WINC-1705: DNM [test] Add Windows container build test for Konflux

[mansikulkarni96]

Summary by CodeRabbit

• New Features
  • Added automated pull request builds for Windows container images targeting the master branch.
  • Added a Windows test container that compiles and runs a minimal Go-based validation program.
  • Builds now support both Linux/amd64 and Windows/amd64 platforms.
• Chores
  • Configured automatic image expiration after five days to help manage build artifacts.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds a multi-stage Windows test container definition that cross-compiles a Go executable and packages it in a Windows host-process image. Adds a Tekton PipelineRun for pull requests targeting master when the Windows test container definition is present, configuring build parameters, output image naming, target platforms, retention, and Git authentication.

🚥 Pre-merge checks | ✅ 20

✅ Passed checks (20 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Go Best Practices & Build Tags	✅ Passed	No Go sources or build tags were changed; the PR only adds a Containerfile and Tekton manifest, so the Go/build-tag rules are not applicable.
Security: Secrets, Ssh & Csr	✅ Passed	PASS: The PR only adds a Windows build test manifest and Containerfile; no secret contents, SSH/SFTP, or CSR approval logic is introduced, and git-auth is only a workspace secret ref.
Kubernetes Controller Patterns	✅ Passed	PR only adds Tekton/Containerfile artifacts; no controller code changed, so requeue/status/finalizer/predicate/owner-ref checks are not applicable.
Windows Service Management	✅ Passed	PR only adds a Windows build test Containerfile and Tekton run; no Windows service logic, SCM interaction, dependencies, or reboot handling appear.
Platform-Specific Requirements	✅ Passed	N/A: this PR only adds a Windows build-test Containerfile and Tekton PipelineRun; it doesn't touch vSphere/AWS/Azure/GCP provisioning or platform docs.
Stable And Deterministic Test Names	✅ Passed	No Ginkgo test titles were added; the PR only changes a Tekton manifest and a Containerfile, so the check is not applicable.
Test Structure And Quality	✅ Passed	No Ginkgo test code was changed; the PR only adds build/test manifests, so this check is not applicable.
Microshift Test Compatibility	✅ Passed	PASS: PR only adds a Tekton YAML and a Windows Containerfile; no new Go/Ginkgo e2e tests or MicroShift-relevant OpenShift API usage were added.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS: The PR only modifies a Tekton PipelineRun; no new Ginkgo e2e tests or SNO-sensitive test code were added.
Topology-Aware Scheduling Compatibility	✅ Passed	PASS: The PR only adds a Tekton PipelineRun and a Windows Containerfile; neither introduces pod scheduling constraints, nodeSelectors, anti-affinity, replicas, or PDBs.
Ote Binary Stdout Contract	✅ Passed	HEAD only adds a Tekton PipelineRun; no OTE/TestMain/init/Ginkgo setup changes or new process-level stdout writes were introduced.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added; the PR only adds a Containerfile and Tekton PipelineRun, so this check doesn’t apply.
No-Weak-Crypto	✅ Passed	New Containerfile and Tekton manifest contain no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, custom crypto, or secret/token comparisons.
Container-Privileges	✅ Passed	No privileged/hostPID/hostNetwork/hostIPC/SYS_ADMIN/allowPrivilegeEscalation fields appear in the PR’s changed manifest.
No-Sensitive-Data-In-Logs	✅ Passed	No added logging exposes secrets or PII; the only secret mention is a git-auth workspace binding, and the Containerfile prints only a static test message.
Title check	✅ Passed	The title matches the change: it adds a Windows container build test for Konflux.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: mansikulkarni96

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [mansikulkarni96]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Actionable comments posted: 5

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.tekton/windows-container-test-pull-request.yaml:
- Around line 41-43: Update the docker-build pipelineRef bundle in the Windows
container test configuration to use an immutable image digest instead of the
mutable :devel tag. Preserve the existing pipeline name and deliberately select
the resolved digest for the intended pipeline version.

In `@Containerfile.windows-test`:
- Line 30: Replace the USER directive selecting ContainerAdministrator with
ContainerUser for the Windows test container, preserving the existing test
behavior while avoiding unnecessary host-level privileges.
- Line 31: Add a Docker HEALTHCHECK instruction to the final image near the
ENTRYPOINT in Containerfile.windows-test, using a command that reliably verifies
the test executable/container is healthy; if this image cannot support a
meaningful health check, document the approved exception instead.
- Line 21: Update the base image declaration in the Windows test container
configuration to use an immutable digest instead of the v1.0.0 tag, and add the
repository-required documented policy exception for this Windows host-process
image because a UBI or distroless Red Hat base is not viable.
- Around line 11-15: Update the main.go generation command in the
Containerfile’s build step to use printf or a heredoc instead of single-quoted
echo, ensuring newline escapes become actual line breaks and the generated Go
source remains valid across shells.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 2f242e9b-5bf4-44d2-9b4a-65c93f3154bd

📥 Commits

Reviewing files that changed from the base of the PR and between d6aac66 and 6d3c94c.

📒 Files selected for processing (2)

• .tekton/windows-container-test-pull-request.yaml
• Containerfile.windows-test

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Pin the remote pipeline bundle instead of using :devel.

A mutable development tag allows the PR’s build behavior and parameter contract to change without a repository change. Resolve and pin the bundle to an immutable digest, then update it deliberately when the pipeline version changes.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.tekton/windows-container-test-pull-request.yaml around lines 41 - 43,
Update the docker-build pipelineRef bundle in the Windows container test
configuration to use an immutable image digest instead of the mutable :devel
tag. Preserve the existing pipeline name and deliberately select the resolved
digest for the intended pipeline version.

[coderabbitai]

🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win

Generate main.go with printf or a heredoc.

The single-quoted echo argument preserves \n literally, and escape handling varies by shell. This can generate invalid Go source and make the build fail at Line 18.

Proposed fix

-RUN echo 'package main\n\
-import "fmt"\n\
-func main() {\n\
-    fmt.Println("Windows container test from Konflux")\n\
-}' > main.go
+RUN printf '%s\n' \
+    'package main' \
+    'import "fmt"' \
+    'func main() {' \
+    '    fmt.Println("Windows container test from Konflux")' \
+    '}' > main.go

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	RUN echo 'package main\n\
	import "fmt"\n\
	func main() {\n\
	fmt.Println("Windows container test from Konflux")\n\
	}' > main.go
	RUN printf '%s\n' \
	'package main' \
	'import "fmt"' \
	'func main() {' \
	' fmt.Println("Windows container test from Konflux")' \
	'}' > main.go

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Containerfile.windows-test` around lines 11 - 15, Update the main.go
generation command in the Containerfile’s build step to use printf or a heredoc
instead of single-quoted echo, ensuring newline escapes become actual line
breaks and the generated Go source remains valid across shells.

[openshift-ci-robot]

@mansikulkarni96: This pull request references WINC-1705 which is a valid jira issue.

Details

In response to this:

Summary by CodeRabbit

• New Features
• Added automated pull request builds for Windows container images targeting the master branch.
• Added a Windows test container that compiles and runs a minimal Go-based validation program.
• Builds now support both Linux/amd64 and Windows/amd64 platforms.
• Chores
• Configured automatic image expiration after five days to help manage build artifacts.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.