chore(ci): skip CLI build on pull requests to reduce build time by janisz · Pull Request #19817 · stackrox/stackrox

janisz · 2026-04-03T08:27:13Z

Description

Problem: The pre-build-cli job compiles roxctl and roxagent for 11 platform/architecture combinations, taking 5-10 minutes per PR build. These binaries are rarely needed for PR testing.

Solution: Create stub text files before compilation, then conditionally run the build. On PRs without the ci-build-cli label, stubs remain and compilation is skipped. On pushes, workflow_call, or labeled PRs, real binaries overwrite stubs. This preserves artifact structure without requiring Dockerfile or Makefile changes.

Impact:

PRs: ~5-10 min build time savings (stubs used)
Master/releases: No change (real binaries built)
Developers needing CLI: Add ci-build-cli label to PR

See: https://redhat-internal.slack.com/archives/CELUQKESC/p1775031436674199

User-facing documentation

CHANGELOG.md is updated OR update is not needed
documentation PR is created and is linked above OR is not needed

Testing and quality

the change is production ready: the change is GA, or otherwise the functionality is gated by a feature flag
CI results are inspected

Automated testing

How I validated my change

CI

sourcery-ai

Hey - I've left some high level feedback:

The Build CLI step's if condition always evaluates github.event.pull_request.labels.*.name even for non-pull_request events, which will fail when github.event.pull_request is undefined; wrap the label check in an github.event_name == 'pull_request' && … guard or split conditions so label access only happens on PR events.
Similarly, the PR labels step should be conditioned to run only for pull_request events to avoid invoking joerick/pr-labels-action when the event payload has no PR context.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- The `Build CLI` step's `if` condition always evaluates `github.event.pull_request.labels.*.name` even for non-`pull_request` events, which will fail when `github.event.pull_request` is undefined; wrap the label check in an `github.event_name == 'pull_request' && …` guard or split conditions so label access only happens on PR events.
- Similarly, the `PR labels` step should be conditioned to run only for `pull_request` events to avoid invoking `joerick/pr-labels-action` when the event payload has no PR context.

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

coderabbitai · 2026-04-03T08:30:25Z

Caution

Review failed

Failed to post review comments

📝 Walkthrough

Summary by CodeRabbit

Chores
- CI now conditionally packages CLI stubs and runs CLI builds based on labels or release/master/workflow events.
- Build pipeline reduced to produce fewer standalone binaries, and images now use a single central binary with command symlinks.
Refactor
- Multiple components’ startup logic moved into dedicated app entrypoints, consolidating runtime initialization and simplifying main executables.

Walkthrough

This PR centralizes runtime entrypoints by adding app.Run() packages and simplifying main() files to delegate to them, introduces a central dispatcher that routes by executable name, adjusts build outputs and packaging (Makefile, CI, Dockerfiles), and updates import allowlists and small scripts.

Changes

Cohort / File(s)	Summary
CI build workflow `.github/workflows/build.yaml`	Add step to fetch PR labels; create and package placeholder CLI stubs; gate Go cache and `make cli` behind expanded conditions (release GOTAGS, `master`, `workflow_call`, or PR label `ci-build-cli`).
Build system & packaging `Makefile`, `image/rhel/Dockerfile`, `image/rhel/konflux.Dockerfile`	Restrict compiled Go binaries produced by main build; stop copying many standalone binaries into image and instead create BusyBox-style symlinks pointing those command names to `/stackrox/central`. Adjust `roxctl` symlink targets.
Central dispatcher `central/main.go`	Rename original `main()` to `centralRun()` and add a new `main()` that dispatches execution by `filepath.Base(os.Args[0])`, invoking `centralRun()` or calling `Run()` from various component `app` packages based on the invoked binary name.
New app.Run() entrypoints (added) `compliance/cmd/compliance/app/app.go`, `compliance/virtualmachines/roxagent/app/app.go`, `config-controller/app/app.go`, `migrator/app/app.go`, `roxctl/app/app.go`, `sensor/admission-control/app/app.go`, `sensor/kubernetes/app/app.go`, `sensor/upgrader/app/app.go`	Introduce `app` packages exposing `Run()` (and small helpers/flags) that encapsulate each component’s startup, signal handling, and main control flow previously in their `main.go` files.
Main files simplified to delegate `compliance/cmd/compliance/main.go`, `compliance/virtualmachines/roxagent/main.go`, `config-controller/main.go`, `migrator/main.go`, `roxctl/main.go`, `sensor/admission-control/main.go`, `sensor/kubernetes/main.go`, `sensor/upgrader/main.go`	Replace extensive inline initialization and run-loop logic with a single `app.Run()` call; remove previously inlined helpers and initialization code from each `main.go`.
Minor package changes / package decl updates `migrator/app/upgrade.go`, `sensor/admission-control/app/certs.go`	Change package declarations from `main` to `app` to match new package layout.
Tests updated for helper extraction `roxctl/main_test.go`	Add `getCommandPath` helper and import update to accommodate refactored CLI startup logic.
Tools / vet allowlist `tools/roxvet/analyzers/validateimports/analyzer.go`	Allow `central` to import specific `*/app` packages (explicitly permit imports of the new `app` entrypoint packages).
Scripts tweak `scripts/check-image-version.sh`	Relax git-grep regex to allow trailing characters after patch number (`X.Y.Z.*`) before extracting numeric `X.Y.Z`.

Estimated code review effort

🎯 5 (Critical) | ⏱️ ~120 minutes

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 27.27% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'chore(ci): skip CLI build on pull requests to reduce build time' accurately summarizes the primary change—a CI optimization that skips CLI compilation on PRs to save build time.
Description check	✅ Passed	The PR description covers the problem, solution, and impact clearly. However, documentation and testing checkboxes remain unchecked, and the template sections are minimally completed with only 'CI' as validation.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch ROX-30858/skip-cli-on-prs

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/build.yaml:
- Around line 241-248: The "Build CLI" job step's conditional omits manual runs
— update the if condition used in the "Build CLI" step to also allow
github.event_name == 'workflow_dispatch' (i.e., include 'workflow_dispatch' in
the OR chain alongside 'push', 'workflow_call', and the label check) so
manually-triggered workflows will run make cli and produce real CLI binaries.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: a37c6f55-f3dc-402c-b782-366a51ee6014

📥 Commits

Reviewing files that changed from the base of the PR and between d32cf0a and 1ac915c.

📒 Files selected for processing (1)

.github/workflows/build.yaml

.github/workflows/build.yaml

codecov · 2026-04-03T08:33:17Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 49.60%. Comparing base (5d9f83e) to head (b4a6ac5).

Additional details and impacted files

@@                     Coverage Diff                     @@
##           ROX-33958/resue-components   #19817   +/-   ##
===========================================================
  Coverage                       49.60%   49.60%           
===========================================================
  Files                            2763     2763           
  Lines                          208254   208254           
===========================================================
  Hits                           103309   103309           
  Misses                          97278    97278           
  Partials                         7667     7667

Flag	Coverage Δ
go-unit-tests	`49.60% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

github-actions · 2026-04-03T08:37:44Z

🚀 Build Images Ready

Images are ready for commit 961885c. To use with deploy scripts:

export MAIN_IMAGE_TAG=4.11.x-559-g961885cc5c

.github/workflows/build.yaml

User request: Speed up build.yaml by skipping CLI builds on PRs. Problem: The pre-build-cli job compiles roxctl and roxagent for 11 platform/architecture combinations, taking 5-10 minutes per PR build. These binaries are rarely needed for PR testing. Solution: Always create stub text files (fast ~2s), then conditionally build real CLI binaries that overwrite stubs. Go cache is skipped when CLI won't be built. This preserves artifact structure without requiring Dockerfile or Makefile changes. Stub creation is unconditional (fast) for simplicity. Build CLI step overwrites stubs when needed. Build conditions (CLI compilation runs when): - GOTAGS=release: Tagged releases - master branch: Nightly builds - workflow_call: Release-ci.yaml calls - ci-build-cli label: Developer explicitly requests Impact: - PRs without label: ~5-10 min savings (stubs used, cache skipped) - Master/releases: No change (real binaries built) - Developers needing CLI: Add ci-build-cli label to PR Co-Authored-By: Claude Sonnet 4.5 <[email protected]>

github-actions · 2026-04-03T14:27:48Z

/konflux-retest central-db-on-push

github-actions · 2026-04-03T14:30:15Z

/konflux-retest main-on-push

github-actions · 2026-04-03T14:31:54Z

/konflux-retest scanner-v4-on-push

github-actions · 2026-04-03T14:31:58Z

/konflux-retest scanner-v4-on-push

github-actions · 2026-04-03T14:32:04Z

/konflux-retest operator-on-push

github-actions · 2026-04-03T14:40:19Z

/konflux-retest main-on-push

github-actions · 2026-04-03T14:40:35Z

/konflux-retest operator-on-push

github-actions · 2026-04-03T14:41:44Z

/konflux-retest roxctl-on-push

github-actions · 2026-04-03T14:53:05Z

/konflux-retest main-on-push

github-actions · 2026-04-03T14:55:08Z

/konflux-retest scanner-v4-on-push

github-actions · 2026-04-03T15:03:46Z

/konflux-retest roxctl-on-push

github-actions · 2026-04-03T15:09:23Z

/konflux-retest roxctl-on-push

github-actions · 2026-04-03T15:14:44Z

/konflux-retest operator-on-push

openshift-ci · 2026-04-03T16:36:37Z

@janisz: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/gke-ui-e2e-tests	`b4a6ac5`	link	true	`/test gke-ui-e2e-tests`
ci/prow/gke-scanner-v4-install-tests	`b4a6ac5`	link	false	`/test gke-scanner-v4-install-tests`
ci/prow/gke-nongroovy-e2e-tests	`b4a6ac5`	link	true	`/test gke-nongroovy-e2e-tests`
ci/prow/gke-operator-e2e-tests	`b4a6ac5`	link	false	`/test gke-operator-e2e-tests`
ci/prow/gke-upgrade-tests	`b4a6ac5`	link	false	`/test gke-upgrade-tests`
ci/prow/gke-qa-e2e-tests	`b4a6ac5`	link	false	`/test gke-qa-e2e-tests`
ci/prow/ocp-4-12-qa-e2e-tests	`b4a6ac5`	link	false	`/test ocp-4-12-qa-e2e-tests`
ci/prow/ocp-4-12-nongroovy-e2e-tests	`b4a6ac5`	link	false	`/test ocp-4-12-nongroovy-e2e-tests`
ci/prow/ocp-4-21-compliance-e2e-tests	`b4a6ac5`	link	false	`/test ocp-4-21-compliance-e2e-tests`
ci/prow/ocp-4-21-scanner-v4-install-tests	`b4a6ac5`	link	false	`/test ocp-4-21-scanner-v4-install-tests`
ci/prow/ocp-4-21-qa-e2e-tests	`b4a6ac5`	link	false	`/test ocp-4-21-qa-e2e-tests`
ci/prow/ocp-4-12-operator-e2e-tests	`b4a6ac5`	link	false	`/test ocp-4-12-operator-e2e-tests`
ci/prow/ocp-4-21-nongroovy-e2e-tests	`b4a6ac5`	link	false	`/test ocp-4-21-nongroovy-e2e-tests`
ci/prow/ocp-4-12-scanner-v4-install-tests	`b4a6ac5`	link	false	`/test ocp-4-12-scanner-v4-install-tests`
ci/prow/ocp-4-21-operator-e2e-tests	`b4a6ac5`	link	false	`/test ocp-4-21-operator-e2e-tests`
ci/prow/ocp-4-12-compliance-e2e-tests	`b4a6ac5`	link	false	`/test ocp-4-12-compliance-e2e-tests`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

github-actions · 2026-04-03T17:01:43Z

/konflux-retest operator-bundle-on-push

github-actions · 2026-04-03T17:02:17Z

/konflux-retest operator-bundle-on-push

github-actions · 2026-04-03T17:11:16Z

/konflux-retest operator-bundle-on-push

janisz requested a review from a team as a code owner April 3, 2026 08:27

github-actions bot added area/ci ai-review coderabbit-review labels Apr 3, 2026

sourcery-ai bot reviewed Apr 3, 2026

View reviewed changes

coderabbitai bot reviewed Apr 3, 2026

View reviewed changes

.github/workflows/build.yaml Outdated Show resolved Hide resolved

janisz force-pushed the ROX-30858/skip-cli-on-prs branch 2 times, most recently from 7e2871a to cc20ba4 Compare April 3, 2026 09:41

janisz commented Apr 3, 2026

View reviewed changes

.github/workflows/build.yaml Show resolved Hide resolved

janisz force-pushed the ROX-30858/skip-cli-on-prs branch from 961885c to b4a6ac5 Compare April 3, 2026 14:02

janisz requested review from a team and rhacs-bot as code owners April 3, 2026 14:02

rhacs-bot requested a review from a team April 3, 2026 14:02

github-actions bot added area/roxctl area/central area/helm area/sensor area/admission-controller konflux-build Run Konflux in PR. Push commit to trigger it. labels Apr 3, 2026

janisz mentioned this pull request Apr 3, 2026

WIP: ROX-33958: BusyBox-style binary consolidation for main image #19819

Open

9 tasks

janisz changed the base branch from master to ROX-33958/resue-components April 3, 2026 14:06

Conversation

janisz commented Apr 3, 2026

Description

User-facing documentation

Testing and quality

Automated testing

How I validated my change

Uh oh!

sourcery-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai bot commented Apr 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review failed

Summary by CodeRabbit

Walkthrough

Changes

Estimated code review effort

❌ Failed checks (1 warning)

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

codecov bot commented Apr 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions bot commented Apr 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚀 Build Images Ready

Uh oh!

Uh oh!

github-actions bot commented Apr 3, 2026

Uh oh!

github-actions bot commented Apr 3, 2026

Uh oh!

github-actions bot commented Apr 3, 2026

Uh oh!

github-actions bot commented Apr 3, 2026

Uh oh!

github-actions bot commented Apr 3, 2026

Uh oh!

github-actions bot commented Apr 3, 2026

Uh oh!

github-actions bot commented Apr 3, 2026

Uh oh!

github-actions bot commented Apr 3, 2026

Uh oh!

github-actions bot commented Apr 3, 2026

Uh oh!

github-actions bot commented Apr 3, 2026

Uh oh!

github-actions bot commented Apr 3, 2026

Uh oh!

github-actions bot commented Apr 3, 2026

Uh oh!

github-actions bot commented Apr 3, 2026

Uh oh!

openshift-ci bot commented Apr 3, 2026

Uh oh!

github-actions bot commented Apr 3, 2026

Uh oh!

github-actions bot commented Apr 3, 2026

Uh oh!

github-actions bot commented Apr 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

coderabbitai bot commented Apr 3, 2026 •

edited

Loading

codecov bot commented Apr 3, 2026 •

edited

Loading

github-actions bot commented Apr 3, 2026 •

edited

Loading