Switch to CentOS Stream 10 IPA images on Rocky 10

[owenjones]

CentOS Stream 10 IPA images are now working - image building workflow has been updated to enable building images and pulp tags and IPA pulp tag selection updated to make use of these new images rather than CentOS Stream 9 images as are currently used.

IPA images built on Rocky 10 are still a WIP - ironic-python-agent-builder doesn't support yet.

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: b437e0c9-d06f-44fe-8d24-5d2e1d58e08a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Update Rocky Linux 10 configuration to use CentOS Stream 10 IPA images. Add Rocky Linux 10 image build and promotion workflows, Pulp version tags, and separate Rocky Linux 9 and 10 image selection. Document upstream support for building these images.

Walkthrough

The workflows now build and promote Rocky Linux 10 IPA images for x86_64 and aarch64. Kayobe configuration selects release- and architecture-specific image versions and URLs. A release note documents CentOS Stream 10 image support.

Changes

Rocky Linux 10 IPA image pipeline

Layer / File(s)	Summary
Build inputs and runner setup .github/workflows/ipa-image-build.yml	The build workflow adds Rocky Linux 10 inputs, validates selections and SMS Lab restrictions, and uses fixed Ubuntu 24.04 runners with container tooling.
Rocky Linux 10 x86_64 build .github/workflows/ipa-image-build.yml	The x86_64 job builds Rocky Linux 10 images, uploads kernel and ramdisk artifacts, collects logs, and reports failures.
Rocky Linux 10 aarch64 build .github/workflows/ipa-image-build.yml	The aarch64 job builds Rocky Linux 10 images, uploads architecture-specific artifacts, collects logs, and reports failures.
Promotion and image selection .github/workflows/ipa-image-promote.yml, etc/kayobe/pulp-ipa-image-versions.yml, etc/kayobe/stackhpc-ipa-images.yml, releasenotes/notes/centos-stream-10-ipa-dde5cf23f432b541.yaml	The promotion workflow adds Rocky Linux 10 selections and promotion steps. Kayobe selects Rocky 9 or 10 image versions by architecture and constructs URLs from os_release. The release note records CentOS Stream 10 support.

Estimated code review effort: 3 (Moderate) | ~30 minutes

Sequence Diagram(s)

sequenceDiagram
  participant BuildWorkflow as ipa-image-build.yml
  participant X86Builder as x86_64 builder
  participant ArmBuilder as aarch64 builder
  participant ImageRepository as IPA image repository
  BuildWorkflow->>X86Builder: Build Rocky Linux 10 x86_64 image
  BuildWorkflow->>ArmBuilder: Build Rocky Linux 10 aarch64 image
  X86Builder->>ImageRepository: Upload kernel and ramdisk artifacts
  ArmBuilder->>ImageRepository: Upload kernel and ramdisk artifacts
  BuildWorkflow->>BuildWorkflow: Report build failures and collect logs

Loading

Possibly related PRs

• stackhpc/stackhpc-kayobe-config#2457: Both changes update Rocky/CentOS 10 IPA image configuration.
• stackhpc/stackhpc-kayobe-config#2458: Both changes update IPA image build and promotion workflows for Rocky Linux 10.

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 7e905c06-9ab3-43b4-b6c8-cff275c4d78a

📥 Commits

Reviewing files that changed from the base of the PR and between c6f8222 and 442347c.

📒 Files selected for processing (5)

• .github/workflows/ipa-image-build.yml
• .github/workflows/ipa-image-promote.yml
• etc/kayobe/pulp-ipa-image-versions.yml
• etc/kayobe/stackhpc-ipa-images.yml
• releasenotes/notes/centos-stream-10-ipa-dde5cf23f432b541.yaml

📜 Review details

⏰ Context from checks skipped due to timeout. (3)

• GitHub Check: stackhpc/check
• GitHub Check: Ansible 2.17 lint with Python 3.10
• GitHub Check: Ansible 2.18 lint with Python 3.12

🧰 Additional context used

🪛 zizmor (1.29.0)

.github/workflows/ipa-image-promote.yml

[warning] 41-41: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

---

[warning] 42-42: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

---

[warning] 43-43: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

---

[warning] 44-44: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

---

[warning] 45-45: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

---

[info] 139-139: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

---

[info] 140-140: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

.github/workflows/ipa-image-build.yml

[warning] 68-68: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

---

[warning] 69-69: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

---

[warning] 70-70: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

---

[warning] 71-71: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

---

[warning] 72-72: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

---

[warning] 79-79: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

---

[warning] 79-79: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

---

[warning] 80-80: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

---

[info] 420-420: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

---

[info] 436-436: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

---

[info] 736-736: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

---

[info] 737-737: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

---

[info] 738-738: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

---

[info] 754-754: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

---

[info] 755-755: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

---

[info] 756-756: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

🔇 Additional comments (6)

.github/workflows/ipa-image-promote.yml (3)

14-21: LGTM!

---

119-138: LGTM!

Also applies to: 141-145

---

43-44: 🔒 Security & Privacy

Keep dispatch inputs out of shell source.

Direct interpolation permits shell expansion. Pass rocky10 and rocky10-aarch64 through env before comparison. GitHub documentation does not establish whether the dispatch API rejects arbitrary strings, so confirm this validation behaviour.

etc/kayobe/pulp-ipa-image-versions.yml (1)

5-6: 🗄️ Data Integrity & Integration

Verify the Rocky Linux 10 image tags before deployment.

Lines 5-6 hard-code 2025.1-20260805T091024, while the build workflow publishes with needs.create-tag.outputs.ipa_image_tag. Confirm that the output matches this value and that both rocky/10 and rocky/10/aarch64 Pulp paths are promoted. Otherwise, etc/kayobe/stackhpc-ipa-images.yml Lines 17-20 can resolve to missing image URLs.

etc/kayobe/stackhpc-ipa-images.yml (1)

17-20: LGTM!

Also applies to: 23-28

releasenotes/notes/centos-stream-10-ipa-dde5cf23f432b541.yaml (1)

1-6: LGTM!

[Alex-Welsh]

Merge Failed.
This change or one of its cross-repo dependencies was unable to be automatically merged with the current state of its repository. Please rebase the change and upload a new patchset.

Odd. Might just be zuul having a funny 5

[Alex-Welsh]

recheck merge failed