chore: add multi arch hermetic builds to consolidate upstream and downstream Containerfiles #3723

Zaperex · 2025-11-21T15:00:51Z

Description

Finished migrating the next builds to become hermetic
Replaced old upstream Dockerfile with the Konflux Containerfile since it's not longer used
Updated documentation on local container builds and migrated a modified downstream localBuild.sh script (requires VPN) to make local hermetic builds easier.
Removed instances of the old upstream build process from the github workflows
Updated some scripts to point to the new Containerfile location
Also refactored the github actions to use environmental variables for better readability, maintainability and security (via input sanitization).

This will require some small modifications to the downstream to accommodate the new Containerfile location.

Which issue(s) does this PR fix

Fixes RHIDP-9706

PR acceptance criteria

Please make sure that the following steps are complete:

GitHub Actions are completed and successful
Unit Tests are updated and passing
E2E Tests are updated and passing
Documentation is updated if necessary (requirement for new features)
Add a screenshot if the change is UX/UI related

How to test changes / Special notes to the reviewer

Example of a successful test run on my fork (switched registry to my own registry for this run): https://github.com/Zaperex/rhdh/actions/runs/19770877442
Test builds uploaded to https://quay.io/repository/my-test-organization/test-repo

Signed-off-by: Frank Kong <[email protected]> rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED

- Rename Dockerfile to Containerfile - Adds a local hermeto build script for local testing - Remove obsolete .rhdh directory and merged the doc content with docker Signed-off-by: Frank Kong <[email protected]> rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED

…i-arch-hermetic-builds Signed-off-by: Frank Kong <[email protected]> rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED

…ile locations Signed-off-by: Frank Kong <[email protected]> rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED

Signed-off-by: Frank Kong <[email protected]> rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED

github-actions · 2025-11-21T18:43:22Z

The image is available at:

github-actions · 2025-11-24T22:27:34Z

The image is available at:

.github/actions/get-sha/action.yml

.github/workflows/next-build-image.yaml

Signed-off-by: Frank Kong <[email protected]> rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED

…i-arch-hermetic-builds rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED

github-actions · 2025-11-26T22:40:11Z

The image is available at:

…i-arch-hermetic-builds rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED

github-actions · 2025-11-28T17:27:45Z

The image is available at:

Signed-off-by: Frank Kong <[email protected]> rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED

github-actions · 2025-11-28T23:39:47Z

The image is available at:

…i-arch-hermetic-builds Signed-off-by: Frank Kong <[email protected]> rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED

Signed-off-by: Frank Kong <[email protected]> rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED

github-actions · 2025-12-02T22:46:40Z

The image is available at:

…i-arch-hermetic-builds rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED

Signed-off-by: Frank Kong <[email protected]> rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED

openshift-ci · 2025-12-05T20:29:04Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign christoph-jerolimov for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

sonarqubecloud · 2025-12-05T20:29:47Z

Quality Gate passed

Issues
5 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

github-actions · 2025-12-05T21:24:54Z

The image is available at:

github-actions · 2025-12-13T02:11:04Z

This PR is stale because it has been open 7 days with no activity. Remove stale label or comment or this will be closed in 21 days.

openshift-merge-robot · 2025-12-13T02:11:14Z

PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Zaperex added 4 commits November 19, 2025 10:21

chore: update next builds to be hermetic

7dc9040

Signed-off-by: Frank Kong <[email protected]> rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED

chore: migrate to use downstream dockerfile as default

88d59a7

Signed-off-by: Frank Kong <[email protected]> rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED

chore: update symlinks for aarch64

dd0ff4b

Signed-off-by: Frank Kong <[email protected]> rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED

openshift-ci bot requested review from PatAKnight and debsmita1 November 21, 2025 15:00

openshift-merge-robot added the needs-rebase label Nov 21, 2025

Zaperex had a problem deploying to internal November 21, 2025 15:01 — with GitHub Actions Error

Zaperex force-pushed the add-multi-arch-hermetic-builds branch from 8e9d2bb to b41ec95 Compare November 21, 2025 15:01

Merge branch 'main' of github.com:redhat-developer/rhdh into add-mult…

818535c

…i-arch-hermetic-builds Signed-off-by: Frank Kong <[email protected]> rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED

Zaperex temporarily deployed to internal November 21, 2025 15:06 — with GitHub Actions Inactive

openshift-merge-robot removed the needs-rebase label Nov 21, 2025

Zaperex temporarily deployed to internal November 21, 2025 15:07 — with GitHub Actions Inactive

Zaperex requested review from nickboldt and removed request for PatAKnight and debsmita1 November 21, 2025 15:08

chore: update the update-Dockerfile.sh script with updated containerf…

6ee8187

…ile locations Signed-off-by: Frank Kong <[email protected]> rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED

Zaperex temporarily deployed to internal November 21, 2025 15:18 — with GitHub Actions Inactive

Zaperex temporarily deployed to internal November 21, 2025 16:33 — with GitHub Actions Inactive

chore: update docs and scripts with new container file location

25e4ce1

Signed-off-by: Frank Kong <[email protected]> rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED

Zaperex force-pushed the add-multi-arch-hermetic-builds branch from da721f0 to 25e4ce1 Compare November 21, 2025 16:34

Zaperex temporarily deployed to internal November 21, 2025 16:34 — with GitHub Actions Inactive

chore: remove dead janus slack invite link

d6f5590

Signed-off-by: Frank Kong <[email protected]> rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED

Zaperex temporarily deployed to internal November 21, 2025 16:59 — with GitHub Actions Inactive

Zaperex added 2 commits November 21, 2025 12:24

chore: update pr podman push with new artifact name

7eacea9

Signed-off-by: Frank Kong <[email protected]> rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED

chore: add missing architecture field in artifact names

f444c66

Signed-off-by: Frank Kong <[email protected]> rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED

Zaperex temporarily deployed to internal November 21, 2025 17:34 — with GitHub Actions Inactive

chore: remove arch in artifacts since we don't do multi-arch for PRs

de9ea21

Signed-off-by: Frank Kong <[email protected]> rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED

Zaperex temporarily deployed to internal November 21, 2025 17:48 — with GitHub Actions Inactive

Zaperex temporarily deployed to internal November 24, 2025 21:34 — with GitHub Actions Inactive

kim-tsao reviewed Nov 25, 2025

View reviewed changes

.github/actions/get-sha/action.yml Outdated Show resolved Hide resolved

.github/workflows/next-build-image.yaml Outdated Show resolved Hide resolved

Zaperex added 2 commits November 26, 2025 16:44

chore: update workflows to use default github envs

9f5e9ba

Signed-off-by: Frank Kong <[email protected]> rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED

Merge branch 'main' of github.com:redhat-developer/rhdh into add-mult…

0569022

…i-arch-hermetic-builds rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED

Zaperex temporarily deployed to internal November 26, 2025 21:44 — with GitHub Actions Inactive

Merge branch 'main' of github.com:redhat-developer/rhdh into add-mult…

a2f9309

…i-arch-hermetic-builds rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED

Zaperex temporarily deployed to internal November 28, 2025 16:33 — with GitHub Actions Inactive

Merge branch 'main' of github.com:redhat-developer/rhdh into add-mult…

ab56193

…i-arch-hermetic-builds rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED

Zaperex temporarily deployed to internal November 28, 2025 16:34 — with GitHub Actions Inactive

chore: add cursor rule to enforce github actions best practices

f66d8a3

Signed-off-by: Frank Kong <[email protected]> rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED

Zaperex temporarily deployed to internal November 28, 2025 22:44 — with GitHub Actions Inactive

Merge branch 'main' of github.com:redhat-developer/rhdh into add-mult…

cb8873a

…i-arch-hermetic-builds Signed-off-by: Frank Kong <[email protected]> rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED

Zaperex temporarily deployed to internal December 2, 2025 21:46 — with GitHub Actions Inactive

chore: remove unnecessary comment

2d1c2b3

Signed-off-by: Frank Kong <[email protected]> rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED

Zaperex temporarily deployed to internal December 2, 2025 21:51 — with GitHub Actions Inactive

Zaperex added 2 commits December 5, 2025 11:48

Merge branch 'main' of github.com:redhat-developer/rhdh into add-mult…

9b35634

…i-arch-hermetic-builds rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED

chore: refactor local hermeto install script

53017fa

Signed-off-by: Frank Kong <[email protected]> rh-pre-commit.version: 2.3.2 rh-pre-commit.check-secrets: ENABLED

Zaperex temporarily deployed to internal December 5, 2025 20:29 — with GitHub Actions Inactive

github-actions bot added the Stale label Dec 13, 2025

openshift-merge-robot added the needs-rebase label Dec 13, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore: add multi arch hermetic builds to consolidate upstream and downstream Containerfiles #3723

chore: add multi arch hermetic builds to consolidate upstream and downstream Containerfiles #3723

Zaperex commented Nov 21, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Nov 21, 2025

Uh oh!

github-actions bot commented Nov 24, 2025

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Nov 26, 2025

Uh oh!

github-actions bot commented Nov 28, 2025

Uh oh!

github-actions bot commented Nov 28, 2025

Uh oh!

github-actions bot commented Dec 2, 2025

Uh oh!

openshift-ci bot commented Dec 5, 2025

Uh oh!

sonarqubecloud bot commented Dec 5, 2025

Uh oh!

github-actions bot commented Dec 5, 2025

Uh oh!

github-actions bot commented Dec 13, 2025

Uh oh!

openshift-merge-robot commented Dec 13, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

chore: add multi arch hermetic builds to consolidate upstream and downstream Containerfiles #3723

Are you sure you want to change the base?

chore: add multi arch hermetic builds to consolidate upstream and downstream Containerfiles #3723

Conversation

Zaperex commented Nov 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Which issue(s) does this PR fix

PR acceptance criteria

How to test changes / Special notes to the reviewer

Uh oh!

github-actions bot commented Nov 21, 2025

Uh oh!

github-actions bot commented Nov 24, 2025

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Nov 26, 2025

Uh oh!

github-actions bot commented Nov 28, 2025

Uh oh!

github-actions bot commented Nov 28, 2025

Uh oh!

github-actions bot commented Dec 2, 2025

Uh oh!

openshift-ci bot commented Dec 5, 2025

Uh oh!

sonarqubecloud bot commented Dec 5, 2025

Quality Gate passed

Uh oh!

github-actions bot commented Dec 5, 2025

Uh oh!

github-actions bot commented Dec 13, 2025

Uh oh!

openshift-merge-robot commented Dec 13, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Zaperex commented Nov 21, 2025 •

edited

Loading