.pushKeytab.principal' "${DATA_FILE}")
+        KEYTAB_FILE=$(jq --exit-status -r '.pushOptions.pushKeytab.name' "${DATA_FILE}")
+        KOJI_PROFILE=$(jq --exit-status -r '.pushOptions.koji_profile' "${DATA_FILE}")
+        KOJI_TAGS=$(jq --exit-status -r '.pushOptions.koji_tags // [] | join(" ")' "${DATA_FILE}")
+        KOJI_IMPORT_DRAFT=$(jq -r '.pushOptions.koji_import_draft' "${DATA_FILE}")
+
+        koji-cmd() {
+            koji --profile="$KOJI_PROFILE" "$@"
+        }
 
         # Fetch the component list from data.pushOptions.components by default, if there is no such list
         # fetch from data.mapping.components.
@@ -94,7 +103,7 @@ spec:
         USER_NAME=$(echo "$PRINCIPAL" | cut -d'@' -f1)
 
         # Test the koji connection
-        $KOJI_CMD hello
+        koji-cmd hello
 
         printf 'Start task "%s" for Application "%s"\n\n' "$(context.task.name)" "$APPLICATION"
 
@@ -118,23 +127,49 @@ spec:
           SRPM=$(ls ./*.src.rpm)
           PACKAGE_NVR=$(basename "$SRPM" .src.rpm)
 
-          if $KOJI_CMD buildinfo "$PACKAGE_NVR" >/dev/null 2>&1;  then
-              printf "Skip import %s into BREW as it's exist ...\n" "$PACKAGE_NVR"
-              cd .. && rm -rf temp
-              continue
+          if [[ "$KOJI_IMPORT_DRAFT" == "false" ]]; then
+              if koji-cmd buildinfo "$PACKAGE_NVR" >/dev/null 2>&1;  then
+                  printf "Skip import %s into BREW as it's exist ...\n" "$PACKAGE_NVR"
+                  cd .. && rm -rf temp
+                  continue
+              fi
+              draft="false"
+              draft_flag=""
+          else
+              draft="true"
+              draft_flag="--draft"
           fi
 
           printf "Import rpm %s with tags $KOJI_TAGS ...\n" "$PACKAGE_NVR"
 
-          $KOJI_CMD import-cg cg_import.json "$(pwd)"
-
-          PACKAGE_NAME=$(jq -r '.build.name' cg_import.json)
+          # Reserve build ID and import build (as draft by default)
+          build_name=$(jq -r '.build.name' cg_import.json)
+          build_version=$(jq -r '.build.version' cg_import.json)
+          build_release=$(jq -r '.build.release' cg_import.json)
+          import_build_data=$(cat <<EOD
+              {
+                "name": "$build_name",
+                "version": "$build_version",
+                "release": "$build_release",
+                "draft": "$draft"
+              }
+        EOD
+          )
+          buildinfo=$(koji-cmd call --json CGInitBuild '"konflux"' "$import_build_data")
+          build_id=$(jq -r '.build_id' <<< "$buildinfo")
+          token=$(jq -r '.token' <<< "$buildinfo")
+
+          if ! koji-cmd import-cg $draft_flag cg_import.json --token="$token" --build-id="$build_id" .; then
+              echo "ERROR: Import failed"
+              koji-cmd call --json CGRefundBuild '"konflux"' "$build_id" "\"$token\""
+              exit 1
+          fi
 
           for BREW_TAG in $KOJI_TAGS; do
-              if ! $KOJI_CMD list-pkgs --tag "$BREW_TAG" | grep "$PACKAGE_NAME" >/dev/null 2>&1;  then
-                  $KOJI_CMD --force add-pkg "$BREW_TAG" "$PACKAGE_NAME" --owner "$USER_NAME"
+              if ! koji-cmd list-pkgs --tag "$BREW_TAG" --package "$build_name" >/dev/null 2>&1;  then
+                  koji-cmd --force add-pkg "$BREW_TAG" "$build_name" --owner "$USER_NAME"
               fi
-              $KOJI_CMD tag-build "$BREW_TAG" "$PACKAGE_NVR"
+              koji-cmd tag-build "$BREW_TAG" "$build_id"
           done
 
           # Clean up to handle next component
diff --git a/tasks/managed/push-rpm-to-koji/tests/test-push-rpm-to-koji.yaml b/tasks/managed/push-rpm-to-koji/tests/test-push-rpm-to-koji.yaml
index 9c7b524faf..f552c98b7c 100644
--- a/tasks/managed/push-rpm-to-koji/tests/test-push-rpm-to-koji.yaml
+++ b/tasks/managed/push-rpm-to-koji/tests/test-push-rpm-to-koji.yaml
@@ -39,8 +39,8 @@ spec:
                   ]
                 },
                 "pushOptions": {
-                  "koji_cmd": "koji",
-                  "koji_env": "stage",
+                  "koji_profile": "koji",
+                  "koji_import_draft": true,
                   "koji_tags": [
                     "test-rpm"
                   ],
@@ -88,9 +88,9 @@ spec:
         name: push-rpm-to-koji
       params:
         - name: snapshotPath
-          value: "$(workspaces.data.path)/snapshot_spec.json"
+          value: "snapshot_spec.json"
         - name: dataPath
-          value: "$(workspaces.data.path)/data.json"
+          value: "data.json"
         - name: pushSecret
           value: "push-koji-test"
         - name: subdirectory


Reviews:
user: login: johnbieren
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-04-24T17:32:37Z
user: login: mmalina
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-25T11:41:53Z
user: login: hluk
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-29T09:48:18Z
user: login: hluk
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-29T09:52:42Z
user: login: johnbieren
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-04-29T14:36:54Z
user: login: hluk
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-29T16:19:22Z
user: login: johnbieren
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-04-29T16:55:36Z
user: login: hluk
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-30T04:25:08Z
user: login: mmalina
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-30T10:29:38Z
user: login: johnbieren
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-01T12:15:41Z
user: login: hluk
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-02T11:46:19Z
user: login: hluk
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-06T12:13:04Z
user: login: mmalina
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-06T12:18:10Z
user: login: mmalina
state: DISMISSED
author_association: CONTRIBUTOR
submitted_at: 2025-05-13T07:59:39Z
user: login: johnbieren
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-13T13:04:29Z
user: login: hluk
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-13T13:18:39Z
user: login: hluk
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-13T13:27:19Z
user: login: johnbieren
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-05-13T19:29:20Z
user: login: hluk
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-14T06:19:28Z
user: login: johnbieren
state: APPROVED
author_association: COLLABORATOR
submitted_at: 2025-05-14T18:15:13Z

Review comments:
diff_hunk: @@ -4,7 +4,7 @@ kind: Pipeline
 metadata:
   name: push-rpm-to-koji
   labels:
-    app.kubernetes.io/version: "0.1.0"
+    app.kubernetes.io/version: "0.2.0"
path: pipelines/managed/push-rpm-to-koji/push-rpm-to-koji.yaml
user: login: johnbieren
body: Maybe there are more changes coming, but if not, you don't need to change this version (or update the pipeline's README) since nothing in changing in this yaml - only in the task (which you've done)
created_at: 2025-04-24T17:32:36Z
author_association: COLLABORATOR
diff_hunk: @@ -56,8 +57,13 @@ spec:
 
         PRINCIPAL=$(jq -r '.pushOptions.pushKeytab.principal' "${DATA_FILE}")
         KEYTAB_FILE=$(jq -r '.pushOptions.pushKeytab.name' "${DATA_FILE}")
-        KOJI_CMD=$(jq -r '.pushOptions.koji_cmd' "${DATA_FILE}")
+        KOJI_PROFILE=$(jq -r '.pushOptions.koji_profile' "${DATA_FILE}")
         KOJI_TAGS=$(jq -r '.pushOptions.koji_tags  | join(" ")' "${DATA_FILE}")
+        KOJI_IMPORT_DRAFT=$(jq -r '.pushOptions.koji_import_draft' "${DATA_FILE}")
path: tasks/managed/push-rpm-to-koji/push-rpm-to-koji.yaml
user: login: mmalina
body: All of these are needed, but if they are not set, it will not end well. For the string ones, the result of the jq command would be the string "null". For the tags, you would get: `jq: error (at <stdin>:1): Cannot iterate over null (null)`

It would be good to handle these - for the strings, set some default values via "//". Or if we really need those, there should be a check and the script should `exit 1` or something. For the tags, maybe `jq -r '.pushOptions.koji_tags  // [] | join(" ")'` would be good enough.
created_at: 2025-04-25T11:41:53Z
author_association: CONTRIBUTOR
diff_hunk: @@ -4,7 +4,7 @@ kind: Pipeline
 metadata:
   name: push-rpm-to-koji
   labels:
-    app.kubernetes.io/version: "0.1.0"
+    app.kubernetes.io/version: "0.2.0"
path: pipelines/managed/push-rpm-to-koji/push-rpm-to-koji.yaml
user: login: hluk
body: The new task is included in the pipeline, hence the version change - there are some backwards incompatible changes.
created_at: 2025-04-29T09:48:17Z
author_association: CONTRIBUTOR
diff_hunk: @@ -56,8 +57,13 @@ spec:
 
         PRINCIPAL=$(jq -r '.pushOptions.pushKeytab.principal' "${DATA_FILE}")
         KEYTAB_FILE=$(jq -r '.pushOptions.pushKeytab.name' "${DATA_FILE}")
-        KOJI_CMD=$(jq -r '.pushOptions.koji_cmd' "${DATA_FILE}")
+        KOJI_PROFILE=$(jq -r '.pushOptions.koji_profile' "${DATA_FILE}")
         KOJI_TAGS=$(jq -r '.pushOptions.koji_tags  | join(" ")' "${DATA_FILE}")
+        KOJI_IMPORT_DRAFT=$(jq -r '.pushOptions.koji_import_draft' "${DATA_FILE}")
path: tasks/managed/push-rpm-to-koji/push-rpm-to-koji.yaml
user: login: hluk
body: I thought these are required by the schema, which is also used to verify the types. Or do we need to include the input data validation in the pipeline? Is there an example how it should be handled?
created_at: 2025-04-29T09:52:42Z
author_association: CONTRIBUTOR
diff_hunk: @@ -4,7 +4,7 @@ kind: Pipeline
 metadata:
   name: push-rpm-to-koji
   labels:
-    app.kubernetes.io/version: "0.1.0"
+    app.kubernetes.io/version: "0.2.0"
path: pipelines/managed/push-rpm-to-koji/push-rpm-to-koji.yaml
user: login: johnbieren
body: There is no change to this yaml. Look at the diff - it is solely the version line. We don't update the pipeline versions if a task inside of them is updated - only if we add/remove a task from the pipeline or update parameters passed to one of the tasks
created_at: 2025-04-29T14:36:54Z
author_association: COLLABORATOR
diff_hunk: @@ -4,7 +4,7 @@ kind: Pipeline
 metadata:
   name: push-rpm-to-koji
   labels:
-    app.kubernetes.io/version: "0.1.0"
+    app.kubernetes.io/version: "0.2.0"
path: pipelines/managed/push-rpm-to-koji/push-rpm-to-koji.yaml
user: login: hluk
body: > There is no change to this yaml. Look at the diff - it is solely the version line.

The YAML file did not change, but the pipeline uses a different task. I.e. there was a change in the pipeline itself. As a user of a pipeline (not a separate task) a would like to know when the pipeline changes (not some YAML file specifically) - especially when it contains a breaking changes.
created_at: 2025-04-29T16:19:22Z
author_association: CONTRIBUTOR
diff_hunk: @@ -4,7 +4,7 @@ kind: Pipeline
 metadata:
   name: push-rpm-to-koji
   labels:
-    app.kubernetes.io/version: "0.1.0"
+    app.kubernetes.io/version: "0.2.0"
path: pipelines/managed/push-rpm-to-koji/push-rpm-to-koji.yaml
user: login: johnbieren
body: Please go look at the README file of any pipeline in this repo. We do not bump versions if the pipeline yaml itself does not change
created_at: 2025-04-29T16:55:36Z
author_association: COLLABORATOR
diff_hunk: @@ -4,7 +4,7 @@ kind: Pipeline
 metadata:
   name: push-rpm-to-koji
   labels:
-    app.kubernetes.io/version: "0.1.0"
+    app.kubernetes.io/version: "0.2.0"
path: pipelines/managed/push-rpm-to-koji/push-rpm-to-koji.yaml
user: login: hluk
body: OK. Reverted.
created_at: 2025-04-30T04:25:08Z
author_association: CONTRIBUTOR
diff_hunk: @@ -56,8 +57,13 @@ spec:
 
         PRINCIPAL=$(jq -r '.pushOptions.pushKeytab.principal' "${DATA_FILE}")
         KEYTAB_FILE=$(jq -r '.pushOptions.pushKeytab.name' "${DATA_FILE}")
-        KOJI_CMD=$(jq -r '.pushOptions.koji_cmd' "${DATA_FILE}")
+        KOJI_PROFILE=$(jq -r '.pushOptions.koji_profile' "${DATA_FILE}")
         KOJI_TAGS=$(jq -r '.pushOptions.koji_tags  | join(" ")' "${DATA_FILE}")
+        KOJI_IMPORT_DRAFT=$(jq -r '.pushOptions.koji_import_draft' "${DATA_FILE}")
path: tasks/managed/push-rpm-to-koji/push-rpm-to-koji.yaml
user: login: mmalina
body: We have a schema file, but everything is optional, unless you define a "system" in the schema and then use it in the pipeline like here: https://github.com/konflux-ci/release-service-catalog/blob/development/pipelines/managed/push-artifacts-to-cdn/push-artifacts-to-cdn.yaml#L212

A lot of things are also validated in the konflux-release-data repo, so likely once products start using it, some checks will be added. But I think it would be good to still have at least something even in the task directly - for example some default values where it makes sense. But it's just a suggestion. If you think you should be able to rely on the fields being correct, it's fine with me.
created_at: 2025-04-30T10:29:38Z
author_association: CONTRIBUTOR
diff_hunk: @@ -4,7 +4,7 @@ kind: Pipeline
 metadata:
   name: push-rpm-to-koji
   labels:
-    app.kubernetes.io/version: "0.1.0"
+    app.kubernetes.io/version: "0.2.0"
path: pipelines/managed/push-rpm-to-koji/push-rpm-to-koji.yaml
user: login: johnbieren
body: you removed the README change (thanks) but didn't revert this version string bump
created_at: 2025-05-01T12:15:41Z
author_association: COLLABORATOR
diff_hunk: @@ -4,7 +4,7 @@ kind: Pipeline
 metadata:
   name: push-rpm-to-koji
   labels:
-    app.kubernetes.io/version: "0.1.0"
+    app.kubernetes.io/version: "0.2.0"
path: pipelines/managed/push-rpm-to-koji/push-rpm-to-koji.yaml
user: login: hluk
body: Oops, I thought I ran `git checkout` on the whole directory, but I ran it only on the README. Fixed.
created_at: 2025-05-02T11:46:19Z
author_association: CONTRIBUTOR
diff_hunk: @@ -56,8 +57,13 @@ spec:
 
         PRINCIPAL=$(jq -r '.pushOptions.pushKeytab.principal' "${DATA_FILE}")
         KEYTAB_FILE=$(jq -r '.pushOptions.pushKeytab.name' "${DATA_FILE}")
-        KOJI_CMD=$(jq -r '.pushOptions.koji_cmd' "${DATA_FILE}")
+        KOJI_PROFILE=$(jq -r '.pushOptions.koji_profile' "${DATA_FILE}")
         KOJI_TAGS=$(jq -r '.pushOptions.koji_tags  | join(" ")' "${DATA_FILE}")
+        KOJI_IMPORT_DRAFT=$(jq -r '.pushOptions.koji_import_draft' "${DATA_FILE}")
path: tasks/managed/push-rpm-to-koji/push-rpm-to-koji.yaml
user: login: hluk
body: I've added the fallback (`[]`) and minimal verification to ensure the data are provided (using `jq --exit-status`).
created_at: 2025-05-06T12:13:04Z
author_association: CONTRIBUTOR
diff_hunk: @@ -56,8 +57,13 @@ spec:
 
         PRINCIPAL=$(jq -r '.pushOptions.pushKeytab.principal' "${DATA_FILE}")
         KEYTAB_FILE=$(jq -r '.pushOptions.pushKeytab.name' "${DATA_FILE}")
-        KOJI_CMD=$(jq -r '.pushOptions.koji_cmd' "${DATA_FILE}")
+        KOJI_PROFILE=$(jq -r '.pushOptions.koji_profile' "${DATA_FILE}")
         KOJI_TAGS=$(jq -r '.pushOptions.koji_tags  | join(" ")' "${DATA_FILE}")
+        KOJI_IMPORT_DRAFT=$(jq -r '.pushOptions.koji_import_draft' "${DATA_FILE}")
path: tasks/managed/push-rpm-to-koji/push-rpm-to-koji.yaml
user: login: mmalina
body: ok, thanks
created_at: 2025-05-06T12:18:10Z
author_association: CONTRIBUTOR
diff_hunk: @@ -29,35 +29,48 @@ spec:
     - name: pipelineImage
       type: string
       description: |
-        The image url with koji, kinit installed for running the push-rpm-to-koji task,
-        please make sure you have such image or you build this image first.
+        The image url with koji (1.34 or higher), jq and kinit installed for
+        running the push-rpm-to-koji task, please make sure you have such image
+        or you build this image first.
   steps:
     - name: push-rpm-to-koji
       # The pipelineImage will be fetching from get-secrets task with koji installed there
       image: "$(params.pipelineImage)"
+      env:
+        - name: SNAPSHOT_SPEC_FILE
+          value: $(params.snapshotPath)
+        - name: DATA_FILE
+          value: $(params.dataPath)
       script: |
         #!/usr/bin/env bash
         set -eux
 
-        SNAPSHOT_SPEC_FILE="$(params.snapshotPath)"
         if [ ! -f "${SNAPSHOT_SPEC_FILE}" ] ; then
path: tasks/managed/push-rpm-to-koji/push-rpm-to-koji.yaml
user: login: johnbieren
body: This isn't going to work. The pipeline is receiving the collect-data result as a parameter. That is a relative path inside the workspace. You don't add the workspace here, so it won't work
created_at: 2025-05-13T13:04:17Z
author_association: COLLABORATOR
diff_hunk: @@ -29,35 +29,48 @@ spec:
     - name: pipelineImage
       type: string
       description: |
-        The image url with koji, kinit installed for running the push-rpm-to-koji task,
-        please make sure you have such image or you build this image first.
+        The image url with koji (1.34 or higher), jq and kinit installed for
+        running the push-rpm-to-koji task, please make sure you have such image
+        or you build this image first.
   steps:
     - name: push-rpm-to-koji
       # The pipelineImage will be fetching from get-secrets task with koji installed there
       image: "$(params.pipelineImage)"
+      env:
+        - name: SNAPSHOT_SPEC_FILE
+          value: $(params.snapshotPath)
+        - name: DATA_FILE
+          value: $(params.dataPath)
       script: |
         #!/usr/bin/env bash
         set -eux
 
-        SNAPSHOT_SPEC_FILE="$(params.snapshotPath)"
         if [ ! -f "${SNAPSHOT_SPEC_FILE}" ] ; then
             echo "No valid snapshot file was provided."
             exit 1
         fi
 
-        DATA_FILE="$(params.dataPath)"
         if [ ! -f "${DATA_FILE}" ] ; then
path: tasks/managed/push-rpm-to-koji/push-rpm-to-koji.yaml
user: login: johnbieren
body: This isn't going to work. The pipeline is receiving the collect-data result as a parameter. That is a relative path inside the workspace. You don't add the workspace here, so it won't work
created_at: 2025-05-13T13:04:19Z
author_association: COLLABORATOR
diff_hunk: @@ -29,35 +29,48 @@ spec:
     - name: pipelineImage
       type: string
       description: |
-        The image url with koji, kinit installed for running the push-rpm-to-koji task,
-        please make sure you have such image or you build this image first.
+        The image url with koji (1.34 or higher), jq and kinit installed for
+        running the push-rpm-to-koji task, please make sure you have such image
+        or you build this image first.
   steps:
     - name: push-rpm-to-koji
       # The pipelineImage will be fetching from get-secrets task with koji installed there
       image: "$(params.pipelineImage)"
+      env:
+        - name: SNAPSHOT_SPEC_FILE
+          value: $(params.snapshotPath)
+        - name: DATA_FILE
+          value: $(params.dataPath)
       script: |
         #!/usr/bin/env bash
         set -eux
 
-        SNAPSHOT_SPEC_FILE="$(params.snapshotPath)"
         if [ ! -f "${SNAPSHOT_SPEC_FILE}" ] ; then
path: tasks/managed/push-rpm-to-koji/push-rpm-to-koji.yaml
user: login: hluk
body: Isn't the current directory the workspace? That's why I needed to use the `readlink` below. Also, in tests the path is absolute, so settings `SNAPSHOT_SPEC_FILE=$(workspaces.data.path)/$(params.snapshotPath)` won't work.
created_at: 2025-05-13T13:18:39Z
author_association: CONTRIBUTOR
diff_hunk: @@ -29,35 +29,48 @@ spec:
     - name: pipelineImage
       type: string
       description: |
-        The image url with koji, kinit installed for running the push-rpm-to-koji task,
-        please make sure you have such image or you build this image first.
+        The image url with koji (1.34 or higher), jq and kinit installed for
+        running the push-rpm-to-koji task, please make sure you have such image
+        or you build this image first.
   steps:
     - name: push-rpm-to-koji
       # The pipelineImage will be fetching from get-secrets task with koji installed there
       image: "$(params.pipelineImage)"
+      env:
+        - name: SNAPSHOT_SPEC_FILE
+          value: $(params.snapshotPath)
+        - name: DATA_FILE
+          value: $(params.dataPath)
       script: |
         #!/usr/bin/env bash
         set -eux
 
-        SNAPSHOT_SPEC_FILE="$(params.snapshotPath)"
         if [ ! -f "${SNAPSHOT_SPEC_FILE}" ] ; then
path: tasks/managed/push-rpm-to-koji/push-rpm-to-koji.yaml
user: login: hluk
body: OK, I think I have a better solution. See the latest commit.
created_at: 2025-05-13T13:27:19Z
author_association: CONTRIBUTOR
diff_hunk: @@ -29,35 +29,48 @@ spec:
     - name: pipelineImage
       type: string
       description: |
-        The image url with koji, kinit installed for running the push-rpm-to-koji task,
-        please make sure you have such image or you build this image first.
+        The image url with koji (1.34 or higher), jq and kinit installed for
+        running the push-rpm-to-koji task, please make sure you have such image
+        or you build this image first.
   steps:
     - name: push-rpm-to-koji
       # The pipelineImage will be fetching from get-secrets task with koji installed there
       image: "$(params.pipelineImage)"
+      env:
+        - name: SNAPSHOT_SPEC_FILE
+          value: $(params.snapshotPath)
+        - name: DATA_FILE
+          value: $(params.dataPath)
       script: |
         #!/usr/bin/env bash
         set -eux
 
-        SNAPSHOT_SPEC_FILE="$(params.snapshotPath)"
         if [ ! -f "${SNAPSHOT_SPEC_FILE}" ] ; then
path: tasks/managed/push-rpm-to-koji/push-rpm-to-koji.yaml
user: login: johnbieren
body: The way you do it now should work, although all of our other tasks (and I think it is cleaner to) do it this way instead https://github.com/konflux-ci/release-service-catalog/blob/development/tasks/managed/check-fbc-packages/check-fbc-packages.yaml#L32 - basically the task adds the workspace, not the pipeline yaml
created_at: 2025-05-13T19:29:19Z
author_association: COLLABORATOR
diff_hunk: @@ -29,35 +29,48 @@ spec:
     - name: pipelineImage
       type: string
       description: |
-        The image url with koji, kinit installed for running the push-rpm-to-koji task,
-        please make sure you have such image or you build this image first.
+        The image url with koji (1.34 or higher), jq and kinit installed for
+        running the push-rpm-to-koji task, please make sure you have such image
+        or you build this image first.
   steps:
     - name: push-rpm-to-koji
       # The pipelineImage will be fetching from get-secrets task with koji installed there
       image: "$(params.pipelineImage)"
+      env:
+        - name: SNAPSHOT_SPEC_FILE
+          value: $(params.snapshotPath)
+        - name: DATA_FILE
+          value: $(params.dataPath)
       script: |
         #!/usr/bin/env bash
         set -eux
 
-        SNAPSHOT_SPEC_FILE="$(params.snapshotPath)"
         if [ ! -f "${SNAPSHOT_SPEC_FILE}" ] ; then
path: tasks/managed/push-rpm-to-koji/push-rpm-to-koji.yaml
user: login: hluk
body: Ack. I've changed the task params back to relative paths. But I still use `env` to pass the values to the script - using `$(...)` can be unsafe (script injection).
created_at: 2025-05-14T06:19:28Z
author_association: CONTRIBUTOR

PR comments:
user: login: openshift-ci[bot]
created_at: 2025-04-24T06:34:56Z
body: Hi @hluk. Thanks for your PR.

I'm waiting for a [konflux-ci](https://github.com/orgs/konflux-ci/people) member to verify that this patch is reasonable to test. If it is, they should reply with `/ok-to-test` on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should [join the org](https://github.com/orgs/konflux-ci/people) to skip this step.

Once the patch is verified, the new status will be reflected by the `ok-to-test` label.

I understand the commands that are listed [here](https://go.k8s.io/bot-commands?repo=konflux-ci%2Frelease-service-catalog).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes-sigs/prow](https://github.com/kubernetes-sigs/prow/issues/new?title=Prow%20issue:) repository.
</details>

author_association: NONE
user: login: hluk
created_at: 2025-04-24T06:36:53Z
body: @xiangge Can you review? We still need to test the behavior.
author_association: CONTRIBUTOR
user: login: xiangge
created_at: 2025-05-07T02:45:21Z
body: LGTM
author_association: CONTRIBUTOR
user: login: hluk
created_at: 2025-05-13T08:26:24Z
body: /ok-to-test
author_association: CONTRIBUTOR
user: login: openshift-ci[bot]
created_at: 2025-05-13T08:26:41Z
body: @hluk: Cannot trigger testing until a trusted user reviews the PR and leaves an `/ok-to-test` message.

<details>

In response to [this](https://github.com/konflux-ci/release-service-catalog/pull/918#issuecomment-2875520945):

>/ok-to-test


Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes-sigs/prow](https://github.com/kubernetes-sigs/prow/issues/new?title=Prow%20issue:) repository.
</details>
author_association: NONE
user: login: mmalina
created_at: 2025-05-13T08:27:43Z
body: /ok-to-test
author_association: CONTRIBUTOR
user: login: hluk
created_at: 2025-05-13T08:43:13Z
body: CI fails on 500 Internal Server Error when pushing an image to Quay. There is a banner on quay.io saying:

> We are currently seeing issues with Image pushes on quay.io. We are working on fixing this.
author_association: CONTRIBUTOR
user: login: mmalina
created_at: 2025-05-13T11:20:25Z
body: > CI fails on 500 Internal Server Error when pushing an image to Quay. There is a banner on quay.io saying:
> 
> > We are currently seeing issues with Image pushes on quay.io. We are working on fixing this.

Yeah, I think this is still an issue: https://status.redhat.com
author_association: CONTRIBUTOR
user: login: hluk
created_at: 2025-05-13T12:55:14Z
body: I've added `CGRefundBuild` XMLRPC call in case the import fails - otherwise the reserved build is stuck in "running" state.
author_association: CONTRIBUTOR
user: login: hluk
created_at: 2025-05-14T08:45:17Z
body: @mmalina Quay is operating properly now. Can we start the Konflux pipelines and merge this?
author_association: CONTRIBUTOR
user: login: johnbieren
created_at: 2025-05-14T18:15:22Z
body: /ok-to-test
author_association: COLLABORATOR
user: login: hluk
created_at: 2025-05-15T06:22:51Z
body: Any idea why konflux-e2e-tests failed? I don't have access to it.
author_association: CONTRIBUTOR
user: login: mmalina
created_at: 2025-05-15T07:29:42Z
body: > Any idea why konflux-e2e-tests failed? I don't have access to it.

I think it failed to provision the cluster.

```
[2025-05-14 21:14:18] [ERROR] The process for bootstrapping the cluster and running tests timed out after 150m
./mage -v ci:unregisterSprayproxy
Running target: CI:UnregisterSprayproxy
I0514 21:14:19.142635   50142 magefile.go:1120] Before unregistering pac server...
I0514 21:14:19.349777   50142 magefile.go:1149] The PaC servers registered in Sprayproxy:  https://pipelines-as-code-controller-openshift-pipelines.apps.konflux-4-15-us-east-2-fd9gj.konflux-qe.devcluster.openshift.com, https://pipelines-as-code-controller-openshift-pipelines.apps.rosa.kx-8b0fea426b.d6ou.p3.openshiftapps.com, https://pipelines-as-code-controller-openshift-pipelines.apps.konflux-4-15-us-east-2-p54ll.konflux-qe.devcluster.openshift.com, https://pipelines-as-code-controller-openshift-pipelines.apps.rosa.kx-5aef67b87e.17at.p3.openshiftapps.com
W0514 21:14:19.401544   50142 utils.go:435] failed to unregister SprayProxy: failed to get PaC host: routes.route.openshift.io "pipelines-as-code-controller" not found - this issue will be reported to a dedicated Slack channel
step-sealights-reporter :-
{"level":"error","ts":1747257260.088344,"caller":"entrypoint/entrypointer.go:240","msg":"Error while substituting step results: open /tekton/steps/step-initialize-sealights-session/results/test-session-id: no such file or directory","stacktrace":"github.com/tektoncd/pipeline/pkg/entrypoint.Entrypointer.Go\n\t/go/src/github.com/tektoncd/pipeline/pkg/entrypoint/entrypointer.go:240\nmain.main\n\t/go/src/github.com/tektoncd/pipeline/cmd/entrypoint/main.go:161\nruntime.main\n\t/usr/lib/golang/src/runtime/proc.go:272"}
{"level":"info","ts":1747257260.0885065,"caller":"entrypoint/entrypointer.go:265","msg":"Step was skipped due to when expressions were evaluated to false."}
step-fail-if-any-step-failed :-
[ERROR]: Step 'e2e-test' failed with exit code '124', which was previously ignored - exiting now
```

FYI, we've been having issues with e2e. Usually it takes like 5 or 10 attempts to get a pass. Normally there should be a comment from Konflux with more details on the failed run, but that too seems to only work sometimes...

I gave you contributor access to the workspace so you can check yourself if needed.
author_association: CONTRIBUTOR
user: login: openshift-ci[bot]
created_at: 2025-05-15T07:29:52Z
body: New changes are detected. LGTM label has been removed.
author_association: NONE
user: login: johnbieren
created_at: 2025-05-15T11:55:11Z
body: I'm not able to rebase this through the UI for whatever reason. @hluk can you rebase?
author_association: COLLABORATOR
user: login: mmalina
created_at: 2025-05-15T13:03:56Z
body: > I'm not able to rebase this through the UI for whatever reason. @hluk can you rebase?

I was able to rebase via UI. Not sure why you couldn't.
author_association: CONTRIBUTOR
user: login: johnbieren
created_at: 2025-05-15T13:27:38Z
body: /ok-to-test
author_association: COLLABORATOR
user: login: johnbieren
created_at: 2025-05-16T02:07:42Z
body: /ok-to-test
author_association: COLLABORATOR
user: login: johnbieren
created_at: 2025-05-16T13:26:47Z
body: /ok-to-test
author_association: COLLABORATOR
user: login: johnbieren
created_at: 2025-05-16T15:02:16Z
body: /ok-to-test
author_association: COLLABORATOR
user: login: hluk
created_at: 2025-05-19T09:22:31Z
body: Is there still some problem with CI itself? I'm not sure I understand the error (some timeout).
author_association: CONTRIBUTOR
user: login: jinqi7
created_at: 2025-05-19T09:46:01Z
body: > Is there still some problem with CI itself? I'm not sure I understand the error (some timeout).

Konflux deployment failed from the log of latest job.  It need rebase.  Then we can "/retest" it.
author_association: CONTRIBUTOR
user: login: hluk
created_at: 2025-05-19T11:23:32Z
body: > > Is there still some problem with CI itself? I'm not sure I understand the error (some timeout).
> 
> Konflux deployment failed from the log of latest job. It need rebase. Then we can "/retest" it.

I've rebased the code again.
author_association: CONTRIBUTOR
user: login: jinqi7
created_at: 2025-05-19T11:53:23Z
body: /ok-to-test
author_association: CONTRIBUTOR
user: login: johnbieren
created_at: 2025-05-19T13:57:12Z
body: /retest
`Logs are no longer accessible for konflux-e2e-tests-catalog-vgkw7-konflux-e2e-tests task` no idea what failed. E2E is only even relevant on this PR because it includes a schema change, which looks totally fine, but it would be nice to ensure it via the test
author_association: COLLABORATOR
user: login: johnbieren
created_at: 2025-05-19T18:24:50Z
body: /ok-to-test
author_association: COLLABORATOR
user: login: johnbieren
created_at: 2025-05-19T19:35:00Z
body: /retest
failed to provision cluster
author_association: COLLABORATOR
user: login: johnbieren
created_at: 2025-05-19T21:15:43Z
body: /retest
failed to provision a cluster
author_association: COLLABORATOR
user: login: johnbieren
created_at: 2025-05-19T23:43:11Z
body: /retest
author_association: COLLABORATOR
user: login: hluk
created_at: 2025-05-20T03:41:18Z
body: I still do not see what the problem is in the latest e2e tests. Is my change causing some errors? Can someone help me fix it?
author_association: CONTRIBUTOR
user: login: jinqi7
created_at: 2025-05-20T08:03:41Z
body: /retest
author_association: CONTRIBUTOR
user: login: johnbieren
created_at: 2025-05-20T10:45:00Z
body: E2E passed, rebasing and merging
author_association: COLLABORATOR
user: login: happybhati
created_at: 2025-05-28T15:11:14Z
body: ⏰  Promoted to Production!
author_association: CONTRIBUTOR