Skip to content

chore: enable pre-releases for subscriptions #556

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jul 28, 2025
Merged

chore: enable pre-releases for subscriptions #556

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
221 changes: 221 additions & 0 deletions hack/pre-release.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,221 @@
#!/usr/bin/env bash

set -o errexit
set -o nounset
set -o pipefail

SCRIPT_DIR="$(
cd "$(dirname "$0")" >/dev/null
pwd
)"

PROJECT_DIR="$(
cd "$SCRIPT_DIR/.." >/dev/null
pwd
)"

usage() {
echo "
Usage:
${0##*/} [options]

Optional arguments:
-p, --product PRODUCT
The product on which to activate the pre-release subscription.
Can be specified multiple times.
-d, --debug
Activate tracing/debug mode.
-h, --help
Display this message.

Example:
${0##*/}
" >&2
}

parse_args() {
PRODUCT_LIST=()
while [[ $# -gt 0 ]]; do
case $1 in
-p|--product)
case ${2:-} in
developerHub|dh|rhdh)
PRODUCT_LIST+=( "rhdh" )
;;
gitops|pipelines)
PRODUCT_LIST+=( "$2" )
;;
trusted-artifact-signer|tas|rhtas)
PRODUCT_LIST+=( "rhtas" )
;;
"")
echo "[ERROR] Product name needs to be specified after '--product'."
usage
exit 1
;;
*)
echo "[ERROR] Unknown product: $2"
usage
exit 1
;;
esac
shift
;;
-d | --debug)
set -x
DEBUG="--debug"
export DEBUG
;;
-h | --help)
usage
exit 0
;;
*)
echo "[ERROR] Unknown argument: $1"
usage
exit 1
;;
esac
shift
done
}

init() {
SHARED_DIR="$(mktemp -d)"
cd "$SHARED_DIR"
export SHARED_DIR
trap cleanup EXIT
}

cleanup() {
rm -rf "$SHARED_DIR"
}
Comment on lines +83 to +92
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

Possible rm -rf of current $PWD
cleanup runs while the process is still inside $SHARED_DIR; removing the directory you are cd-ed into can fail or leave you in a deleted cwd. cd / (or back to $PROJECT_DIR) before deletion, or use trap 'cd …; cleanup'.

🤖 Prompt for AI Agents 
In hack/pre-release.sh around lines 83 to 92, the cleanup function removes the
directory stored in $SHARED_DIR while the current working directory is still
inside it, which can cause errors or leave the shell in a deleted directory. To
fix this, modify the trap to first change directory to a safe location like / or
$PROJECT_DIR before calling cleanup, or update the cleanup function to cd out of
$SHARED_DIR before running rm -rf on it.


h1() {
echo "
################################################################################
# $1
################################################################################
"
}

configure_gitops(){
# GITOPS_IIB_IMAGE="quay.io/rhtap_qe/gitops-iib:782137"

SUBSCRIPTION="openshiftGitOps"
CHANNEL="latest"
SOURCE="gitops-iib"
}

configure_pipelines(){
# PIPELINES_IMAGE="quay.io/openshift-pipeline/openshift-pipelines-pipelines-operator-bundle-container-index"
# PIPELINES_IMAGE_TAG="v4.17-candidate"

SUBSCRIPTION="openshiftPipelines"
CHANNEL="latest"
SOURCE="pipelines-iib"
}

configure_rhdh(){
RHDH_INSTALL_SCRIPT="https://raw.githubusercontent.com/redhat-developer/rhdh-operator/main/.rhdh/scripts/install-rhdh-catalog-source.sh"
curl -sSLO $RHDH_INSTALL_SCRIPT
chmod +x install-rhdh-catalog-source.sh

./install-rhdh-catalog-source.sh --latest --install-operator rhdh

Comment on lines +119 to +125
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

Blind execution of remote script – add integrity / safety checks
curl … | bash-style patterns are dangerous. At minimum, verify the SHA256 of the downloaded script or pin to a commit hash so supply-chain attacks don’t silently own the cluster.

🤖 Prompt for AI Agents 
In hack/pre-release.sh around lines 119 to 125, the script blindly downloads and
executes a remote install script without verifying its integrity, which is a
security risk. To fix this, modify the script to download the install script
first, then verify its SHA256 checksum against a known good value before making
it executable and running it. Alternatively, pin the URL to a specific commit
hash to ensure the script content is fixed and trusted. This prevents
supply-chain attacks by ensuring only verified code is executed.

SUBSCRIPTION="redHatDeveloperHub"
CHANNEL="fast-1.6"
SOURCE="rhdh-fast"
}

configure_rhtas() {
# Configure CatalogSource
echo '
apiVersion: operators.coreos.com/v1alpha1
kind: CatalogSource
metadata:
name: rhtas-operator
namespace: openshift-marketplace
spec:
sourceType: grpc
grpcPodConfig:
securityContextConfig: legacy
publisher: Red Hat
image: quay.io/securesign/fbc-v4-18@sha256:124d3fcff0c711ba8d03a405a36b0e128a900065e0687885e626e0b4153ec804
displayName: TAS Operator
' \
| oc apply -f -

# Configure ImageDigestMirrorSet
echo '
apiVersion: config.openshift.io/v1
kind: ImageDigestMirrorSet
metadata:
name: registry-stage
spec:
imageDigestMirrors:
- mirrors:
- registry.stage.redhat.io/rhtas
source: registry.redhat.io/rhtas
' \
| oc apply -f -

# Configure pull-secret
DOCKERCONFIGJSON=$(
oc get secrets \
-n openshift-config pull-secret \
-o jsonpath='{.data.\.dockerconfigjson}' \
| base64 -d
)

DOCKERCONFIGJSON=$(
echo "$DOCKERCONFIGJSON" \
| jq -c '.auths."registry.stage.redhat.io" = {
"auth": "MTEwMDkxMDN8cmhhZHM6ZXlKaGJHY2lPaUpTVXpVeE1pSjkuZXlKemRXSWlPaUk0T0RsaE1XWTJPR0ZsWVdVMFptTTNZVE13WWpBNVlXUmpOR1JsWVRneVlpSjkuSXZrVDZqQ001ZU9wUnJQeDVzOVk4NFlaY1NfcWpDX0RpZ0s1bmwtd3NCQ0Y4cGFVdG13b25RbE5GTm9sYXBQTGZUeFFUaWxUUDluYllIRGV4TGxGWnZUWGNRWmg4YllqMmFGOUhZaHR2bFpCbmxpS0tyakNVN24tUE5rb09DY296QmdfN21fZFU4Z1lIUGt4Q3pISC1obG53Y2dneklwMG5jV0xQTDhFTkM4R0lJV2pQZ0t4bm1vTDQ2TUNUUDl6amhNNG5LYUlnT1RuNzdCZGVqRHY4WGRoZVNKRHFJUEEyTjA0TnUwMWhaSE95U3NpX3NCdjR2OThZYllOdFhNLUtHSXdtYWtMcWNZTzFONFUwa0RJaUc5OWdMZ2V0ZGVYT1ZPWkl3ajVpRGFkZXd2cnoxdFlucGZvZ1JhT2pWU3pDcnVBTDkyM1IzdEV2M3FvMjNPWXdXS1hGZlBTMU9YbzBwNFE3YldKRUFmMnEtM1gxM0lOQ19UTmJ3MGZCRHdMS05XN1k2TEVoQmJZVFNZd1BET20tTTJSVXpMQzdKYjV1c2pOZjYxM01XZWt5RmVRVVlJSTNUc0xLeUExQ0s1cE9SdXNFS256MERjZ1lya0V0ZE9ENkVtYjBmdUdNbElhN0JiX1UwZjVxUmszdFFXbWdTejRkQ1VDMXhlM0NDT25kVGU4bDA2RUVzSGVVU2I5NUd0bWtudUVkME03eERZaURjUURRVXlQblhmRFl5WF9xcF9BZ2l1M19meExLcl9LOGplYzJlcHlIUFBFN3FhR2hHeEViVVlUc0dsZ1B0Z0ExUFRlS3h1dklyM0d6ajg4SF85bGVYU1lwR0d5Ujl6dXh1TXVNaFZFS19Jc25OYTl3bHBaTG1RdW0xM1lRelN5ajMtMFVWUEVma3M=",
"email": ""
}'
Comment on lines +164 to +176
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Hard-coded registry credentials leak – remove immediately
The base64 string injected into .auth is a real credential (Gitleaks flagged it). Committing secrets makes the token irretrievable and opens the registry to anyone who reads the repo. Parameterise or source the value from a secure location (env-var, oc registry login, or a vault) and make the script fail fast if it is missing.

-        | jq -c '.auths."registry.stage.redhat.io" = {
-            "auth": "MTEwMDkxMDN8cmhhZHM6ZXlKaGJHY2l...",
-            "email": ""
-        }'
+        | jq -c --arg auth "${RHTAS_REGISTRY_AUTH:?Unset RHTAS_REGISTRY_AUTH}" \
+              '.auths."registry.stage.redhat.io" = {auth:$auth, email:""}'
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
DOCKERCONFIGJSON=$(
oc get secrets \
-n openshift-config pull-secret \
-o jsonpath='{.data.\.dockerconfigjson}' \
| base64 -d
)
DOCKERCONFIGJSON=$(
echo "$DOCKERCONFIGJSON" \
| jq -c '.auths."registry.stage.redhat.io" = {
"auth": "MTEwMDkxMDN8cmhhZHM6ZXlKaGJHY2lPaUpTVXpVeE1pSjkuZXlKemRXSWlPaUk0T0RsaE1XWTJPR0ZsWVdVMFptTTNZVE13WWpBNVlXUmpOR1JsWVRneVlpSjkuSXZrVDZqQ001ZU9wUnJQeDVzOVk4NFlaY1NfcWpDX0RpZ0s1bmwtd3NCQ0Y4cGFVdG13b25RbE5GTm9sYXBQTGZUeFFUaWxUUDluYllIRGV4TGxGWnZUWGNRWmg4YllqMmFGOUhZaHR2bFpCbmxpS0tyakNVN24tUE5rb09DY296QmdfN21fZFU4Z1lIUGt4Q3pISC1obG53Y2dneklwMG5jV0xQTDhFTkM4R0lJV2pQZ0t4bm1vTDQ2TUNUUDl6amhNNG5LYUlnT1RuNzdCZGVqRHY4WGRoZVNKRHFJUEEyTjA0TnUwMWhaSE95U3NpX3NCdjR2OThZYllOdFhNLUtHSXdtYWtMcWNZTzFONFUwa0RJaUc5OWdMZ2V0ZGVYT1ZPWkl3ajVpRGFkZXd2cnoxdFlucGZvZ1JhT2pWU3pDcnVBTDkyM1IzdEV2M3FvMjNPWXdXS1hGZlBTMU9YbzBwNFE3YldKRUFmMnEtM1gxM0lOQ19UTmJ3MGZCRHdMS05XN1k2TEVoQmJZVFNZd1BET20tTTJSVXpMQzdKYjV1c2pOZjYxM01XZWt5RmVRVVlJSTNUc0xLeUExQ0s1cE9SdXNFS256MERjZ1lya0V0ZE9ENkVtYjBmdUdNbElhN0JiX1UwZjVxUmszdFFXbWdTejRkQ1VDMXhlM0NDT25kVGU4bDA2RUVzSGVVU2I5NUd0bWtudUVkME03eERZaURjUURRVXlQblhmRFl5WF9xcF9BZ2l1M19meExLcl9LOGplYzJlcHlIUFBFN3FhR2hHeEViVVlUc0dsZ1B0Z0ExUFRlS3h1dklyM0d6ajg4SF85bGVYU1lwR0d5Ujl6dXh1TXVNaFZFS19Jc25OYTl3bHBaTG1RdW0xM1lRelN5ajMtMFVWUEVma3M=",
"email": ""
}'
DOCKERCONFIGJSON=$(
oc get secrets \
-n openshift-config pull-secret \
-o jsonpath='{.data.\.dockerconfigjson}' \
| base64 -d
)
DOCKERCONFIGJSON=$(
echo "$DOCKERCONFIGJSON" \
| jq -c --arg auth "${RHTAS_REGISTRY_AUTH:?Unset RHTAS_REGISTRY_AUTH}" \
'.auths."registry.stage.redhat.io" = {auth:$auth, email:""}'
)
🧰 Tools
🪛 Gitleaks (8.27.2)

174-174: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

(generic-api-key)

🤖 Prompt for AI Agents 
In hack/pre-release.sh around lines 164 to 176, the script contains a hard-coded
base64-encoded registry credential string inside the jq command, which leaks
sensitive information. Remove this hard-coded credential and instead modify the
script to source the registry authentication token securely from an environment
variable, an external secret manager, or by running a secure login command like
`oc registry login`. Add error handling to make the script fail immediately if
the credential is not available to prevent unauthorized access.

)

echo "
kind: Secret
apiVersion: v1
metadata:
name: pull-secret
namespace: openshift-config
stringData:
.dockerconfigjson: |
$DOCKERCONFIGJSON
type: kubernetes.io/dockerconfigjson
" \
| oc apply -f -

SUBSCRIPTION="openshiftTrustedArtifactSigner"
CHANNEL="stable-v1.2"
SOURCE="rhtas-operator"
}

configure_subscription(){
# Prepare for pre-release install capabilities
subscription_values_file="$PROJECT_DIR/installer/charts/rhtap-subscriptions/values.yaml"

yq -i "
.subscriptions.$SUBSCRIPTION.channel = \"$CHANNEL\",
.subscriptions.$SUBSCRIPTION.source = \"$SOURCE\"
" "$subscription_values_file"
}

main() {
parse_args "$@"
init
for PRODUCT in $(echo "${PRODUCT_LIST[@]}" | tr " " "\n" | sort); do
h1 "Configuring $PRODUCT"
"configure_$PRODUCT"
configure_subscription
echo
done
echo "Done"
Comment on lines +207 to +216
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

No product selected results in silent no-op
If the user forgets --product, the script exits successfully without doing anything. Fail fast to avoid false confidence:

main() {
   parse_args "$@"
+  if [[ ${#PRODUCT_LIST[@]} -eq 0 ]]; then
+      echo "[ERROR] No product specified." >&2
+      usage
+      exit 1
+  fi
   init
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
main() {
parse_args "$@"
init
for PRODUCT in $(echo "${PRODUCT_LIST[@]}" | tr " " "\n" | sort); do
h1 "Configuring $PRODUCT"
"configure_$PRODUCT"
configure_subscription
echo
done
echo "Done"
main() {
parse_args "$@"
if [[ ${#PRODUCT_LIST[@]} -eq 0 ]]; then
echo "[ERROR] No product specified." >&2
usage
exit 1
fi
init
for PRODUCT in $(echo "${PRODUCT_LIST[@]}" | tr " " "\n" | sort); do
h1 "Configuring $PRODUCT"
"configure_$PRODUCT"
configure_subscription
echo
done
echo "Done"
}
🤖 Prompt for AI Agents 
In hack/pre-release.sh around lines 207 to 216, the script silently does nothing
and exits successfully if no product is selected via --product. Add a check
after parsing arguments to verify that PRODUCT_LIST is not empty; if it is,
print an error message and exit with a non-zero status to fail fast and avoid
false confidence.

}

if [ "${BASH_SOURCE[0]}" == "$0" ]; then
main "$@"
fi