Skip to content

Implement values.yaml.tpl composition from different charts#1780

Draft
dperaza4dustbit wants to merge 1 commit into
redhat-appstudio:mainfrom
dperaza4dustbit:consolidate_bundles
Draft

Implement values.yaml.tpl composition from different charts#1780
dperaza4dustbit wants to merge 1 commit into
redhat-appstudio:mainfrom
dperaza4dustbit:consolidate_bundles

Conversation

@dperaza4dustbit

@dperaza4dustbit dperaza4dustbit commented Apr 20, 2026

Copy link
Copy Markdown
Member

Partially Implements RHTAP-6486

Assisted by Cursor agents

Summary by CodeRabbit

  • Chores
    • Updated Go dependencies, including transitive dependencies, for improved stability.
    • Refactored configuration system by modularizing component settings into separate template files for enhanced maintainability and organization.

@openshift-ci openshift-ci Bot requested review from Roming22 and prietyc123 April 20, 2026 20:36
@openshift-ci

openshift-ci Bot commented Apr 20, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: dperaza4dustbit
Once this PR has been reviewed and has the lgtm label, please assign jkopriva for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@coderabbitai

coderabbitai Bot commented Apr 20, 2026

Copy link
Copy Markdown

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: bdc14c8c-ae90-422c-9759-4629a962b32d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

This PR restructures Helm values configuration by moving product-specific settings from the central installer/values.yaml.tpl into dedicated per-chart template files. It also updates the github.com/redhat-appstudio/helmet Go dependency with a version bump and adds a replace directive.

Changes

Cohort / File(s) Summary
Dependency Updates
go.mod
Updated github.com/redhat-appstudio/helmet to v0.0.0-20260420150238-7035f5b16d8e and added a replace directive. Bumped indirect google.golang.org/grpc from v1.79.2 to v1.79.3.
New Chart Values Templates - Core Services
installer/charts/tssc-acs/values.yaml.tpl, installer/charts/tssc-acs-test/values.yaml.tpl, installer/charts/tssc-dh/values.yaml.tpl, installer/charts/tssc-gitops/values.yaml.tpl
Added templated values for ACS, ACS testing, Developer Hub, and ArgoCD services. Each derives configuration from required .Installer and .OpenShift inputs with conditional logic for protocols, ingress domains, and authentication providers.
New Chart Values Templates - Security & Auth
installer/charts/tssc-iam/values.yaml.tpl, installer/charts/tssc-tas/values.yaml.tpl, installer/charts/tssc-tpa/values.yaml.tpl
Added comprehensive IAM (Keycloak), Trusted Artifact Signer, and Trusted Profile Analyzer configuration templates with computed OIDC URLs, realm names, TLS toggles, and database/secret wiring.
New Chart Values Templates - Pipelines
installer/charts/tssc-pipelines/values.yaml.tpl, installer/charts/tssc-pipelines-config/values.yaml.tpl
Added OpenShift Pipelines configuration templates defining namespaces and integration secret references.
Central Values Refactoring
installer/values.yaml.tpl
Removed 268 lines of product-specific configuration blocks (iam, acs, argoCD sub-fields, pipelines_config, pipelines, developerHub, trustedProfileAnalyzer, trustedArtifactSigner, trustification) now distributed to per-chart templates. Retained simplified infrastructure and integrations keys.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~50 minutes

The refactoring redistributes significant configuration logic across nine new chart-specific templates while removing equivalent sections from the central file. Reviewers must verify that all product-specific configuration is preserved in the correct chart templates, that required input validation (required(...) directives) is appropriate, and that computed values (e.g., Keycloak URLs, protocol selection, namespace derivations) remain functionally equivalent to the previous implementation.

Possibly related PRs

Suggested labels

approved, lgtm

Suggested reviewers

  • otaviof
  • Roming22
  • jkopriva
  • prietyc123

Poem

🐰 Configuration scattered far and wide,
From central store to templates by its side,
Each chart now holds its secrets tight and true,
Dependency bumps bring freshness too!
The installer speaks in smaller, clearer voice.

🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately describes the main change: refactoring configuration into separate chart templates for composition instead of a monolithic values file.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Tip

💬 Introducing Slack Agent: The best way for teams to turn conversations into code.

Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.

  • Generate code and open pull requests
  • Plan features and break down work
  • Investigate incidents and troubleshoot customer tickets together
  • Automate recurring tasks and respond to alerts with triggers
  • Summarize progress and report instantly

Built for teams:

  • Shared memory across your entire org—no repeating context
  • Per-thread sandboxes to safely plan and execute work
  • Governance built-in—scoped access, auditability, and budget controls

One agent for your entire SDLC. Right inside Slack.

👉 Get started


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 4

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
installer/values.yaml.tpl (1)

1-11: ⚠️ Potential issue | 🟠 Major

Remove unused required declarations from top-level template.

The variables $crc, $ingressDomain, $ingressRouterCA, and $openshiftMinorVersion are declared as required but never referenced in this file. Declaring them fails rendering if values are missing or placeholders, even though per-chart templates now access these values directly. Remove the unused declarations:

-{{- $crc := required "CRC settings" .Installer.Settings.crc -}}
 {{- $tas := required "TAS settings" .Installer.Products.Trusted_Artifact_Signer -}}
 {{- $tpa := required "TPA settings" .Installer.Products.Trusted_Profile_Analyzer -}}
 {{- $acs := required "Red Hat ACS settings" .Installer.Products.Advanced_Cluster_Security -}}
 {{- $gitops := required "GitOps settings" .Installer.Products.OpenShift_GitOps -}}
 {{- $pipelines := required "Pipelines settings" .Installer.Products.OpenShift_Pipelines -}}
 {{- $pipelinesNamespace := "openshift-pipelines" -}}
 {{- $rhdh := required "RHDH settings" .Installer.Products.Developer_Hub -}}
-{{- $ingressDomain := required "OpenShift ingress domain" .OpenShift.Ingress.Domain -}}
-{{- $ingressRouterCA := required "OpenShift RouterCA" .OpenShift.Ingress.RouterCA -}}
-{{- $openshiftMinorVersion := required "OpenShift Version" .OpenShift.MinorVersion -}}
 {{- $authProvider := required "Auth Provider is required" $rhdh.Properties.authProvider }}
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@installer/values.yaml.tpl` around lines 1 - 11, Remove the unused required
variable declarations to avoid rendering failures: delete the top-level template
lines that set $crc, $ingressDomain, $ingressRouterCA, and
$openshiftMinorVersion (the declarations using required "CRC settings"
.Installer.Settings.crc, required "OpenShift ingress domain"
.OpenShift.Ingress.Domain, required "OpenShift RouterCA"
.OpenShift.Ingress.RouterCA, and required "OpenShift Version"
.OpenShift.MinorVersion) since those values are not referenced elsewhere in this
template and are accessed directly by chart templates.
🧹 Nitpick comments (3)
installer/charts/tssc-pipelines/values.yaml.tpl (1)

1-6: Duplicated fixed namespace across two charts.

$pipelinesNamespace := "openshift-pipelines" is hardcoded here and also in installer/charts/tssc-pipelines-config/values.yaml.tpl. Any future change to this constant (e.g. custom namespace support) will require editing both files and risks drift. Consider centralizing it — e.g. via a shared named template in a common chart, or sourcing it from .Installer.Products.OpenShift_Pipelines.Namespace — so both charts stay consistent.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@installer/charts/tssc-pipelines/values.yaml.tpl` around lines 1 - 6, The
values file hardcodes $pipelinesNamespace := "openshift-pipelines" causing
duplication; replace this by referencing a single source of truth: either create
a shared named template (e.g., in a common chart _helpers.tpl) that returns the
pipelines namespace and use that template in
installer/charts/tssc-pipelines/values.yaml.tpl and
installer/charts/tssc-pipelines-config/values.yaml.tpl, or read the namespace
from the installer data structure (e.g.,
.Installer.Products.OpenShift_Pipelines.Namespace) in both files; update
occurrences of $pipelinesNamespace in tssc-pipelines values to use the chosen
centralized reference so both charts remain consistent.
installer/charts/tssc-tas/values.yaml.tpl (1)

1-10: Keycloak host/realm/protocol derivation is duplicated across charts.

This same block — $keycloakRouteHost := printf "tssc-sso.%s" $ingressDomain, $realmsName := "tssc-iam", and the CRC-driven $protocol switch — appears in installer/charts/tssc-dh/values.yaml.tpl and (per the PR summary) in tssc-tpa and tssc-iam as well. If the SSO route host prefix, realm, or protocol rules ever change, all of these files have to be edited in lockstep.

Consider extracting these into a shared helper (e.g. a named template in a common chart, or surfacing them via .Installer.Products.Red_Hat_Keycloak / a computed installer field) so consumers just reference the derived values.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@installer/charts/tssc-tas/values.yaml.tpl` around lines 1 - 10, The Keycloak
host/realm/protocol derivation (variables $keycloakRouteHost, $realmsName,
$protocol and the CRC check) is duplicated across multiple chart value
templates; extract this logic into a single shared helper and replace the inline
copies with calls to that helper. Create a named Helm template (e.g., tpl in a
common chart or _helpers.tpl) that accepts .OpenShift.Ingress.Domain and
.Installer.Settings.crc and returns the derived values (route host, realm name,
protocol or a map/object), and update each values.yaml.tpl (including the
current tssc-tas one referencing $keycloakRouteHost, $realmsName, $protocol, and
$tasRealmPath) to call the new helper instead of computing them locally so all
charts reuse the same derivation logic.
installer/charts/tssc-pipelines-config/values.yaml.tpl (1)

4-13: Minor: duplicated namespace constant and a stray double space.

  • "openshift-pipelines" is duplicated with installer/charts/tssc-pipelines/values.yaml.tpl; see the consolidation note on that file.
  • Line 5 has a double space after namespace: (namespace: {{ $pipelinesNamespace }}). Safe for YAML but inconsistent with line 7 and the rest of the templates.
Proposed spacing fix
-  namespace:  {{ $pipelinesNamespace }}
+  namespace: {{ $pipelinesNamespace }}
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@installer/charts/tssc-pipelines-config/values.yaml.tpl` around lines 4 - 13,
The templates duplicate a namespace constant for the pipelines chart and contain
an inconsistent double space after the namespace key; remove the duplicate
hard-coded namespace and ensure both pipelines_config.namespace and
infrastructure.openShiftPipelines.namespace consistently use the shared
$pipelinesNamespace variable (and that integrationSecret.namespace uses
.Installer.Namespace only if intended), and fix the spacing by changing
"namespace:  {{ $pipelinesNamespace }}" to a single space "namespace: {{
$pipelinesNamespace }}".
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@go.mod`:
- Around line 163-167: The replace directive currently redirects
github.com/redhat-appstudio/helmet to the personal fork
github.com/dperaza4dustbit/helmet (pseudo-version
v0.0.0-20260420150238-7035f5b16d8e), which is unsafe for production; either
remove the replace and land the needed changes upstream in
github.com/redhat-appstudio/helmet, or if this is temporary keep the replace but
add a clear comment above the replace block explaining the rationale, include a
tracking issue/PR URL and an ETA for removal, and ensure the pseudo-version is
pinned to a known commit; update the go.mod replace block accordingly for the
chosen approach.

In `@installer/charts/tssc-acs-test/values.yaml.tpl`:
- Around line 3-12: The comment claiming "Same acsTest shape as
charts/tssc-acs/values.yaml.tpl" is incorrect because this acsTest block omits
fields (enabled, ingressDomain, ingressRouterCA); either update the comment to
clearly say this file only renders the subset used by this chart's templates
(integrationSecret.namespace, test.scanner.image, tssc.namespace) or make the
block match the full shape from the tssc-acs values (include enabled,
ingressDomain, ingressRouterCA) by rendering the same values (referencing
.OpenShift.Ingress.Domain/.RouterCA and $acs.Enabled) so acsTest matches the acs
alias shape used in installer/charts/tssc-acs/values.yaml.tpl.

In `@installer/charts/tssc-tas/values.yaml.tpl`:
- Around line 23-25: Fix the typo in the TODO comment ("promopt" → "prompt") and
remove hardcoded defaults for organizationEmail and organizationName; update the
TODO to explicitly state these values should be sourced from installer settings
(or add a TODO referencing an issue/ISSUE-ID) and replace the literals
organizationEmail and organizationName with templated/parameterized values
obtained from installer configuration (e.g., values injected by the
chart/installer), ensuring the variables referenced in the file
(organizationEmail, organizationName) are documented so they are populated by
the installer at deploy time.

In `@installer/charts/tssc-tpa/values.yaml.tpl`:
- Around line 93-94: The tls.serviceEnabled value is being emitted as a quoted
string; change the template to output an unquoted boolean by removing the
surrounding quotes so it renders as a boolean literal (e.g., replace
serviceEnabled: "{{ not $crc }}" with serviceEnabled: {{ not $crc }}), ensuring
the template uses the tls.serviceEnabled key and the not $crc expression without
quotes so downstream consumers receive a true/false boolean.

---

Outside diff comments:
In `@installer/values.yaml.tpl`:
- Around line 1-11: Remove the unused required variable declarations to avoid
rendering failures: delete the top-level template lines that set $crc,
$ingressDomain, $ingressRouterCA, and $openshiftMinorVersion (the declarations
using required "CRC settings" .Installer.Settings.crc, required "OpenShift
ingress domain" .OpenShift.Ingress.Domain, required "OpenShift RouterCA"
.OpenShift.Ingress.RouterCA, and required "OpenShift Version"
.OpenShift.MinorVersion) since those values are not referenced elsewhere in this
template and are accessed directly by chart templates.

---

Nitpick comments:
In `@installer/charts/tssc-pipelines-config/values.yaml.tpl`:
- Around line 4-13: The templates duplicate a namespace constant for the
pipelines chart and contain an inconsistent double space after the namespace
key; remove the duplicate hard-coded namespace and ensure both
pipelines_config.namespace and infrastructure.openShiftPipelines.namespace
consistently use the shared $pipelinesNamespace variable (and that
integrationSecret.namespace uses .Installer.Namespace only if intended), and fix
the spacing by changing "namespace:  {{ $pipelinesNamespace }}" to a single
space "namespace: {{ $pipelinesNamespace }}".

In `@installer/charts/tssc-pipelines/values.yaml.tpl`:
- Around line 1-6: The values file hardcodes $pipelinesNamespace :=
"openshift-pipelines" causing duplication; replace this by referencing a single
source of truth: either create a shared named template (e.g., in a common chart
_helpers.tpl) that returns the pipelines namespace and use that template in
installer/charts/tssc-pipelines/values.yaml.tpl and
installer/charts/tssc-pipelines-config/values.yaml.tpl, or read the namespace
from the installer data structure (e.g.,
.Installer.Products.OpenShift_Pipelines.Namespace) in both files; update
occurrences of $pipelinesNamespace in tssc-pipelines values to use the chosen
centralized reference so both charts remain consistent.

In `@installer/charts/tssc-tas/values.yaml.tpl`:
- Around line 1-10: The Keycloak host/realm/protocol derivation (variables
$keycloakRouteHost, $realmsName, $protocol and the CRC check) is duplicated
across multiple chart value templates; extract this logic into a single shared
helper and replace the inline copies with calls to that helper. Create a named
Helm template (e.g., tpl in a common chart or _helpers.tpl) that accepts
.OpenShift.Ingress.Domain and .Installer.Settings.crc and returns the derived
values (route host, realm name, protocol or a map/object), and update each
values.yaml.tpl (including the current tssc-tas one referencing
$keycloakRouteHost, $realmsName, $protocol, and $tasRealmPath) to call the new
helper instead of computing them locally so all charts reuse the same derivation
logic.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 56cb2a86-dd94-4fdb-92da-a62a500d0a55

📥 Commits

Reviewing files that changed from the base of the PR and between fd767ce and 7902f03.

⛔ Files ignored due to path filters (11)
  • go.sum is excluded by !**/*.sum
  • vendor/github.com/redhat-appstudio/helmet/framework/integrations.go is excluded by !vendor/**
  • vendor/github.com/redhat-appstudio/helmet/internal/chartfs/chartfs.go is excluded by !vendor/**
  • vendor/github.com/redhat-appstudio/helmet/internal/flags/installer.go is excluded by !vendor/**
  • vendor/github.com/redhat-appstudio/helmet/internal/githubapp/githubapp.go is excluded by !vendor/**
  • vendor/github.com/redhat-appstudio/helmet/internal/integration/tas.go is excluded by !vendor/**
  • vendor/github.com/redhat-appstudio/helmet/internal/resolver/collection.go is excluded by !vendor/**
  • vendor/github.com/redhat-appstudio/helmet/internal/resolver/dependency.go is excluded by !vendor/**
  • vendor/github.com/redhat-appstudio/helmet/internal/subcmd/deploy.go is excluded by !vendor/**
  • vendor/github.com/redhat-appstudio/helmet/internal/subcmd/template.go is excluded by !vendor/**
  • vendor/modules.txt is excluded by !vendor/**
📒 Files selected for processing (11)
  • go.mod
  • installer/charts/tssc-acs-test/values.yaml.tpl
  • installer/charts/tssc-acs/values.yaml.tpl
  • installer/charts/tssc-dh/values.yaml.tpl
  • installer/charts/tssc-gitops/values.yaml.tpl
  • installer/charts/tssc-iam/values.yaml.tpl
  • installer/charts/tssc-pipelines-config/values.yaml.tpl
  • installer/charts/tssc-pipelines/values.yaml.tpl
  • installer/charts/tssc-tas/values.yaml.tpl
  • installer/charts/tssc-tpa/values.yaml.tpl
  • installer/values.yaml.tpl

Comment thread go.mod
Comment on lines 163 to 167
replace (
github.com/Microsoft/hcsshim => github.com/Microsoft/hcsshim v0.13.0
github.com/imdario/mergo => github.com/imdario/mergo v1.0.2
github.com/redhat-appstudio/helmet => github.com/dperaza4dustbit/helmet v0.0.0-20260420150238-7035f5b16d8e
)

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Replace directive points helmet to a personal fork.

The replace redirects github.com/redhat-appstudio/helmet to github.com/dperaza4dustbit/helmet at the same pseudo-version. Pinning a production dependency to an individual's fork is a supply-chain and maintenance risk: the fork could be deleted/force-pushed, has no organizational review gates, and will drift from upstream.

If this is only needed until upstream merges the required changes, consider landing those changes in redhat-appstudio/helmet first and dropping the replace before merging this PR. Otherwise, at minimum add a comment explaining the rationale and tracking link/ETA for removal.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@go.mod` around lines 163 - 167, The replace directive currently redirects
github.com/redhat-appstudio/helmet to the personal fork
github.com/dperaza4dustbit/helmet (pseudo-version
v0.0.0-20260420150238-7035f5b16d8e), which is unsafe for production; either
remove the replace and land the needed changes upstream in
github.com/redhat-appstudio/helmet, or if this is temporary keep the replace but
add a clear comment above the replace block explaining the rationale, include a
tracking issue/PR URL and an ETA for removal, and ensure the pseudo-version is
pinned to a known commit; update the go.mod replace block accordingly for the
chosen approach.

Comment on lines +3 to +12
# Same acsTest shape as charts/tssc-acs/values.yaml.tpl (this chart uses its own ReadValuesTemplate).
acsTest:
name: stackrox-central-services
integrationSecret:
namespace: {{ .Installer.Namespace }}
test:
scanner:
image: registry.access.redhat.com/ubi10:latest
tssc:
namespace: {{ .Installer.Namespace }}

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Comment claims "same shape" but acsTest is a strict subset.

Compared to acsTest in installer/charts/tssc-acs/values.yaml.tpl (which is aliased from acs via *acs), this block omits enabled, ingressDomain, and ingressRouterCA. Today that's benign because installer/charts/tssc-acs-test/templates/tests/scanner.yaml only reads integrationSecret.namespace, test.scanner.image, and tssc.namespace — but the misleading comment will bite whoever next adds a template referencing one of the missing fields.

Either update the comment to state that only the subset actually used by this chart's templates is rendered, or render the same fields as tssc-acs for parity (requiring .OpenShift.Ingress.Domain/RouterCA and $acs.Enabled).

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@installer/charts/tssc-acs-test/values.yaml.tpl` around lines 3 - 12, The
comment claiming "Same acsTest shape as charts/tssc-acs/values.yaml.tpl" is
incorrect because this acsTest block omits fields (enabled, ingressDomain,
ingressRouterCA); either update the comment to clearly say this file only
renders the subset used by this chart's templates (integrationSecret.namespace,
test.scanner.image, tssc.namespace) or make the block match the full shape from
the tssc-acs values (include enabled, ingressDomain, ingressRouterCA) by
rendering the same values (referencing .OpenShift.Ingress.Domain/.RouterCA and
$acs.Enabled) so acsTest matches the acs alias shape used in
installer/charts/tssc-acs/values.yaml.tpl.

Comment on lines +23 to +25
# TODO: promopt the user for organization email/name input!
organizationEmail: trusted-artifact-signer@company.dev
organizationName: TSSC

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Typo in TODO comment + hardcoded org identity.

"promopt" → "prompt". Also worth tracking that organizationEmail/organizationName are hardcoded to trusted-artifact-signer@company.dev / TSSC; the TODO suggests these should eventually come from installer settings. Consider filing an issue so this doesn't ship to users as-is.

Typo fix
-        # TODO: promopt the user for organization email/name input!
+        # TODO: prompt the user for organization email/name input!
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# TODO: promopt the user for organization email/name input!
organizationEmail: trusted-artifact-signer@company.dev
organizationName: TSSC
# TODO: prompt the user for organization email/name input!
organizationEmail: trusted-artifact-signer@company.dev
organizationName: TSSC
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@installer/charts/tssc-tas/values.yaml.tpl` around lines 23 - 25, Fix the typo
in the TODO comment ("promopt" → "prompt") and remove hardcoded defaults for
organizationEmail and organizationName; update the TODO to explicitly state
these values should be sourced from installer settings (or add a TODO
referencing an issue/ISSUE-ID) and replace the literals organizationEmail and
organizationName with templated/parameterized values obtained from installer
configuration (e.g., values injected by the chart/installer), ensuring the
variables referenced in the file (organizationEmail, organizationName) are
documented so they are populated by the installer at deploy time.

Comment on lines +93 to +94
tls:
serviceEnabled: "{{ not $crc }}"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Find chart templates that consume trustification.tls.serviceEnabled.
# Expected: Consumers should receive a YAML boolean, especially if used in Helm conditionals.

rg -n -C3 '\.Values\.trustification\.tls\.serviceEnabled|trustification\.tls\.serviceEnabled|serviceEnabled' installer/charts

Repository: redhat-appstudio/tssc-cli

Length of output: 911


🏁 Script executed:

# Find all template files in the chart
find installer/charts/tssc-tpa -type f \( -name "*.yaml" -o -name "*.tpl" \) | head -20

Repository: redhat-appstudio/tssc-cli

Length of output: 477


🏁 Script executed:

# Search for actual usage of trustification.tls.serviceEnabled in templates
rg -n 'trustification\.tls\.serviceEnabled|\.Values\.trustification' installer/charts/tssc-tpa/templates

Repository: redhat-appstudio/tssc-cli

Length of output: 166


🏁 Script executed:

# Also search for any conditional patterns that might use this
rg -n '\.Values\.trustification|serviceEnabled' installer/charts/tssc-tpa/templates -A 2 -B 2

Repository: redhat-appstudio/tssc-cli

Length of output: 454


🏁 Script executed:

# Check the main trustedProfileAnalyzer template
cat -n installer/charts/tssc-tpa/templates/trustedProfileAnalyzer.yaml

Repository: redhat-appstudio/tssc-cli

Length of output: 1835


🏁 Script executed:

# Check integration-secret template
cat -n installer/charts/tssc-tpa/templates/integration-secret.yaml

Repository: redhat-appstudio/tssc-cli

Length of output: 828


🏁 Script executed:

# Search for any if conditions that might reference tls or trustification
rg -n 'if.*tls|if.*serviceEnabled|if.*trustification' installer/charts/tssc-tpa

Repository: redhat-appstudio/tssc-cli

Length of output: 261


🏁 Script executed:

# Verify which TLS object is being used - check the values structure
rg -n 'trustification:' installer/charts/tssc-tpa/values.yaml.tpl -A 20 | head -40

Repository: redhat-appstudio/tssc-cli

Length of output: 350


🏁 Script executed:

# Check if there's any CRD definition or validation that would catch type issues
find installer/charts/tssc-tpa -name "*.yaml" -o -name "*.crd.yaml" | xargs grep -l "serviceEnabled" 2>/dev/null || echo "No CRD definitions found"

Repository: redhat-appstudio/tssc-cli

Length of output: 106


🏁 Script executed:

# Verify the actual structure - is trustification.tls used or just in values?
rg -n 'trustification\.tls' installer/charts/tssc-tpa --type yaml

Repository: redhat-appstudio/tssc-cli

Length of output: 51


🏁 Script executed:

# Search the entire installer directory for any references to trustification
rg -n 'trustification' installer/ --type yaml --type txt

Repository: redhat-appstudio/tssc-cli

Length of output: 2294


🏁 Script executed:

# Check if values.yaml.tpl is a template that generates values.yaml
ls -la installer/charts/tssc-tpa/values.yaml*

Repository: redhat-appstudio/tssc-cli

Length of output: 246


🏁 Script executed:

# Check the git history or README to understand the purpose of values.yaml.tpl
head -50 installer/charts/tssc-tpa/values.yaml.tpl

Repository: redhat-appstudio/tssc-cli

Length of output: 1792


🏁 Script executed:

# Check the actual values.yaml to see if trustification section exists and its state
sed -n '185,200p' installer/charts/tssc-tpa/values.yaml

Repository: redhat-appstudio/tssc-cli

Length of output: 291


🏁 Script executed:

# Check if trustification.tls is ever referenced anywhere in the code
rg -n '\.trustification\.tls|trustification\.tls\.serviceEnabled' installer/ --type yaml

Repository: redhat-appstudio/tssc-cli

Length of output: 51


🏁 Script executed:

# Check if this is a CRD that accepts the trustification config
rg -n 'kind: TrustedProfileAnalyzer' installer/charts/tssc-tpa -A 100 | grep -E 'apiVersion|kind|spec|tls|serviceEnabled' | head -20

Repository: redhat-appstudio/tssc-cli

Length of output: 518


Emit serviceEnabled as a boolean, not a string.

Line 94 renders the value as a quoted string. If downstream consumers of these values expect a boolean type, the quoted string will be treated as a string literal rather than a boolean value.

Proposed fix
   tls:
-    serviceEnabled: "{{ not $crc }}"
+    serviceEnabled: {{ not $crc }}
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
tls:
serviceEnabled: "{{ not $crc }}"
tls:
serviceEnabled: {{ not $crc }}
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@installer/charts/tssc-tpa/values.yaml.tpl` around lines 93 - 94, The
tls.serviceEnabled value is being emitted as a quoted string; change the
template to output an unquoted boolean by removing the surrounding quotes so it
renders as a boolean literal (e.g., replace serviceEnabled: "{{ not $crc }}"
with serviceEnabled: {{ not $crc }}), ensuring the template uses the
tls.serviceEnabled key and the not $crc expression without quotes so downstream
consumers receive a true/false boolean.

@konflux-ci-qe-bot

Copy link
Copy Markdown

Scenario: pr-e2e-tests
@dperaza4dustbit: The following test has Failed, say /retest to rerun failed tests.

PipelineRun Name Status Rerun command Build Log Test Log
e2e-4.20-x6v5x Failed /retest View Pipeline Log View Test Logs

Inspecting Test Artifacts

To inspect your test artifacts, follow these steps:

  1. Install ORAS (see the ORAS installation guide).
  2. Download artifacts with the following commands:
mkdir -p oras-artifacts
cd oras-artifacts
oras pull quay.io/konflux-test-storage/rhtap-team/rhtap-cli:e2e-4.20-x6v5x

Test results analysis

<not enabled>

OCI Artifact Browser URL

<not enabled>

Comment thread installer/charts/tssc-quay/templates/tests/connectivity.yaml Fixed
Comment thread installer/charts/tssc-quay/templates/tests/connectivity.yaml Fixed
@dperaza4dustbit dperaza4dustbit force-pushed the consolidate_bundles branch 5 times, most recently from 6d6b578 to 4f2aca9 Compare May 4, 2026 21:39
@dperaza4dustbit dperaza4dustbit force-pushed the consolidate_bundles branch 6 times, most recently from 5ebe167 to 7e59dd9 Compare May 11, 2026 15:36
Signed-off-by: David Perza <dperaza@redhat.com>
@sonarqubecloud

Copy link
Copy Markdown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants