[mclasmeier]

Summary

• LookupMainImageTag / LookupLatestTag hardcoded constants.DefaultRegistry when verifying whether a release tag has a pullable image, ignoring roxie.imageRegistry
• This caused --set roxie.imageRegistry=quay.io/stackrox-io to have no effect when no explicit --tag was set: roxie would try to verify the image against quay.io/rhacs-eng and fail with 401 in case no pull secrets are available
• Thread the configured image registry through to the tag lookup functions so verification hits the correct registry

Before this fix

❯ HOME=/tmp/empty-docker-auth ./roxie deploy central --set roxie.imageRegistry=quay.io/stackrox-io
00:00 Using kubeconfig /Users/mclasmeier/.kube/infra/kubeconfig
00:00 Running with a controlling terminal.
00:01 No existing manifest found on cluster, starting from defaults
00:01 Checking if main image tag is defined in the environment
00:01 Checking if current working directory is checkout of stackrox/stackrox repository
00:01 Repository does not seem to be a clone of https://github.com/stackrox/stackrox, based on the configured git remotes
00:01 No tag specified and no MAIN_IMAGE_TAG found in the environment, looking up latest release tag on registry
00:01 To use a different tag, use `--tag` or set the MAIN_IMAGE_TAG environment variable
00:01 Alternatively, execute roxie from within the stackrox repository, in which case the currently checked out stackrox tag will be used
00:01 Checking what the latest released version tag is
00:02 Inspecting image quay.io/rhacs-eng/main:4.11.6
Error: looking up main image tag: looking up latest release tag: verifying image quay.io/rhacs-eng/main:4.11.6: image inspection failed: HEAD https://quay.io/v2/rhacs-eng/main/manifests/4.11.6: unexpected status code 401 Unauthorized (HEAD responses have no body, use GET for details)

Summary by CodeRabbit

• Bug Fixes
  • Deployments now resolve the latest image tag from the configured image registry. When no registry is configured, the default registry is used. This helps ensure the selected image tag matches the registry used for deployment.

[coderabbitai]

Walkthrough

Tag lookup now accepts an image registry and uses it to check candidate release images. If the registry is empty, lookup uses the default registry. Deploy passes its configured registry, and test callers pass an empty value.

Changes: Registry-aware release tag lookup

Layer / File(s)	Summary
Registry selection and caller updates internal/helpers/tag.go, cmd/deploy.go, internal/helpers/tag_integration_test.go, tests/e2e/e2e_test.go	LookupMainImageTag and LookupLatestTag accept a registry argument. LookupLatestTag uses the default registry when the argument is empty. Deploy passes its configured image registry, and existing test callers pass an empty value.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: porridge

Merge Risk: Minimal · up to dc529

Release tag lookup now checks the registry the user configured instead of always checking the default one. This removes the 401 failure when only a custom registry is set. No concrete merge-blocking risk was established.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 25.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documenta…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: using the configured image registry when discovering the main image.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 25.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 4 functions across 4 files.

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

Finishing Touches

Generate docstrings

• Commit to this branch
• Create a new PR

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.

[coderabbitai]

Additional comments: 1

internal/helpers/tag.go-65-65: 1

65-65: Major · Security & Privacy · Heavy lift

Unverified finding
Verification ran but could not confirm this finding. It is shown for review, not as a verified issue.

Scope environment credentials before querying a custom registry.

If REGISTRY_USERNAME and REGISTRY_PASSWORD contain Quay credentials, a lookup against another registry can send those credentials to that host. internal/ocihelper/keychain.go Line 17 ignores the target when it resolves environment credentials, and VerifyImageExistence uses that keychain. This lookup also runs during a dry run. (github.com)

Scope environment credentials to their intended registry and use host-specific credentials for other registries.

Review info

Run configuration

• Source mode: Auto
• Repository: stackrox/roxie
• Branch: mc/image-registry-auto-discovery
• File: .coderabbit.yml
• Commit: dc52957
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: bdcac6bd-4cb7-4265-ba5b-c96bde357035

Commits

Reviewing files that changed from the base of the PR and between 715b502 and dc52957.

Files selected for processing: 4

• cmd/deploy.go
• internal/helpers/tag.go
• internal/helpers/tag_integration_test.go
• tests/e2e/e2e_test.go

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.