fix(e2e): migrate test image registry from ttl.sh to quay by tommyd450 · Pull Request #2178 · securesign/secure-sign-operator

tommyd450 · 2026-08-04T09:24:09Z

Adding support to push to our own quay repo. For the moment I have set my own repo and used my own service account for this test.

qodo-for-securesign · 2026-08-04T09:25:39Z

PR Summary by Qodo

Use Quay auth for e2e image pushes and in-cluster cosign signing

🧪 Tests ⚙️ Configuration changes ✨ Enhancement 🕐 20-40 Minutes

AI Description

• Authenticate CI jobs to quay.io and standardize DOCKER_CONFIG usage for e2e runs.
• Publish e2e test images to quay.io with an expiry label, replacing ttl.sh dependency.
• Mount registry credentials into in-cluster cosign jobs to enable signing/verification against
 Quay.

Diagram

graph TD
  A["GitHub Actions workflow"] --> B["podman-login (quay.io)"] --> C["E2E test runner"] --> D["go-containerregistry push"] --> E{{"quay.io registry"}}
  C --> F[("registry-auth Secret")]
  F --> G["In-cluster cosign Job"] --> E

  subgraph Legend
    direction LR
    _wf["CI / Step"] ~~~ _k8s[("K8s resource")] ~~~ _ext{{"External"}}
  end

High-Level Assessment

The following are alternative approaches to this PR:

1. Run a local ephemeral registry inside CI (Kind)

➕ Avoids external registry availability/rate limits
➕ No need to manage Quay credentials in CI secrets
➖ More moving parts in CI (registry deployment, networking, cleanup)
➖ May not match real-world registry auth/signing paths

2. Use GHCR for e2e images

➕ First-class integration with GitHub Actions (GITHUB_TOKEN)
➕ Often simpler credential management than external registries
➖ May not align with project’s desired distribution registry
➖ Org/package permissions can be tricky for forks and PRs

3. Keep ttl.sh but isolate registry-dependent tests

➕ No credentials required
➕ Very simple for ephemeral test artifacts
➖ Reintroduces reliance on ttl.sh availability/behavior
➖ TTL semantics may still be a source of flakes

Recommendation: Proceed with the Quay-based approach, but ensure credentials are project-owned (e.g., a Quay robot/service account scoped to the e2e repository) rather than a personal account. This PR’s strategy (standardize DOCKER_CONFIG in CI, reuse that config to create a K8s Secret for in-cluster cosign) is cohesive and keeps registry auth behavior consistent across local pushes and in-cluster signing.

Files changed (4) +152 / -14

Enhancement (2) +95 / -12

common.goPush e2e images to Quay with expiry metadata and auth support +43/-2

Push e2e images to Quay with expiry metadata and auth support

• Replaces ttl.sh image publishing with quay.io/securesign/e2e-tests and adds a quay expiration label to the image config. Switches the remote pusher to use the default keychain and adds a helper to create a dockerconfigjson Secret from DOCKER_CONFIG (or ~/.docker).

test/e2e/support/common.go

cosign_inCluster.goAdd optional registry auth Secret mounting for cosign Job +52/-10

Add optional registry auth Secret mounting for cosign Job
• Introduces an option pattern to configure a registry auth Secret for the in-cluster cosign runner. When provided, the Secret is mounted and DOCKER_CONFIG is set so cosign can authenticate to Quay during sign/verify operations.
test/e2e/support/tas/cosign/cosign_inCluster.go

Tests (1) +7 / -1

cluster_internal_test.goCreate registry auth Secret and pass it to in-cluster cosign +7/-1

Create registry auth Secret and pass it to in-cluster cosign
• Creates a Kubernetes dockerconfigjson Secret before the suite runs. Updates the in-cluster cosign helper construction to mount that Secret for authenticated registry access.
test/e2e/install/cluster_internal_test.go

Other (1) +50 / -1

main.ymlLog into quay.io and propagate DOCKER_CONFIG for e2e jobs +50/-1

Log into quay.io and propagate DOCKER_CONFIG for e2e jobs
• Adds quay.io authentication steps using podman-login across multiple CI jobs. Sets DOCKER_CONFIG=/tmp for test steps so Go tooling and in-cluster flows can reuse the generated auth file.
.github/workflows/main.yml

qodo-for-securesign · 2026-08-04T09:29:27Z

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Full docker config exfiltration 🐞 Bug ⛨ Security ⭐ New

Description

CreateRegistryAuthSecret copies the entire local docker config.json into a Kubernetes Secret and
the in-cluster cosign job consumes it via DOCKER_CONFIG, unnecessarily expanding credential exposure
to the test namespace/pod beyond the single registry actually needed.

Code

test/e2e/support/common.go[R171-174]

+		Type: v1.SecretTypeDockerConfigJson,
+		Data: map[string][]byte{
+			v1.DockerConfigJsonKey: data,
+		},

Relevance

●● Moderate
Security concern but no close precedent on dockerconfigjson exfiltration; fix may require nontrivial
auth scoping changes.
PR-#2015

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The helper reads raw bytes from config.json and stores them as the Secret’s .dockerconfigjson; the
cosign job mounts that Secret and sets DOCKER_CONFIG to point at the mounted directory, so the job
consumes the full copied config.

test/e2e/support/common.go[159-176]
test/e2e/support/tas/cosign/cosign_inCluster.go[111-132]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`CreateRegistryAuthSecret` reads and stores the entire local `config.json` as `.dockerconfigjson`, which may include unrelated registry credentials and other settings. That full file is then mounted into the cosign job and used as `DOCKER_CONFIG`.

## Issue Context
This is a least-privilege violation: the test only needs credentials for the target registry (e.g., quay.io), but it uploads and exposes everything present in the developer/CI docker config.

## Fix Focus Areas
- test/e2e/support/common.go[161-176]
- test/e2e/support/tas/cosign/cosign_inCluster.go[111-132]

### Suggested approach
- Parse the docker config JSON and write a reduced config containing only the required `auths["quay.io"]` entry (or the specific registry under test).
- Alternatively, generate a dedicated docker config file in CI and only ever read from that dedicated file for creating the Secret (avoid reusing the developer’s entire config).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

2. ~~E2E Quay auth hard-requirement~~ ✓ Resolved 🐞 Bug ☼ Reliability

Description

PrepareImage now pushes a randomly generated image to quay.io/securesign/e2e-tests and will
panic if the authenticated push fails (e.g., missing Quay credentials / missing Docker-style
config.json for authn.DefaultKeychain). This breaks the default local make test-e2e path because
it doesn’t set TEST_IMAGE (to bypass pushing) and doesn’t set up DOCKER_CONFIG/credentials for
the keychain-based push.

Code

test/e2e/support/common.go[R132-135]

+	targetImageName := fmt.Sprintf("quay.io/securesign/e2e-tests:%s", uuid.New().String())
	ref, err := name.ParseReference(targetImageName)
	if err != nil {
		panic(err.Error())

Relevance

●●● Strong
Team tends to keep e2e runnable across environments; hard-required Quay auth breaks
local/non-configured runs.
PR-#2015
PR-#1779

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The new hard-coded Quay target plus keychain-based auth means each e2e run must successfully perform
an authenticated registry push; failures are converted into panics. The repo’s default e2e make
target doesn’t provide TEST_IMAGE (to avoid pushing) nor any credential setup, while CI explicitly
sets DOCKER_CONFIG for the test step, showing that the Quay push path depends on that
configuration.

test/e2e/support/common.go[113-147]
Makefile[132-136]
.github/workflows/main.yml[288-294]
test/e2e/install/common_install_test.go[72-74]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`test/e2e/support.PrepareImage` now always pushes a new random image to a hard-coded Quay repo and panics on push errors. This makes the e2e test suite non-runnable in environments without Quay push credentials and a Docker-style `config.json` readable by `authn.DefaultKeychain`.

## Issue Context
- CI sets `DOCKER_CONFIG=/tmp` for test steps so `authn.DefaultKeychain` can discover the auth file created by `podman-login`.
- The default local `make test-e2e` target does not set `TEST_IMAGE` and does not configure `DOCKER_CONFIG`.

## Fix Focus Areas
- test/e2e/support/common.go[113-147]
- Makefile[132-136]
- .github/workflows/main.yml[288-294]

## Suggested remediation (pick one)
1) **Configurable registry + clear failure mode**
  - Add env overrides such as `TEST_IMAGE_REPO` (defaulting to `ttl.sh/<uuid>:15m` or another anonymous registry) and/or `TEST_IMAGE_LABEL_EXPIRES_AFTER`.
  - Before pushing to Quay, detect missing auth (or missing `DOCKER_CONFIG`) and return a descriptive error (or `ginkgo.Skip`) instructing users to set `TEST_IMAGE`.
  - Avoid `panic`; return `(string, error)` from `PrepareImage` and handle it in callers.

2) **Keep Quay for CI, fallback for local**
  - If `support.IsCIEnvironment()` is false and `TEST_IMAGE` is unset, fallback to the previous `ttl.sh` path (or another local-friendly approach).

3) **Document and wire local-friendly defaults**
  - Update `make test-e2e` to require/provide `TEST_IMAGE` or to export `DOCKER_CONFIG` and document the need for `docker login quay.io` (Docker config, not Podman auth.json).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}

Previous review results

Review updated until commit be782a0

Results up to commit ce452eb ⚖️ Balanced

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. ~~E2E Quay auth hard-requirement~~ ✓ Resolved 🐞 Bug ☼ Reliability

Description

PrepareImage now pushes a randomly generated image to quay.io/securesign/e2e-tests and will
panic if the authenticated push fails (e.g., missing Quay credentials / missing Docker-style
config.json for authn.DefaultKeychain). This breaks the default local make test-e2e path because
it doesn’t set TEST_IMAGE (to bypass pushing) and doesn’t set up DOCKER_CONFIG/credentials for
the keychain-based push.

Code

test/e2e/support/common.go[R132-135]

+	targetImageName := fmt.Sprintf("quay.io/securesign/e2e-tests:%s", uuid.New().String())
	ref, err := name.ParseReference(targetImageName)
	if err != nil {
		panic(err.Error())

Relevance

●●● Strong
Team tends to keep e2e runnable across environments; hard-required Quay auth breaks
local/non-configured runs.
PR-#2015
PR-#1779

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The new hard-coded Quay target plus keychain-based auth means each e2e run must successfully perform
an authenticated registry push; failures are converted into panics. The repo’s default e2e make
target doesn’t provide TEST_IMAGE (to avoid pushing) nor any credential setup, while CI explicitly
sets DOCKER_CONFIG for the test step, showing that the Quay push path depends on that
configuration.

test/e2e/support/common.go[113-147]
Makefile[132-136]
.github/workflows/main.yml[288-294]
test/e2e/install/common_install_test.go[72-74]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`test/e2e/support.PrepareImage` now always pushes a new random image to a hard-coded Quay repo and panics on push errors. This makes the e2e test suite non-runnable in environments without Quay push credentials and a Docker-style `config.json` readable by `authn.DefaultKeychain`.

## Issue Context
- CI sets `DOCKER_CONFIG=/tmp` for test steps so `authn.DefaultKeychain` can discover the auth file created by `podman-login`.
- The default local `make test-e2e` target does not set `TEST_IMAGE` and does not configure `DOCKER_CONFIG`.

## Fix Focus Areas
- test/e2e/support/common.go[113-147]
- Makefile[132-136]
- .github/workflows/main.yml[288-294]

## Suggested remediation (pick one)
1) **Configurable registry + clear failure mode**
  - Add env overrides such as `TEST_IMAGE_REPO` (defaulting to `ttl.sh/<uuid>:15m` or another anonymous registry) and/or `TEST_IMAGE_LABEL_EXPIRES_AFTER`.
  - Before pushing to Quay, detect missing auth (or missing `DOCKER_CONFIG`) and return a descriptive error (or `ginkgo.Skip`) instructing users to set `TEST_IMAGE`.
  - Avoid `panic`; return `(string, error)` from `PrepareImage` and handle it in callers.

2) **Keep Quay for CI, fallback for local**
  - If `support.IsCIEnvironment()` is false and `TEST_IMAGE` is unset, fallback to the previous `ttl.sh` path (or another local-friendly approach).

3) **Document and wire local-friendly defaults**
  - Update `make test-e2e` to require/provide `TEST_IMAGE` or to export `DOCKER_CONFIG` and document the need for `docker login quay.io` (Docker config, not Podman auth.json).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

codecov-commenter · 2026-08-04T09:30:05Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 56.94%. Comparing base (0174d24) to head (be782a0).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2178      +/-   ##
==========================================
+ Coverage   56.67%   56.94%   +0.27%     
==========================================
  Files         287      287              
  Lines       16251    16251              
==========================================
+ Hits         9210     9254      +44     
+ Misses       6080     6044      -36     
+ Partials      961      953       -8

Flag	Coverage Δ
e2e	`69.64% <ø> (+1.04%)`	⬆️
unit	`35.67% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

tommyd450 · 2026-08-04T14:40:58Z

/tests

tommyd450 · 2026-08-04T16:49:04Z

/retest

tommyd450 · 2026-08-04T19:13:31Z

/retest

tommyd450 · 2026-08-04T21:04:33Z

/retest

tommyd450 · 2026-08-05T08:01:31Z

/retest

qodo-for-securesign · 2026-08-05T08:03:13Z

Code review by qodo was updated up to the latest commit f36cf81

tommyd450 · 2026-08-05T08:04:31Z

/retest

tommyd450 · 2026-08-05T10:22:04Z

/retest

tommyd450 · 2026-08-05T10:36:12Z

/retest

osmman

You need to squash the commit history down to one commit before I can approve it. The intermediate fixes clutter up the main branch history.

tommyd450 · 2026-08-05T10:57:29Z

/retest

tommyd450 · 2026-08-05T12:03:18Z

/retest

tommyd450 · 2026-08-05T12:09:29Z

This hopefully should resolve e2e issues we have been having using ttl.sh. Test Images are now hopefully fully unique

Push e2e test images to the e2e-tests quay repo with unique tags per test run. For Konflux cluster runs, the quay secret is stored on-cluster and referenced in pipelines. For GitHub Actions, the secret is ingested from the repo secrets in workflows.

tommyd450 marked this pull request as draft August 4, 2026 09:24

tommyd450 requested a review from osmman August 4, 2026 14:36

tommyd450 force-pushed the tdalton/mainTTL.sh branch from 535f448 to f36cf81 Compare August 5, 2026 07:51

tommyd450 marked this pull request as ready for review August 5, 2026 07:58

petrpinkas approved these changes Aug 5, 2026

View reviewed changes

osmman requested changes Aug 5, 2026

View reviewed changes

Comment thread test/e2e/support/common.go

tommyd450 force-pushed the tdalton/mainTTL.sh branch 2 times, most recently from 12b9693 to a10b925 Compare August 5, 2026 12:08

tommyd450 force-pushed the tdalton/mainTTL.sh branch from a10b925 to b3be8e0 Compare August 5, 2026 12:19

tommyd450 force-pushed the tdalton/mainTTL.sh branch from b3be8e0 to be782a0 Compare August 5, 2026 12:24

osmman changed the title ~~Testing WIP fix for TTL dependency.~~ fix(e2e): migrate test image registry from ttl.sh to quay Aug 5, 2026

osmman merged commit 4c2af50 into main Aug 5, 2026
11 of 17 checks passed

osmman deleted the tdalton/mainTTL.sh branch August 5, 2026 12:26

Uh oh!

Conversation

tommyd450 commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

qodo-for-securesign Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary by Qodo

Uh oh!

qodo-for-securesign Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review by Qodo

Previous review results

Uh oh!

codecov-commenter commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

tommyd450 commented Aug 4, 2026

Uh oh!

tommyd450 commented Aug 4, 2026

Uh oh!

tommyd450 commented Aug 4, 2026

Uh oh!

tommyd450 commented Aug 4, 2026

Uh oh!

tommyd450 commented Aug 5, 2026

Uh oh!

qodo-for-securesign Bot commented Aug 5, 2026

Uh oh!

tommyd450 commented Aug 5, 2026

Uh oh!

tommyd450 commented Aug 5, 2026

Uh oh!

tommyd450 commented Aug 5, 2026

Uh oh!

osmman left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

tommyd450 commented Aug 5, 2026

Uh oh!

tommyd450 commented Aug 5, 2026

Uh oh!

tommyd450 commented Aug 5, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

tommyd450 commented Aug 4, 2026 •

edited

Loading

qodo-for-securesign Bot commented Aug 4, 2026 •

edited

Loading

qodo-for-securesign Bot commented Aug 4, 2026 •

edited

Loading

codecov-commenter commented Aug 4, 2026 •

edited

Loading