菜单
Use when CI checks fail unexpectedly, when modifying Tekton pipelines or GitHub Actions, or when debugging build failures. Covers pipeline structure, GitHub Actions scope, and image digest gotchas.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/konflux-ci/oauth2-proxy --skill ci-cd-quirks命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
正在显示 SKILL.md
Use when building the container image locally, running upstream tests, or linting. Covers submodule init, podman build, make test, and golangci-lint.
Use when updating the oauth2-proxy git submodule to a new upstream tag. Covers tag checkout workflow, version injection via ldflags, and commit conventions.
| name | ci-cd-quirks |
| description | Use when CI checks fail unexpectedly, when modifying Tekton pipelines or GitHub Actions, or when debugging build failures. Covers pipeline structure, GitHub Actions scope, and image digest gotchas. |
| Pipeline | Trigger | Purpose |
|---|---|---|
.tekton/oauth2-proxy-pull-request.yaml | PR opened/updated | Build + security scans on PR |
.tekton/oauth2-proxy-push.yaml | Merge to main | Production build + push to registry |
.tekton/oauth2-proxy-pipeline.yaml | Shared pipeline definition | Referenced by PR and push configs |
Builds run in Konflux, not GitHub Actions. GitHub Actions handle:
lint.yaml — yamllint + hadolint on PRs and pushes to mainauto-merge.yaml — auto-merges bot PRs (Renovate/MintMaker)dep-triage.yaml — labels and triages dependency update PRsThe pipeline currently builds linux/x86_64 and linux/arm64. When updating base image digests in the Containerfile, always use the manifest list digest. Platform-specific digests (e.g., from podman inspect) break arm64 builds (and any other non-amd64 platforms if added later).
# Get the correct manifest list digest
skopeo inspect --raw docker://registry.access.redhat.com/ubi10/go-toolset:<tag> \
| sha256sum | cut -d' ' -f1
# Verify it's a manifest list (should show a "manifests" array)
skopeo inspect --raw docker://registry.access.redhat.com/ubi10/go-toolset:<tag> \
| python3 -m json.tool | head -5
| Symptom | Cause | Fix |
|---|---|---|
| arm64 build: "image not known" | Platform-specific digest in Containerfile | Replace with manifest list digest |
| Go version mismatch | go.mod requires newer Go than UBI provides | Update go-toolset image or downgrade submodule |
jwt_signing_key.pem not found | Build step skipped or failed | Ensure touch jwt_signing_key.pem runs in builder stage |
基于 SOC 职业分类