stackrox · GrimmiMeloni · Mar 26, 2026 · Jan 29, 2026 · Jan 29, 2026 · Jan 29, 2026
@@ -0,0 +1,250 @@
+#  This workflow makes sure that the Go and Python outputs of operator bundle helpers are byte for byte equivalent.
+# It will be removed together with the Python implementation in a follow-up PR.
+name: Test Bundle Helpers
+
+on:
+  push:
+    tags:
+    - '*'
+    branches:
+    - master
+    - release-*
+  pull_request:
+    types:
+    - opened
+    - reopened
+    - synchronize
+
+env:
+ ROX_PRODUCT_BRANDING: RHACS_BRANDING
+ RELATED_IMAGE_MAIN: foo
+ RELATED_IMAGE_SCANNER: foo
+ RELATED_IMAGE_SCANNER_SLIM: foo
+ RELATED_IMAGE_SCANNER_DB: foo
+ RELATED_IMAGE_SCANNER_DB_SLIM: foo
+ RELATED_IMAGE_COLLECTOR: foo
+ RELATED_IMAGE_FACT: foo
+ RELATED_IMAGE_ROXCTL: foo
+ RELATED_IMAGE_CENTRAL_DB: foo
+ RELATED_IMAGE_SCANNER_V4_DB: foo
+ RELATED_IMAGE_SCANNER_V4: foo
+
+jobs:
+  test-python-implementation:
+    strategy:
+      matrix:
+        related_img_mode:
+        - konflux
+        - omit
+        - downstream
+    name: Test Python Implementation
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: operator
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Install Python dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r bundle_helpers/requirements.txt
+
+      - name: Run Python unit tests
+        run: make test-bundle-helpers
+
+      - name: Generate bundle with Python
+        env:
+          USE_GO_BUNDLE_HELPER: false
+          RELATED_IMAGES_MODE: ${{ matrix.related_img_mode }}
+        run: |
+          set -euo pipefail
+          go mod tidy
+          make bundle bundle-post-process
+          mkdir -p /tmp/artifacts
+          cp -r bundle /tmp/artifacts/bundle-python
+          cp -r build/bundle /tmp/artifacts/build-bundle-python
+          # Make sure the build is clean.
+          git diff --exit-code HEAD
+
+      - name: Upload Python bundle artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: bundle-python-${{ matrix.related_img_mode }}
+          path: /tmp/artifacts/
+          retention-days: 1
+
+  test-go-implementation:
+    strategy:
+      fail-fast: false
+      matrix:
+        related_img_mode:
+        - konflux
+        - omit
+        - downstream
+    name: Test Go Implementation
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: operator
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: false
+
+      - name: Cache Go dependencies
+        uses: ./.github/actions/cache-go-dependencies
+
+      - name: Run Go unit tests
+        run: |
+          cd bundle_helpers
+          go test ./...
+
+      # Needed since the Go implementation uses yaml-normalizer.py
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      # Needed since the Go implementation uses yaml-normalizer.py
+      - name: Install Python dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r bundle_helpers/requirements.txt
+
+      - name: Generate bundle with Go
+        env:
+          USE_GO_BUNDLE_HELPER: true
+          RELATED_IMAGES_MODE: ${{ matrix.related_img_mode }}
+        run: |
+          set -euo pipefail
+          go mod tidy
+          make bundle bundle-post-process
+          mkdir -p /tmp/artifacts
+          cp -r bundle /tmp/artifacts/bundle-go
+          cp -r build/bundle /tmp/artifacts/build-bundle-go
+          # Make sure the build is clean.
+          git diff --exit-code HEAD
+
+      - name: Upload Go bundle artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: bundle-go-${{ matrix.related_img_mode }}
+          path: /tmp/artifacts/
+          retention-days: 1
+
+  compare-implementations:
+    strategy:
+      fail-fast: false
+      matrix:
+        related_img_mode:
+        - konflux
+        - omit
+        - downstream
+    name: Compare Python and Go Outputs
+    runs-on: ubuntu-latest
+    needs: [test-python-implementation, test-go-implementation]
+
+    steps:
+      - name: Download Python bundle
+        uses: actions/download-artifact@v4
+        with:
+          name: bundle-python-${{ matrix.related_img_mode }}
+          path: /tmp/python
+
+      - name: Download Go bundle
+        uses: actions/download-artifact@v4
+        with:
+          name: bundle-go-${{ matrix.related_img_mode }}
+          path: /tmp/go
+
+      - name: Install comparison tools
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y diffutils
+
+      - name: Compare bundle outputs
+        run: |
+          echo "=== Comparing Python and Go bundle outputs ==="
+
+          if diff -ruN /tmp/python/bundle-python /tmp/go/bundle-go; then
+            echo "✓ SUCCESS: Bundle outputs are identical"
+          else
+            echo "✗ FAILURE: Bundle outputs differ"
+            exit 1
+          fi
+          echo ""
+          echo "=== Pruning createdAt lines..."
+          sed -i '/^    createdAt:/d' /tmp/*/build-bundle-*/manifests/rhacs-operator.clusterserviceversion.yaml
+
+          echo ""
+          echo "=== Comparing build/bundle outputs ==="
+          if diff -ruN /tmp/python/build-bundle-python /tmp/go/build-bundle-go; then
+            echo "✓ SUCCESS: Build bundle outputs are identical"
+          else
+            echo "✗ FAILURE: Build bundle outputs differ"
+            exit 1
+          fi
+          echo ""
+          echo "=== Listing contents"
+          find /tmp/python /tmp/go -ls
+          find /tmp/python /tmp/go -type f -print0 | xargs -0 md5sum | sort
+
+  status-check:
+    strategy:
+      matrix:
+        related_img_mode:
+        - konflux
+        - omit
+        - downstream
+    name: Bundle Helper Tests Status
+    runs-on: ubuntu-latest
+    needs: [test-python-implementation, test-go-implementation, compare-implementations]
+    if: always()
+
+    steps:
+      - name: Check test results
+        run: |
+          python_result="${{ needs.test-python-implementation.result }}"
+          go_result="${{ needs.test-go-implementation.result }}"
+          compare_result="${{ needs.compare-implementations.result }}"
+
+          echo "Python tests: $python_result"
+          echo "Go tests: $go_result"
+          echo "Comparison: $compare_result"
+
+          if [ "$python_result" != "success" ]; then
+            echo "✗ Python tests failed"
+            exit 1
+          fi
+
+          if [ "$go_result" != "success" ]; then
+            echo "✗ Go tests failed"
+            exit 1
+          fi
+
+          if [ "$compare_result" != "success" ]; then
+            echo "✗ Go/Python comparison failed"
+            exit 1
+          fi
+
+          echo "✓ All required tests passed"
@@ -50,7 +50,8 @@ spec:
   - name: prefetch-input
     value: |
       [
-        { "type": "rpm", "path": "." }
+        { "type": "rpm", "path": "." },
+        { "type": "gomod", "path": "." }
       ]
   - name: build-source-image
     value: 'true'

@@ -12,8 +12,8 @@ CSV_VERSION ?= v$(VERSION)
 # Set to empty string to echo some command lines which are hidden by default.
 SILENT ?= @
 
-# Python binary to use for bundle helpers. Can be overridden to use a specific version (e.g., python3.9).
-# The Konflux build uses Python 3.9, so using python3.9 locally ensures compatibility.
+# Python binary to use for bundle helpers. Can be overridden to use a specific version (e.g., python3.12).
+# The Konflux build uses Python 3.12, so using python3.12 locally ensures compatibility.
 PYTHON ?= python3
 
 # This can be adjusted if deploying into non-standard namespaces. For example, as in
@@ -83,6 +83,14 @@ INDEX_IMG ?= $(INDEX_IMG_BASE):$(INDEX_IMG_TAG)
 # Image URL to use all building/pushing image targets
 IMG ?= $(IMAGE_TAG_BASE):$(VERSION)
 
+# RELATED_IMAGES_MODE controls how container image references are handled in the operator bundle CSV.
+# Valid values:
+#   omit (default)   - No related images in CSV (upstream builds)
+#   downstream       - Inject RELATED_IMAGE_* env vars for Red Hat builds (no spec.relatedImages)
+#   konflux          - Add explicit spec.relatedImages section for Konflux builds
+# Used by bundle-post-process target to support image mirroring and disconnected environments.
+RELATED_IMAGES_MODE ?= omit
+
 # Set up the so-called "storage image" for executing scorecard test suite.
 # By default a busybox image is pulled from docker.io. In order to rule out timing issues related to rate limiting
 # we use our own copy of a busybox image from quay.io.
@@ -287,8 +295,12 @@ test-upgrade: kuttl bundle-post-process ## Run OLM-based operator upgrade tests.
 .PHONY: test-bundle-helpers
 test-bundle-helpers: ## Run Python unit tests against helper scripts.
 	set -euo pipefail ;\
-	$(ACTIVATE_PYTHON) ;\
-	pytest -v bundle_helpers
+	if [ "$${USE_GO_BUNDLE_HELPER:-true}" != "true" ]; then \
+		$(ACTIVATE_PYTHON) ;\
+		pytest -v bundle_helpers ;\
+	else \
+		echo "Skipping Python tests (USE_GO_BUNDLE_HELPER=true)" ;\
+	fi
 
 .PHONY: stackrox-image-pull-secret
 stackrox-image-pull-secret: ## Create default image pull secret for StackRox images on Quay.io. Used by Helm chart.
@@ -443,11 +455,13 @@ upgrade-dirty-tag-via-olm: kuttl
 ##@ Bundle and Index build
 
 # Commands to enter local Python virtual environment and get needed dependencies there.
-# pip 21.3.1 and setuptools 59.6.0 use pkgutil.ImpImporter, removed in Python 3.12.
-# The required Python version is tracked in bundle_helpers/.python-version.
+# We rely on the venv's default pip and setuptools, which are automatically compatible
+# with the Python version used to create the venv:
+# - Python 3.12 venvs come with pip/setuptools that handle Python 3.12 correctly
+# - Older Python venvs come with pip/setuptools appropriate for those versions
+# This avoids compatibility issues when trying to upgrade to specific pip versions.
 ACTIVATE_PYTHON = $(PYTHON) -m venv bundle_helpers/.venv ;\
 	. bundle_helpers/.venv/bin/activate ;\
-	pip3 install --upgrade pip==21.3.1 setuptools==59.6.0 ;\
 	pip3 install -r bundle_helpers/requirements.txt
 
 .PHONY: bundle
@@ -476,10 +490,11 @@ bundle: yq manifests kustomize operator-sdk ## Generate bundle manifests and met
 # Yet we want most of the contents autogenerated from the Makefile variables as a single source of truth.
 # Therefore we append ".extra" file to the end of bundle's dockerfile.
 	cat bundle.Dockerfile.extra >> bundle.Dockerfile
-# Run a python script to fix the orders in the specDescriptors (children must not appear before their parents).
+# Fix the orders in the specDescriptors (children must not appear before their parents).
+# Note: Python venv is always needed because the Go implementation uses yaml-normalizer.py
 	set -euo pipefail ;\
 	$(ACTIVATE_PYTHON) ;\
-	bundle_helpers/fix-spec-descriptor-order.py \
+	./bundle_helpers/dispatch.sh fix-spec-descriptor-order \
 	  <bundle/manifests/rhacs-operator.clusterserviceversion.yaml \
 	  >bundle/manifests/rhacs-operator.clusterserviceversion.yaml.fixed
 	mv bundle/manifests/rhacs-operator.clusterserviceversion.yaml.fixed \
@@ -488,10 +503,11 @@ bundle: yq manifests kustomize operator-sdk ## Generate bundle manifests and met
 
 .PHONY: bundle-post-process
 bundle-post-process: test-bundle-helpers operator-sdk ## Post-process CSV file to include correct operator versions, etc.
+# Note: Python venv is always needed because dispatch.sh may use yaml-normalizer.py
 	set -euo pipefail ;\
 	$(ACTIVATE_PYTHON) ;\
 	first_version=3.62.0 `# 3.62.0 is the first operator version ever released` ;\
-	candidate_version=$$(./bundle_helpers/patch-csv.py \
+	candidate_version=$$(./bundle_helpers/dispatch.sh patch-csv \
 		--use-version $(VERSION) \
 		--first-version $${first_version} \
 		--operator-image $(IMG) \
@@ -509,7 +525,7 @@ bundle-post-process: test-bundle-helpers operator-sdk ## Post-process CSV file t
 		--use-version=$(VERSION) \
 		--first-version=$${first_version} \
 		--operator-image=$(IMG) \
-		--related-images-mode=omit \
+		--related-images-mode=$(RELATED_IMAGES_MODE) \
 		$${unreleased_opt:-}
 # Check that the resulting bundle still passes validations.
 	$(OPERATOR_SDK) bundle validate ./build/bundle --select-optional suite=operatorframework