Build yq for Conforma CLI images, avoid needless kubectl cross-compiles by simonbaird · Pull Request #3663 · conforma/cli

simonbaird · 2026-10-30T18:06:34Z

Summary

Pin and build Mike Farah yq v4 for the container platform, and include it in both Conforma CLI image variants.
Build kubectl only for the image platform rather than cross-compiling unused kubectl binaries for every download platform. The ec cross-builds remain unchanged.

The yq packaging is useful independently of the planned runtime-data work; that work is not included in this PR.

Verification

bash -n build.sh
git diff --check upstream/main...HEAD
Built linux/amd64 yq with the pinned tools/yq module (CGO_ENABLED=0); yq --version reports v4.53.3.
Full container image build not run locally.

I was thinking I would need it for the "inject data source" script, but I realized I could get away with using jq. Despite that, we've have been talking about doing this for a number of other reasons recently, perhaps it's worth while either way. Ref: https://redhat.atlassian.net/browse/EC-2377 Assisted-by: gpt-6-sol

I don't think there was ever any good reason to do all that cross-compiling of kubectl. I think it was done that way since that's how the ec build was done. It seems like we don't copy the cross-compiled binaries over to the final image anyway which would have to mean they're 100% unused. https://redhat.atlassian.net/browse/EC-2365 Assisted-by: gpt-6-sol

coderabbitai · 2026-10-30T18:06:49Z

No actionable comments were generated in the recent review.

Recent review info

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: cabbcaca-a267-45e4-92eb-c25a7307a229

Commits

Reviewing files that changed from the base of the PR and between e669d75 and a818f74.

Files ignored due to path filters: 1

tools/yq/go.sum is excluded by !**/*.sum

Files selected for processing: 5

Dockerfile
Dockerfile.dist
build.sh
tools/yq/go.mod
tools/yq/yq.go

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.

Walkthrough

The build now produces yq for the selected Linux image platform. Both Dockerfiles add the matching binary to the final image and report its version.

Changes: yq image integration

Layer / File(s)	Summary
Define and build yq artifacts `tools/yq/go.mod`, `tools/yq/yq.go`, `build.sh`, `Dockerfile`, `Dockerfile.dist`	A dedicated Go module tracks the yq CLI dependency. `build.sh` builds yq for the selected Linux image platform, and both Dockerfiles download the module dependencies during the build.
Add yq to final images `Dockerfile`, `Dockerfile.dist`	Both Dockerfiles copy the target-platform yq binary into the final image and add `yq --version` to the version check.

Priority: Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

Suggested reviewers: robnester-rh, joejstuart, dheerajodha

Merge Risk: Minimal · up to a818f

No actionable merge-blocking risk was established in the changed build and image-packaging paths.

Pre-merge checks: 5

Check name	Status	Explanation
Description check		The description explains what changed, why it changed, verification performed, limitations, and related tickets. It uses different headings from the template but contains the required information.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Title check		The title clearly identifies the yq image build and the change to avoid unnecessary kubectl cross-compiles.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 2 files. (3 skipped: 3 unsupported.)

Finishing Touches: 💡 1

🧪 Generate unit tests (beta)

Create a new PR

🛠️ Fix failing CI checks: 💡

Commit to this branch
Create a new PR

_{Comment @coderabbitai help to get the list of available commands.}

qodo-for-conforma · 2026-10-30T18:07:13Z

PR Summary by Qodo

Add yq to Conforma images and build kubectl only for the image platform

✨ Enhancement ⚙️ Configuration changes 🕐 20-40 Minutes

AI Description

• Pin and build yq v4.53.3 for both Conforma CLI image variants.
• Build kubectl and yq only for the image platform, avoiding unused download-platform binaries.
• Preserve existing cross-platform ec builds for CLI downloads.

Diagram

graph TD
  M["Tool modules"] --> B["Build script"] --> D{"Linux image?"} --> K["Image kubectl"] --> I["CLI images"]
  D --> Y["Image yq"] --> I
  B --> E["Cross-built ec"] --> I

High-Level Assessment

The following are alternative approaches to this PR:

1. Package verified upstream yq binaries

➕ Avoids compiling yq during image builds.
➖ Requires per-architecture downloads and checksum management.
➖ Departs from the existing pinned Go-module build pattern.

Recommendation: Keep the source-build approach: it matches the existing kubectl tool-module pattern and produces a binary for the selected image platform from a pinned dependency. Verify both image variants with full builds before release.

Files changed (6) +185 / -7

Enhancement (2) +16 / -2

DockerfilePackage platform-matched yq in the standard image +8/-1

Package platform-matched yq in the standard image
• Caches the yq module download, copies the built yq binary into the final image, and prints its version during image construction.
Dockerfile

Dockerfile.distPackage platform-matched yq in the distribution image +8/-1

Package platform-matched yq in the distribution image
• Adds the same module caching, binary copy, and version check to the Konflux distribution image.
Dockerfile.dist

Other (4) +169 / -5

build.shSeparate image-tool builds from ec cross-builds +21/-5

Separate image-tool builds from ec cross-builds

• Keeps the ec build loop for download targets but builds kubectl and yq only for the selected Linux image platform. yq is compiled with CGO disabled.

build.sh

go.modPin the standalone yq build dependency +38/-0

Pin the standalone yq build dependency
• Defines a separate Go tool module requiring Mike Farah yq v4.53.3 and its transitive dependencies.
tools/yq/go.mod

go.sumLock yq module checksums +90/-0

Lock yq module checksums
• Records checksums for the pinned yq dependency graph.
tools/yq/go.sum

yq.goTrack the yq CLI package in its tool module +20/-0

Track the yq CLI package in its tool module
• Adds a blank import of the yq command package so the separate module tracks the CLI dependency.
tools/yq/yq.go

qodo-for-conforma · 2026-10-30T18:08:22Z

Code Review by Qodo

📘 Rule violations (1)

View low (1)

🟡 **Low**

1. Kubectl image builds can depend on cgo 📘 Rule violation

Description

build_kubectl invokes go install without setting CGO_ENABLED=0, and the new Linux image path
calls that function for the image's kubectl binary. When cgo is enabled in the build environment,
the resulting deployable binary can depend on native C libraries instead of being guaranteed
cgo-disabled.

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The new Linux image build path invokes `build_kubectl`, but its `go install` command does not explicitly set `CGO_ENABLED=0`. This violates the requirement that Go commands producing deployable binaries build with cgo disabled.

## Fix Focus Areas
- build.sh[66-71]
- build.sh[107-110]

## Recommended Fix
Prefix the `go install` invocation in `build_kubectl` with `CGO_ENABLED=0`, preserving the existing cross-compilation environment variables and output behavior.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Dismiss ↗ | View ↗

codecov · 2026-10-30T18:18:31Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
acceptance	`54.61% <ø> (ø)`
generative	`12.22% <ø> (ø)`
integration	`23.62% <ø> (ø)`
unit	`72.29% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

fullsend-ai-review · 2026-10-30T18:28:33Z

Risk Assessment: elevated (3/5)

Details

Score 3 (elevated) driven by three high-risk Tier 1 signals: protected Dockerfile paths, two new Go dependency files (go.mod/go.sum), and zero test coverage, offset by a known non-bot author, no security-sensitive changes, and very low git churn/regression history in Tier 2.

fullsend-ai-review · 2026-10-30T18:28:35Z

Looks good to me

Labels: PR modifies Dockerfiles, adds a new Go tool module (tools/yq/), and changes build infrastructure.

simonbaird added 2 commits October 30, 2026 13:58

simonbaird requested a review from a team as a code owner October 30, 2026 18:06

github-actions Bot added the size: L label Oct 30, 2026

simonbaird changed the title ~~Build yq for Conforma CLI images and avoid redundant kubectl builds~~ Build yq for Conforma CLI images, avoid needless kubectl cross-compiles Oct 30, 2026

fullsend-ai-review Bot added the risk/elevated PR risk: elevated label Oct 30, 2026

fullsend-ai-review Bot added requires-manual-review Review requires human judgment docker Pull requests that update Docker code go Pull requests that update Go code tooling labels Oct 30, 2026

Navigation Menu

Repository navigation

Build yq for Conforma CLI images, avoid needless kubectl cross-compiles - #3663

Build yq for Conforma CLI images, avoid needless kubectl cross-compiles#3663
simonbaird wants to merge 2 commits into
conforma:mainfrom
simonbaird:yq-in-image

simonbaird commented Oct 30, 2026

Uh oh!

coderabbitai Bot commented Oct 30, 2026 •

edited

Loading

Uh oh!

qodo-for-conforma Bot commented Oct 30, 2026

Uh oh!

qodo-for-conforma Bot commented Oct 30, 2026

Uh oh!

codecov Bot commented Oct 30, 2026

Uh oh!

fullsend-ai-review Bot commented Oct 30, 2026

Uh oh!

fullsend-ai-review Bot commented Oct 30, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

simonbaird commented Oct 30, 2026

Summary

Verification

Uh oh!

coderabbitai Bot commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

qodo-for-conforma Bot commented Oct 30, 2026

PR Summary by Qodo

Uh oh!

qodo-for-conforma Bot commented Oct 30, 2026

Code Review by Qodo

Uh oh!

codecov Bot commented Oct 30, 2026

Codecov Report

Uh oh!

fullsend-ai-review Bot commented Oct 30, 2026

Uh oh!

fullsend-ai-review Bot commented Oct 30, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

coderabbitai Bot commented Oct 30, 2026 •

edited

Loading