菜单
Use when CI checks fail unexpectedly, when preparing code for CI, or when encountering non-obvious build and pipeline behavior. Covers hermetic builds, Tekton pipelines, multi-arch, GitHub Actions checks, and integration test structure.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | ci-cd-quirks |
| description | Use when CI checks fail unexpectedly, when preparing code for CI, or when encountering non-obvious build and pipeline behavior. Covers hermetic builds, Tekton pipelines, multi-arch, GitHub Actions checks, and integration test structure. |
CI runs on both GitHub Actions (linting, unit tests) and Konflux Tekton pipelines (image builds, integration tests). Several non-obvious requirements trip up developers.
File: .github/workflows/pr-checks.yaml
| Check | What it does | Strict enforcement |
|---|---|---|
| yamllint | Lints all YAML files | Yes, fails PR |
| hadolint | Lints Dockerfile (ignores DL3003,DL3013,DL3041,DL4006) | Yes, fails PR |
| opa_policies_unittest | OPA tests + coverage check (100% coverage required — fails if any line uncovered) | Yes, fails PR |
| bash_unittests | BATS tests for bash functions | Yes, fails PR |
| shellcheck | Bash linting on test/ (ignores conftest.sh, selftest.sh) | Yes, fails PR |
| gitlint | Validates commit message format | PR-only, enforces lowercase after colon (custom rule UC1) |
Critical detail: OPA coverage enforcement uses jq to assert:
jq -j -r 'if .coverage < 100 then "ERROR: Code coverage threshold not met: got \(.coverage) instead of 100.00\n" | halt_error(1) else "" end'
PR Pipeline: .tekton/konflux-test-pull-request.yaml
on-pr-{{revision}}Push Pipeline: .tekton/konflux-test-push.yaml
{{revision}}File: integration-tests/konflux_test_validation.yaml
Runs INSIDE the built image after build succeeds:
/selftest.sh (smoke tests: binaries present, conftest works)opa test on ./policies (100% coverage enforced)bats unittests_bash (expects cosign in /usr/local/bin)Output format: Uses Tekton result functions (make_result_json, parse_test_output, handle_error).
All dependencies must be pre-declared — no network access during build:
RPM packages: rpms.in.yaml → rpms.lock.yaml (generated lockfile)
packages:
- jq
- python3
- skopeo
Generic artifacts: artifacts.lock.yaml (binaries, tarballs)
- download_url: https://github.com/operator-framework/operator-registry/releases/download/v1.57.0/linux-amd64-opm.tar.gz
checksum: sha256:abc123...
filename: opm-v1.57.0.tar.gz
Critical: Hermetic build requires both amd64 and arm64 variants for each multi-arch binary.
Dockerfile uses:
if [ "$TARGETARCH" = "amd64" ]; then
cp ${PATH_TO_ART}/opm-amd64 /usr/local/bin/opm
elif [ "$TARGETARCH" = "arm64" ]; then
cp ${PATH_TO_ART}/opm-arm64 /usr/local/bin/opm
fi
| Problem | Root cause | Fix |
|---|---|---|
| OPA coverage exactly 99.x% | CI enforces 100% strictly | Add test for uncovered policy line |
shellcheck passes locally, fails CI | Different flags (-s bash in CI) | Run locally with: shellcheck -s bash test/utils.sh |
| Binary "not found" after build | Missing from artifacts.lock.yaml | Add both amd64 and arm64 variants with checksums |
| Integration tests fail but unit tests pass | Tests run inside the image | Check Dockerfile COPY paths and selftest.sh validation |
| Hadolint fails on new instruction | Rule not in ignore list | Check .github/workflows/pr-checks.yaml for ignore: field |
| New RPM package fails hermetic build | Not declared in rpms.in.yaml | Add package name and regenerate rpms.lock.yaml |
Use when adding new tools, binaries, or packages to the konflux-test container image. Covers artifacts.lock.yaml (generic binaries), rpms.in.yaml (system packages), multi-architecture support, and hermetic build constraints.
Use when preparing a pull request for review or before pushing. Checklist of commit conventions, Rego policy tests at 100% coverage, BATS tests, code quality checks, and CI check requirements.
Use when running OPA policy unit tests, BATS bash tests, shellcheck, hadolint, or conftest integration tests locally. Covers test commands, coverage requirements, test data, and prerequisites.
Use when adding or modifying bash utility functions in test/utils.sh. Covers naming conventions, function structure, BATS tests, mock patterns for external tools, TEST_OUTPUT format, and shellcheck compliance.
Use when writing, modifying, or reviewing OPA/conftest Rego policies. Covers package naming, rule prefixes (violation_ and warn_), conftest namespaces, violation object structures, imports, and unit test patterns.