Keep OPENSCAP_IMAGE defaulting to the manifest image - #1336
Conversation
Since ComplianceAsCode#1295 the manifests default to the Konflux openscap-dev:master image, but OPENSCAP_IMAGE still defaulted to the ghcr openscap-ocp image - whose publisher ComplianceAsCode#1295 removed, freezing that tag permanently. Because the deploy targets substitute DEFAULT_OPENSCAP_IMAGE with OPENSCAP_IMAGE, a plain 'make deploy' swapped the fresh Konflux image out for the frozen ghcr one. Restore the invariant that an unset OPENSCAP_IMAGE equals the manifest default, so the substitution is a no-op unless a developer overrides it. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: Vincent056, yuumasato The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/retest |
1 similar comment
|
/retest |
|
@Vincent056: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
Superseded: the identical change ( |
3 participants
Summary
One-line follow-up to #1295:
OPENSCAP_IMAGEstill defaulted to the ghcropenscap-ocpimage, whose publisher #1295 removed - the tag is now frozen at its final build. Since the deploy targets substituteDEFAULT_OPENSCAP_IMAGE->OPENSCAP_IMAGEin the rendered manifests, a plainmake deploy/e2e deploy silently swapped the fresh Konfluxopenscap-dev:masterimage out for the permanently-frozen ghcr one - the same slow-rot failure mode as the frozen k8scontent image.Restoring
OPENSCAP_IMAGE?=$(DEFAULT_OPENSCAP_IMAGE)makes the substitution a no-op unless a developer explicitly overrides (e.g.make e2e OPENSCAP_IMAGE=my-scanner:test, which is unaffected).🤖 Generated with Claude Code