✨ feat(dist): activate Artifact Hub + OperatorHub distribution - #309
Merged
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
…able
The OperatorHub submission path had never executed, so three bugs survived CI
and review. Found by running hack/operatorhub-pr.sh for real.
- installModes advertised OwnNamespace/SingleNamespace as supported, but the
controller never reads olm.targetNamespaces and sets no WATCH_NAMESPACE, so a
namespace-scoped install would silently collect cluster-wide. Advertise
AllNamespaces only until that plumbing exists.
- sed -i is GNU-only; on BSD/macOS sed -i consumes the next argument as a backup
suffix, so the OpenShift annotation step died with 'invalid command code' on
every manual re-run. Rewritten with awk.
- The existing-PR lookup filtered on "${FORK_OWNER}:${BRANCH}", a literal match
against GitHub's canonical org casing (PlatformRelay vs platformrelay), so it
never matched and the script tried to open a duplicate PR. Match the head owner
via headRepositoryOwner + ascii_downcase instead.
- gh pr edit resolves assignees/labels/reviewers over GraphQL and requires
read:org, which would force a broader PAT than this needs. PATCH via gh api.
- ci.yaml reviewers listed the platformrelay org; the field takes usernames.
Each is covered by a regression gate in dist_operatorhub_pr_test.sh.
The chart repository is registered on Artifact Hub as `kollect` (oci://ghcr.io/platformrelay/kollect), so the placeholder repositoryID is replaced with the real one and the owner is set to an address that can actually claim ownership — Artifact Hub matches it against the signed-in account's email rather than mailing it, and maintainers@platformrelay.github.io is a Pages host that can never be one. With the listing live, ADR-0708's rule that hub URLs must not 404 before listing no longer applies to Artifact Hub, so the badge ships and DIST-DOC-01 is narrowed to OperatorHub (still unlisted) plus a positive assertion that the Artifact Hub badge is present, so it cannot silently regress.
Artifact Hub reported "layer not found" for eleven tags. DR-FIND-07 is the cause: one OCI repository holds two artifact kinds — the Helm chart at bare semver tags and the multi-arch controller image at v-prefixed tags — and Artifact Hub treats every semver-ish tag as a chart version. Add an ignore rule covering the ten v-prefixed image tags plus bare 0.12.0, the one release that published the image to the chart's bare tag. The pattern is a regex over versions and was checked against every tag in the registry: it matches all eleven image tags and none of the nine real charts. Also give the OperatorHub submission a full description — what Kollect does, its features, and its security posture (runtime hardening, RBAC/SAR least privilege, Secret-only credentials, signed images with SBOM and SLSA provenance) — plus reviewer notes on the AllNamespaces-only install mode and the webhook-less bundle. It lives in the script so every future release carries it.
Artifact Hub is listed and Verified Publisher is active, so that badge is unambiguous. The OperatorHub.io badge ships ahead of the upstream listing by explicit operator decision — a departure from ADR-0708's rule that hub URLs must not appear before listing. The mitigating facts: the community-operators submission is open with all checks green and automerge enabled, and operatorhub.io soft-404s (HTTP 200 with the generic landing page) for unknown operators rather than serving a hard error. DIST-DOC-01 now asserts both badges are PRESENT rather than banning them, so neither can silently regress; both assertions were perturbation-checked.
konih
force-pushed
the
dist/hub-activation
branch
from
August 18, 2026 12:18
9890dbf to
981c650
Compare
|
konih
added a commit
that referenced
this pull request
Aug 18, 2026
The upstream community-operators hosted pipeline emits `check_using_fbc` as a Warning on both open submissions, recommending File-Based Catalogs for new operators. ADR-0708 already rejected in-repo FBC/`opm` (option C, lowest on operability, listed under "Skipped"), but that predates the warning, so nothing recorded that we saw the recommendation and held the line. Add a dated 2026-08-18 note under "Alternatives considered" restating the ADR's own reasoning -- an `opm`-rendered catalog is a second generated artifact to pin and re-render every release, disproportionate for lean solo-maintained release engineering -- plus the concrete triggers that would reopen it: upstream deprecating registry+v1 or hardening the check to an error, the bundle outgrowing hand-templating, or maintenance ceasing to be solo. No FBC adoption: that would reverse a recorded decision and needs a superseding ADR. Resolve the status while here. The operator accepted option A on 2026-08-08 and the track has shipped -- #309 merged, Artifact Hub registered with Verified Publisher active, both community-operators PRs open and green -- so the header and the theme-07 index row move from "Exploring (Proposed)" to Current, the vocabulary this repo uses for an accepted decision. The install-docs tense follows. dist_adr_0708_indexed_test.sh asserted the old status, so it now asserts the new one, anchored to the ADR header line rather than a file-wide grep, and requires the header and the index row to agree so the two cannot drift apart.
konih
added a commit
that referenced
this pull request
Aug 18, 2026
The upstream community-operators hosted pipeline emits `check_using_fbc` as a Warning on both open submissions, recommending File-Based Catalogs for new operators. ADR-0708 already rejected in-repo FBC/`opm` (option C, lowest on operability, listed under "Skipped"), but that predates the warning, so nothing recorded that we saw the recommendation and held the line. Add a dated 2026-08-18 note under "Alternatives considered" restating the ADR's own reasoning -- an `opm`-rendered catalog is a second generated artifact to pin and re-render every release, disproportionate for lean solo-maintained release engineering -- plus the concrete triggers that would reopen it: upstream deprecating registry+v1 or hardening the check to an error, the bundle outgrowing hand-templating, or maintenance ceasing to be solo. No FBC adoption: that would reverse a recorded decision and needs a superseding ADR. Resolve the status while here. The operator accepted option A on 2026-08-08 and the track has shipped -- #309 merged, Artifact Hub registered with Verified Publisher active, both community-operators PRs open and green -- so the header and the theme-07 index row move from "Exploring (Proposed)" to Current, the vocabulary this repo uses for an accepted decision. The install-docs tense follows. dist_adr_0708_indexed_test.sh asserted the old status, so it now asserts the new one, anchored to the ADR header line rather than a file-wide grep, and requires the header and the index row to agree so the two cannot drift apart.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Activates the ADR-0708 hub distribution track, which was fully implemented but had never once executed.
Artifact Hub — listed
Registered as
kollect. RealrepositoryIDreplaces the placeholder; owner email set to one that can actually claim the repo (Artifact Hub matches it against the signed-in account rather than mailing it —maintainers@platformrelay.github.iois a Pages host and can never be an account). Badge added;DIST-DOC-01narrowed to OperatorHub, which is still unlisted, plus a positive assertion so the badge cannot silently regress.OperatorHub — submitted
operator-ci,ok-to-test,automerge-enabled,DCOall green; labelsauthorized-changes,new-operatorThree bugs found by actually running it
installModesadvertised Own/SingleNamespaceolm.targetNamespaces, so a namespace-scoped install would silently collect cluster-wide. Shipped to a hub audience.sed -iis GNU-only-ieats the next arg as a backup suffix →invalid command code. Killed every manual re-run, whichdocs/RELEASE.mdand the workflow's own failure warning both instruct.gh pr list --head "\${FORK_OWNER}:\${BRANCH}"PlatformRelaycasing → never matched → tried to open a duplicate PR and aborted.Also:
gh pr editneedsread:org; switched togh api --method PATCHso a minimalpublic_repoPAT suffices.ci.yamlreviewers took an org where usernames are required.Each bug has a regression gate in
dist_operatorhub_pr_test.sh, all perturbation-verified (the gates inspect executable lines only, since the script's comments name the anti-patterns they ban).Verification
All five
dist_*gates pass; full pre-commit passes on every changed file. Submitted bundle content verified upstream: OpenShiftannotations.yamlcarries correctly-placedcom.redhat.openshift.versions: "v4.19",ci.yamlcarriesreviewers: konih.Note
The upstream PRs were submitted from this branch's content. If this does not land, the next release regenerates the bundle from
mainwith the oldinstallModesand regresses upstream.