Update golang builder CVE component name to openshift4/openshift-golang-builder

elliott/elliottlib/cli/attach_cve_flaws_cli.py

@@ -537,7 +537,8 @@ def get_cve_component_mapping(
                 raise ValueError(f"Bug {tracker.id} doesn't have a valid whiteboard component.")
 
             whiteboard_component = tracker.whiteboard_component
-            if is_ocp_delivery_repo(whiteboard_component):
+            is_golang_builder = whiteboard_component == constants.GOLANG_BUILDER_CVE_COMPONENT
+            if is_ocp_delivery_repo(whiteboard_component) and not is_golang_builder:
                 # this means the component here is the delivery repo name
                 # we need to translate it to build component name
                 new_component = get_component_by_delivery_repo(runtime, whiteboard_component)
@@ -548,10 +549,12 @@ def get_cve_component_mapping(
             component_names = None  # Initialize to ensure it's always defined
 
             if konflux:
-                new_component = get_konflux_component_by_component(runtime, whiteboard_component)
+                new_component = (
+                    get_konflux_component_by_component(runtime, whiteboard_component) if not is_golang_builder else None
+                )
                 if not new_component:
                     # Special case for builder containers: they should map to all components that use this builder
-                    if whiteboard_component == "openshift-golang-builder-container":
+                    if is_golang_builder or whiteboard_component == constants.GOLANG_BUILDER_BREW_COMPONENT:
                         # Check which components actually use the golang builder
                         logger.info(f"Processing builder container CVE for '{whiteboard_component}' (golang builder)")
 

elliott/elliottlib/cli/find_bugs_golang_cli.py

@@ -162,7 +162,7 @@ def _is_fixed(self, bug: JIRABug, tracker_fixed_in: Set[Version], go_nvr_map) ->
         for go_build in go_nvr_map.keys():
             # if this is a builder image then fetch the golang rpm
             parent_go_build = go_build
-            if constants.GOLANG_BUILDER_CVE_COMPONENT in go_build:
+            if constants.GOLANG_BUILDER_BREW_COMPONENT in go_build:
                 parsed_nvr = parse_nvr(go_build)
                 go_builder_nvr_map = get_golang_container_nvrs(
                     [(parsed_nvr['name'], parsed_nvr['version'], parsed_nvr['release'])], self._logger, exact=True
@@ -748,7 +748,7 @@ def compare(b1, b2):
     "--component",
     "components",
     multiple=True,
-    help="Only operate on trackers for these JIRA Bug components e.g. openshift-golang-builder-container",
+    help="Only operate on trackers for these JIRA Bug components e.g. openshift4/openshift-golang-builder",
 )
 @click.option('--art-jira', help='Related ART Jira ticket for reference e.g. ART-1234')
 @click.option(
@@ -815,7 +815,7 @@ async def find_bugs_golang_cli(
 
     Bugs are compared with latest builds in `stream` assembly by default. Pass --assembly to specify.
 
-    For openshift-golang-builder-container build, use --pullspec <payload_pullspec> to determine if fixed for builds in
+    For openshift-golang-builder build, use --pullspec <payload_pullspec> to determine if fixed for builds in
     given pullspec
 
     Note: rpm trackers cannot be processed if --pullspec is used, for that rely on --assembly.
@@ -828,7 +828,7 @@ async def find_bugs_golang_cli(
     bugs like openshift-golang-builder where we want to move the bug to VERIFIED after or close to when mass rebuild is
     triggered.
 
-    --component: Only operate on trackers for these JIRA Bug components e.g. openshift-golang-builder-container.
+    --component: Only operate on trackers for these JIRA Bug components e.g. openshift4/openshift-golang-builder.
 
     --rpms-only: Ignore builder container bugs and only analyze RPM trackers.
 

elliott/elliottlib/cli/find_bugs_sweep_cli.py

@@ -615,6 +615,7 @@ def categorize_bugs_by_type(
             # golang builder is a special tracker component
             # which applies to all our golang images
             exception_packages.append(constants.GOLANG_BUILDER_CVE_COMPONENT)
+            exception_packages.append(constants.GOLANG_BUILDER_BREW_COMPONENT)
 
         for bug in tracker_bugs:
             package_name = bug.whiteboard_component

elliott/elliottlib/constants.py

@@ -22,7 +22,8 @@
 }
 
 # Golang builder needs special treatment when associating security tracking bugs with builds:
-GOLANG_BUILDER_CVE_COMPONENT = 'openshift-golang-builder-container'
+GOLANG_BUILDER_CVE_COMPONENT = 'openshift4/openshift-golang-builder'
+GOLANG_BUILDER_BREW_COMPONENT = 'openshift-golang-builder-container'
 
 BUG_LOOKUP_CHUNK_SIZE = 100
 BUG_ATTACH_CHUNK_SIZE = 100

elliott/elliottlib/errata_async.py

@@ -417,10 +417,10 @@ def populate_golang_cve_components(cls, golang_cve_names, expected_cve_component
             builder_nvr = parse_nvr(builder_nvr_string)
 
             # Make sure they are go builder nvrs (this should never happen)
-            if builder_nvr['name'] != constants.GOLANG_BUILDER_CVE_COMPONENT:
+            if builder_nvr['name'] != constants.GOLANG_BUILDER_BREW_COMPONENT:
                 raise ValueError(
                     f"Unexpected `name` value for nvr {builder_nvr}. Expected "
-                    f"{constants.GOLANG_BUILDER_CVE_COMPONENT}. Please investigate."
+                    f"{constants.GOLANG_BUILDER_BREW_COMPONENT}. Please investigate."
                 )
 
             if 'etcd' in list(go_nvr_map[builder_nvr_string])[0]:

elliott/elliottlib/util.py

@@ -488,7 +488,7 @@ def get_golang_container_nvrs_brew(nvrs: List[Tuple[str, str, str]], logger, exa
             logger.error(f'Error parsing {build}')
             raise
         name = nvr[0]
-        if name == 'openshift-golang-builder-container' or 'go-toolset' in name:
+        if name == constants.GOLANG_BUILDER_BREW_COMPONENT or 'go-toolset' in name:
             go_version = get_parent_golang_from_brew(nvr)
             if not go_version:
                 raise ValueError(f'Could not find go version for golang builder {nvr}')
@@ -591,7 +591,7 @@ def get_golang_container_nvrs_for_konflux_record(
             # NVRs never contain '/', so we can distinguish them from pullspecs.
             if '/' not in p:
                 # This is an NVR - look for golang builder (e.g. openshift-golang-builder-container-v1.24.4-...)
-                if p.startswith(f'{constants.GOLANG_BUILDER_CVE_COMPONENT}-'):
+                if p.startswith(f'{constants.GOLANG_BUILDER_BREW_COMPONENT}-'):
                     go_version = p
                     break
             else:
@@ -602,7 +602,7 @@ def get_golang_container_nvrs_for_konflux_record(
                     break
                 elif spec.startswith('art-images:golang-builder-'):
                     go_version = spec.replace(
-                        'art-images:golang-builder-', f'{constants.GOLANG_BUILDER_CVE_COMPONENT}-'
+                        'art-images:golang-builder-', f'{constants.GOLANG_BUILDER_BREW_COMPONENT}-'
                     )
                     break
 

elliott/tests/test_bzutil.py

@@ -740,36 +740,36 @@ def test_whiteboard_component_normalizes_duplicated_component(self):
             flexmock(
                 key=1,
                 fields=flexmock(
-                    labels=["pscomponent:openshift-golang-builder-container/openshift-golang-builder-container"],
+                    labels=["pscomponent:some-component/some-component"],
                     issuetype=flexmock(name="Bug"),
                 ),
             )
         )
-        self.assertEqual(bug.whiteboard_component, "openshift-golang-builder-container")
+        self.assertEqual(bug.whiteboard_component, "some-component")
 
         # Non-duplicated component with slash should be left alone
         bug = JIRABug(
             flexmock(
                 key=2,
                 fields=flexmock(
-                    labels=["pscomponent:openshift4/ose-cli"],
+                    labels=["pscomponent:openshift4/openshift-golang-builder"],
                     issuetype=flexmock(name="Bug"),
                 ),
             )
         )
-        self.assertEqual(bug.whiteboard_component, "openshift4/ose-cli")
+        self.assertEqual(bug.whiteboard_component, "openshift4/openshift-golang-builder")
 
         # Component without slash should be unaffected
         bug = JIRABug(
             flexmock(
                 key=3,
                 fields=flexmock(
-                    labels=["pscomponent:openshift-golang-builder-container"],
+                    labels=["pscomponent:openshift-clients"],
                     issuetype=flexmock(name="Bug"),
                 ),
             )
         )
-        self.assertEqual(bug.whiteboard_component, "openshift-golang-builder-container")
+        self.assertEqual(bug.whiteboard_component, "openshift-clients")
 
 
 class TestBugzillaBug(unittest.TestCase):

elliott/tests/test_find_bugs_golang_cli.py

@@ -28,7 +28,7 @@ def _make_cli(**overrides):
     return FindBugsGolangCli(**defaults)
 
 
-def _make_bug(bug_id="OCPBUGS-99999", component="openshift-golang-builder-container"):
+def _make_bug(bug_id="OCPBUGS-99999", component=constants.GOLANG_BUILDER_CVE_COMPONENT):
     bug = MagicMock()
     bug.id = bug_id
     bug.whiteboard_component = component

pyartcd/pyartcd/pipelines/update_golang.py

@@ -24,7 +24,7 @@
 from artcommonlib.util import new_roundtrip_yaml_handler
 from doozerlib.constants import ART_IMAGES_BASE_APPLICATION
 from elliottlib import util as elliottutil
-from elliottlib.constants import GOLANG_BUILDER_CVE_COMPONENT
+from elliottlib.constants import GOLANG_BUILDER_BREW_COMPONENT, GOLANG_BUILDER_CVE_COMPONENT
 
 from pyartcd import constants, jenkins
 from pyartcd.cli import cli, click_coroutine, pass_runtime
@@ -532,7 +532,7 @@ async def tag_build(self, el_v, nvr):
             await self._slack_client.say_in_thread(f"Tagged {build} with {build_tag} tag")
 
     def get_existing_builders_brew(self, el_nvr_map, go_version):
-        component = GOLANG_BUILDER_CVE_COMPONENT
+        component = GOLANG_BUILDER_BREW_COMPONENT
         _LOGGER.info(f"Checking if {component} builds exist in Brew for given golang builds")
         package_info = self.koji_session.getPackage(component)
         if not package_info:
@@ -574,7 +574,7 @@ async def get_existing_builders_konflux(
         _LOGGER.info(f"Checking if {GOLANG_BUILDER_IMAGE_NAME} builds exist in Konflux for given golang builds")
 
         builder_records: dict[int, KonfluxBuildRecord] = {}
-        extra_patterns = {'nvr': f"{GOLANG_BUILDER_CVE_COMPONENT}-v{go_version}"}
+        extra_patterns = {'nvr': f"{GOLANG_BUILDER_BREW_COMPONENT}-v{go_version}"}
         build_records = await asyncio.gather(
             *(
                 anext(
@@ -624,8 +624,8 @@ def _get_builder_pullspec(self, builder_nvr: str):
         parsed_nvr = parse_nvr(builder_nvr)
         component_name = parsed_nvr["name"]
         if component_name == GOLANG_BUILDER_IMAGE_NAME:
-            component_name = GOLANG_BUILDER_CVE_COMPONENT
-        elif component_name != GOLANG_BUILDER_CVE_COMPONENT:
+            component_name = GOLANG_BUILDER_BREW_COMPONENT
+        elif component_name != GOLANG_BUILDER_BREW_COMPONENT:
             raise ValueError(f"Expected a golang builder image NVR, got: {builder_nvr}")
         published_nvr = f'{component_name}-{parsed_nvr["version"]}-{parsed_nvr["release"]}'
         return f'{PUBLISHED_GOLANG_BUILDER_REPO}:{published_nvr}'

pyartcd/tests/pipelines/test_update_golang.py

@@ -225,7 +225,7 @@ async def test_move_golang_bugs_with_cves(self, mock_cmd_assert):
             ocp_version="4.16",
             cves=["CVE-2024-1234", "CVE-2024-5678"],
             nvrs=["golang-1.20.12-2.el8"],
-            components=["openshift-golang-builder-container"],
+            components=["openshift4/openshift-golang-builder"],
             force_update_tracker=False,
             dry_run=False,
         )
@@ -246,7 +246,7 @@ async def test_move_golang_bugs_with_cves(self, mock_cmd_assert):
             "--fixed-in-nvr",
             "golang-1.20.12-2.el8",
             "--component",
-            "openshift-golang-builder-container",
+            "openshift4/openshift-golang-builder",
         ]
         mock_cmd_assert.assert_called_once_with(expected_cmd, log_stdout=True)