fix: add --base-image-release CLI override for open network mode

[thegreyd]

Summary

• Adds --base-image-release/--no-base-image-release CLI flag to doozer's beta:images:konflux:build command, following the same pattern as --network-mode
• Adds base_image_release_override to Runtime, checked in should_trigger_base_image_release() with highest precedence (after OKD check)
• Wires update_golang pipeline to pass --no-base-image-release when --network-mode open is set, since base image release currently requires hermetic builds

Test plan

• Existing test_should_trigger_base_image_release tests pass
• New test cases verify CLI override=False disables for base/golang images
• New test cases verify CLI override=True enables even when group config disables
• Full test suite passes (2720 tests across all packages)

🤖 Generated with Claude Code

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign rayfordj for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Walkthrough

This PR adds a CLI-driven override mechanism for base image release triggering. A new --base-image-release/--no-base-image-release flag enables operators to force enable or disable base image release in the beta:images:konflux:build command. The override is checked first in the image metadata decision logic, bypassing normal config and metadata rules when set. Pipeline integration uses the flag to disable base image release when network mode is open.

Changes

Base image release override feature

Layer / File(s)	Summary
Runtime attribute initialization doozer/doozerlib/runtime.py	Runtime.__init__ initializes base_image_release_override to None.
CLI option and handler wiring doozer/doozerlib/cli/images_konflux.py	New --base-image-release/--no-base-image-release flag added to beta:images:konflux:build; handler accepts base_image_release: Optional[bool] and conditionally sets runtime.base_image_release_override.
ImageMetadata override check doozer/doozerlib/image.py	should_trigger_base_image_release() checks runtime.base_image_release_override early and returns it immediately if not None, bypassing force/enabled/assembly/base-image logic.
Test coverage for override behavior doozer/tests/test_image.py	Existing test setup updated to explicitly set override to None; new test cases validate override=False prevents triggering and override=True enables triggering even when config disables it.
Pipeline integration in golang builder pyartcd/pyartcd/pipelines/update_golang.py	UpdateGolangPipeline._build_konflux adds --no-base-image-release when network_mode == "open".

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-ci]

@thegreyd: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/security	7f45b51	link	false	/test security

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[coderabbitai]

🧹 Nitpick comments (1)

doozer/tests/test_image.py (1)

1946-1966: ⚡ Quick win

Add an OKD + override=True regression test.

You now verify OCP override on/off, but not that OKD still hard-disables base image release when base_image_release_override=True. Adding this case will lock the intended precedence contract in tests.

Suggested test addition

+        # OKD guard must still win even when CLI override is explicitly True
+        okd_override_runtime = MagicMock()
+        okd_override_runtime.logger = logging.getLogger('test_runtime')
+        okd_override_runtime.variant = BuildVariant.OKD
+        okd_override_runtime.assembly = 'stream'
+        okd_override_runtime.product = 'ocp'
+        okd_override_runtime.group_config = Model({})
+        okd_override_runtime.base_image_release_override = True
+        self.assertFalse(ImageMetadata(okd_override_runtime, base_data).should_trigger_base_image_release())

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@doozer/tests/test_image.py` around lines 1946 - 1966, Add a regression test
that asserts OKD still blocks base image release even when the CLI override is
True: create a MagicMock runtime similar to override_on_runtime but set variant
= BuildVariant.OKD, set group_config = Model({'base_image_release':
Model({'enabled': False})}) and base_image_release_override = True, then assert
ImageMetadata(<that runtime>, base_data).should_trigger_base_image_release() is
False; this targets the ImageMetadata.should_trigger_base_image_release()
behavior and ensures the override does not take precedence for OKD.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@doozer/tests/test_image.py`:
- Around line 1946-1966: Add a regression test that asserts OKD still blocks
base image release even when the CLI override is True: create a MagicMock
runtime similar to override_on_runtime but set variant = BuildVariant.OKD, set
group_config = Model({'base_image_release': Model({'enabled': False})}) and
base_image_release_override = True, then assert ImageMetadata(<that runtime>,
base_data).should_trigger_base_image_release() is False; this targets the
ImageMetadata.should_trigger_base_image_release() behavior and ensures the
override does not take precedence for OKD.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: cad1af52-88a6-450b-9535-93696985ddc2

📥 Commits

Reviewing files that changed from the base of the PR and between a06061e and 7f45b51.

📒 Files selected for processing (5)

• doozer/doozerlib/cli/images_konflux.py
• doozer/doozerlib/image.py
• doozer/doozerlib/runtime.py
• doozer/tests/test_image.py
• pyartcd/pyartcd/pipelines/update_golang.py

[openshift-ci]

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.