USHIFT-6074: Add support on releases scenarios to use artifacts from konflux

test/bin/scenario.sh

@@ -293,6 +293,94 @@ sos_report_for_vm_offline() {
         "--filename" "*.log"
 }
 
+get_lrel_release_image_url() {
+    local -r brew_lrel_release_version="$1"
+    local image_url=""
+
+    # Strip the rpm release suffix and convert tilde to dash.
+    # "4.19.7-202501010000.p0.gc62e92f.assembly.4.19.7.el9" -> "4.19.7"
+    # "4.20.0~rc.3-..."                                     -> "4.20.0-rc.3"
+    local release_version=""
+    release_version="$(echo "${brew_lrel_release_version}" \
+        | sed -E 's/(.*)-.*/\1/' \
+        | sed -E 's/(.*)~(.*)/\1-\2/')"
+
+    # EC and RC releases have their bootc pullspec published on the mirror.
+    local mirror_path=""
+    if [[ "${release_version}" == *"ec"* ]]; then
+        mirror_path="ocp-dev-preview"
+    elif [[ "${release_version}" == *"rc"* ]]; then
+        mirror_path="ocp"
+    fi
+
+    if [ -n "${mirror_path}" ]; then
+        if ! image_url="$(curl -fsS --retry 3 \
+            "https://mirror.openshift.com/pub/openshift-v4/${UNAME_M}/microshift/${mirror_path}/${release_version}/el9/bootc-pullspec.txt")"; then
+            image_url=""
+        fi
+        echo "${image_url}"
+        return
+    fi
+
+    # GA releases: resolve the arch-specific image digest from the registry.
+    local arch=""
+    if [[ "${UNAME_M}" =~ x86 ]]; then
+        arch="amd64"
+    elif [[ "${UNAME_M}" =~ aarch ]]; then
+        arch="arm64"
+    fi
+
+    # Resolve the arch-specific digest from both registries
+    local -r image_path="openshift4/microshift-bootc-rhel9"
+    local -r image_tag="v${release_version}"
+    local -r prod_registry="registry.redhat.io"
+    local -r stage_registry="registry.stage.redhat.io"
+
+    local prod_sha=""
+    local stage_sha=""
+    for registry in "${prod_registry}" "${stage_registry}"; do
+        local sha_id=""
+        if sha_id=$(skopeo inspect --raw --authfile "${PULL_SECRET}" \
+            "docker://${registry}/${image_path}:${image_tag}" 2>/dev/null | \
+            jq -r ".manifests[] | select(.platform.architecture==\"${arch}\") | .digest" 2>/dev/null); then
+            if [[ "${sha_id}" =~ ^sha256:[0-9a-f]{64}$ ]]; then
+                case "${registry}" in
+                    "${prod_registry}")  prod_sha="${sha_id}" ;;
+                    "${stage_registry}") stage_sha="${sha_id}" ;;
+                esac
+            fi
+        fi
+    done
+
+    # Select registry with the following priority:
+    # 1. stage with a newer digest (e.g., new z-stream not yet in prod)
+    # 2. stage when prod is unavailable (e.g., pre-GA release)
+    # 3. prod as fallback
+    local selected_registry=""
+    local reason=""
+    if [[ -n "${stage_sha}" && "${stage_sha}" != "${prod_sha}" ]]; then
+        selected_registry="${stage_registry}"
+        reason="digest differs from prod"
+    elif [[ -n "${stage_sha}" && -z "${prod_sha}" ]]; then
+        selected_registry="${stage_registry}"
+        reason="prod is unavailable"
+    elif [[ -n "${prod_sha}" ]]; then
+        selected_registry="${prod_registry}"
+        reason="fallback to prod"
+    fi
+
+    if [[ -n "${selected_registry}" ]]; then
+        local selected_sha
+        case "${selected_registry}" in
+            "${prod_registry}")  selected_sha="${prod_sha}" ;;
+            "${stage_registry}") selected_sha="${stage_sha}" ;;
+        esac
+        image_url="${selected_registry}/${image_path}@${selected_sha}"
+        echo "Selected registry: ${selected_registry} (${reason})"
+    fi
+    echo "${image_url}"
+}
+
 # Public function to render a unique kickstart from a template for a
 # VM in a scenario.
 #
@@ -415,6 +503,16 @@ exit_if_image_not_found() {
     fi
 }
 
+# Exit the script if the latest release image is not set.
+exit_if_image_not_set() {
+    local -r release_version="${1}"
+    if [[ "${release_version}" == "" ]] ; then
+        echo "Release version '${release_version}' is not set - VM can't be created"
+        record_junit "${release_version}" "build_vm_image_not_set" "SKIPPED"
+        exit 0
+    fi
+}
+
 # Show the IP address of the VM
 function get_vm_ip {
     local -r vmname="${1}"

test/scenarios-bootc/releases/el96-lrel@published-images-standard1.sh

@@ -0,0 +1,38 @@
+#!/bin/bash
+
+# Sourced from scenario.sh and uses functions defined there.
+
+# Enable container signature verification for published MicroShift images.
+# These are ec / rc / zstream, thus guaranteed to be signed.
+# shellcheck disable=SC2034  # used elsewhere
+IMAGE_SIGSTORE_ENABLED=true
+
+LATEST_RELEASE_IMAGE_URL="$(get_lrel_release_image_url "${BREW_LREL_RELEASE_VERSION}")"
+
+scenario_create_vms() {
+    exit_if_image_not_set "${LATEST_RELEASE_IMAGE_URL}"
+
+    prepare_kickstart host1 kickstart-bootc.ks.template "${LATEST_RELEASE_IMAGE_URL}"
+    launch_vm --boot_blueprint rhel96-bootc
+
+    # Open the firewall ports. Other scenarios get this behavior by embedding
+    # settings in the blueprint, but we cannot open firewall ports in published
+    # images. We need to do this step before running the RF suite so that suite
+    # can assume it can reach all of the same ports as for any other test.
+    configure_vm_firewall host1
+}
+
+scenario_remove_vms() {
+    exit_if_image_not_set "${LATEST_RELEASE_IMAGE_URL}"
+
+    remove_vm host1
+}
+
+scenario_run_tests() {
+    exit_if_image_not_set "${LATEST_RELEASE_IMAGE_URL}"
+
+    run_tests host1 \
+        --variable "EXPECTED_OS_VERSION:9.6" \
+        --variable "IMAGE_SIGSTORE_ENABLED:True" \
+        suites/standard1/
+}

test/scenarios-bootc/releases/el96-lrel@published-images-standard2.sh

@@ -0,0 +1,37 @@
+#!/bin/bash
+
+# Sourced from scenario.sh and uses functions defined there.
+
+# Enable container signature verification for published MicroShift images.
+# These are ec / rc / zstream, thus guaranteed to be signed.
+# shellcheck disable=SC2034  # used elsewhere
+IMAGE_SIGSTORE_ENABLED=true
+
+LATEST_RELEASE_IMAGE_URL="$(get_lrel_release_image_url "${BREW_LREL_RELEASE_VERSION}")"
+
+scenario_create_vms() {
+    exit_if_image_not_set "${LATEST_RELEASE_IMAGE_URL}"
+
+    prepare_kickstart host1 kickstart-bootc.ks.template "${LATEST_RELEASE_IMAGE_URL}"
+    launch_vm --boot_blueprint rhel96-bootc
+
+    # Open the firewall ports. Other scenarios get this behavior by embedding
+    # settings in the blueprint, but we cannot open firewall ports in published
+    # images. We need to do this step before running the RF suite so that suite
+    # can assume it can reach all of the same ports as for any other test.
+    configure_vm_firewall host1
+}
+
+scenario_remove_vms() {
+    exit_if_image_not_set "${LATEST_RELEASE_IMAGE_URL}"
+
+    remove_vm host1
+}
+
+scenario_run_tests() {
+    exit_if_image_not_set "${LATEST_RELEASE_IMAGE_URL}"
+
+    run_tests host1 \
+        --variable "IMAGE_SIGSTORE_ENABLED:True" \
+        suites/standard2/
+}