Kuadrant / Kuadrant/kuadrant-operator
Validate dependency images exist on Quay before release PR merges
- Dominant language
- Go
- Stars
- 94
- Forks
- 89
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 43
Description
## Problem
The `Validate release data` CI check verifies that `make prepare-release` output is self-consistent, but does not verify that the component images referenced in `release.yaml` actually exist on Quay. This means a release PR can pass CI while upstream component images are missing, broken, or only partially built (e.g. operator image exists but bundle/catalog images don't).
During the v1.4.6-rc1 release, authorino-operator v0.23.4 had its operator image on Quay but the bundle and catalog images were missing due to a `workflow_dispatch` parameter issue. This was only caught by manual `curl` checks against the Quay API.
## Proposal
Add a CI step (or extend `verify-prepare-release`) that checks all dependency images are pullable before the release PR can merge:
```bash
# For each dependency in release.yaml, verify operator + bundle + catalog images exist
for comp in authorino-operator limitador-operator dns-operator; do
version=$(yq ".dependencies.\"$comp\"" release.yaml)
for suffix in "" "-bundle" "-catalog"; do
curl -sf "https://quay.io/api/v1/repository/kuadrant/${comp}${suffix}/tag/?specificTag=v${version}" | jq -e '.tags | length > 0' || echo "MISSING: ${comp}${suffix}:v${version}"
done
done
# Also check operand images
for comp in authorino limitador wasm-shim console-plugin developer-portal-controller; do
# resolve version from the operator's pinned RELATED_IMAGE or release.yaml
done
```
## Impact
Without this, broken releases can ship with missing OLM bundle/catalog images, which breaks OLM-based installations. The check is cheap (HTTP calls to Quay API) and could run as part of the existing `Validate release data` job.
## Context
Discovered during the 1.4.6 patch release cycle. The authorino-operator build workflow was triggered via `workflow_dispatch` without the `authorinoVersion` parameter, causing `verify-manifests` to fail on the bundle build. The operator image was pushed but bundle and catalog were not.
Contributor guide
Research direction
Start with the existing `Validate release data` job and `verify-prepare-release`; trace how dependencies in `release.yaml` and operand image versions are resolved. Run the current release validation, then add checks through the Quay API for operator, bundle, catalog, and operand images so missing images fail the job.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- json, shell, yaml
- Domain
- ci-cd, release
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 50/100