From bd52d4389edac6c14377d63ac3471e56039cd515 Mon Sep 17 00:00:00 2001 From: cuipinghuo Date: Thu, 23 Jul 2026 10:14:59 -0400 Subject: [PATCH] fix(EC-1994): correct off-by-one in validate image worker loop MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The worker loop used <= instead of <, spawning numWorkers+1 goroutines instead of the intended numWorkers. Bump task defaults to preserve the effective concurrency users had before the fix: - verify-conforma-konflux-ta: 4 → 5 - verify-enterprise-contract: 1 → 2 Co-Authored-By: Claude Opus 4.6 (1M context) --- cmd/validate/image.go | 2 +- docs/modules/ROOT/pages/verify-conforma-konflux-ta.adoc | 2 +- docs/modules/ROOT/pages/verify-enterprise-contract.adoc | 2 +- tasks/verify-conforma-konflux-ta/0.1/README.md | 2 +- .../0.1/verify-conforma-konflux-ta.yaml | 2 +- tasks/verify-enterprise-contract/0.1/README.md | 2 +- .../0.1/verify-enterprise-contract.yaml | 2 +- 7 files changed, 7 insertions(+), 7 deletions(-) diff --git a/cmd/validate/image.go b/cmd/validate/image.go index 8fb17e8f2..52a726395 100644 --- a/cmd/validate/image.go +++ b/cmd/validate/image.go @@ -400,7 +400,7 @@ func validateImageCmd(validate imageValidationFunc) *cobra.Command { results := make(chan validate_utils.Result, numComponents) // Initialize each worker. They will wait patiently until a job is sent to the jobs // channel, or the jobs channel is closed. - for i := 0; i <= numWorkers; i++ { + for i := 0; i < numWorkers; i++ { go worker(i, jobs, results) } // Initialize all the jobs. Each worker will pick a job from the channel when the worker diff --git a/docs/modules/ROOT/pages/verify-conforma-konflux-ta.adoc b/docs/modules/ROOT/pages/verify-conforma-konflux-ta.adoc index dd90b8a28..7d624e82d 100644 --- a/docs/modules/ROOT/pages/verify-conforma-konflux-ta.adoc +++ b/docs/modules/ROOT/pages/verify-conforma-konflux-ta.adoc @@ -64,7 +64,7 @@ paths can be provided by using the `:` separator. *WORKERS* (`string`):: Number of parallel workers to use for policy evaluation. + -*Default*: `4` +*Default*: `5` *EC_USE_OPA* (`string`):: Use the OPA evaluator instead of the default conftest evaluator. Set to "1" to enable. *SINGLE_COMPONENT* (`string`):: Reduce the Snapshot to only the component whose build caused the Snapshot to be created + diff --git a/docs/modules/ROOT/pages/verify-enterprise-contract.adoc b/docs/modules/ROOT/pages/verify-enterprise-contract.adoc index 339e27908..12eb86ea6 100644 --- a/docs/modules/ROOT/pages/verify-enterprise-contract.adoc +++ b/docs/modules/ROOT/pages/verify-enterprise-contract.adoc @@ -74,7 +74,7 @@ paths can be provided by using the `:` separator. *Default*: `sha256:f904979d405a39a3cc492439b379b4b117c622bbe7126a0e1ba76527ec3ce6a2` *WORKERS* (`string`):: Number of parallel workers to use for policy evaluation. + -*Default*: `1` +*Default*: `2` *EC_USE_OPA* (`string`):: Use the OPA evaluator instead of the default conftest evaluator. Set to "1" to enable. *SINGLE_COMPONENT* (`string`):: Reduce the Snapshot to only the component whose build caused the Snapshot to be created + diff --git a/tasks/verify-conforma-konflux-ta/0.1/README.md b/tasks/verify-conforma-konflux-ta/0.1/README.md index 5fda36c63..1155b50cb 100644 --- a/tasks/verify-conforma-konflux-ta/0.1/README.md +++ b/tasks/verify-conforma-konflux-ta/0.1/README.md @@ -31,7 +31,7 @@ kubectl apply -f https://raw.githubusercontent.com/conforma/cli/main/tasks/verif * **HOMEDIR**: Value for the HOME environment variable. (default: "/tekton/home") * **EFFECTIVE_TIME**: Run policy checks with the provided time. (default: "now") * **EXTRA_RULE_DATA**: Merge additional Rego variables into the policy data. Use syntax "key=value,key2=value2..." (default: "") -* **WORKERS**: Number of parallel workers to use for policy evaluation. This parameter is currently not used. All policy evaluations are run with 35 workers. (default: "35") +* **WORKERS**: Number of parallel workers to use for policy evaluation. Note: managed release pipelines in `release-service-catalog` override this to 35 via `conforma.workerCount` in `konflux-release-data`. (default: "5") * **SINGLE_COMPONENT**: Reduce the Snapshot to only the component whose build caused the Snapshot to be created (default: "false") * **SINGLE_COMPONENT_CUSTOM_RESOURCE**: Name, including kind, of the Kubernetes resource to query for labels when single component mode is enabled, e.g. pr/somepipeline. (default: "unknown") * **SINGLE_COMPONENT_CUSTOM_RESOURCE_NS**: Kubernetes namespace where the SINGLE_COMPONENT_NAME is found. Only used when single component mode is enabled. (default: "") diff --git a/tasks/verify-conforma-konflux-ta/0.1/verify-conforma-konflux-ta.yaml b/tasks/verify-conforma-konflux-ta/0.1/verify-conforma-konflux-ta.yaml index c4e68d677..08e117bb1 100644 --- a/tasks/verify-conforma-konflux-ta/0.1/verify-conforma-konflux-ta.yaml +++ b/tasks/verify-conforma-konflux-ta/0.1/verify-conforma-konflux-ta.yaml @@ -177,7 +177,7 @@ spec: type: string description: > Number of parallel workers to use for policy evaluation. - default: "4" + default: "5" - name: EC_USE_OPA type: string diff --git a/tasks/verify-enterprise-contract/0.1/README.md b/tasks/verify-enterprise-contract/0.1/README.md index 358bb1fed..70f6133ef 100644 --- a/tasks/verify-enterprise-contract/0.1/README.md +++ b/tasks/verify-enterprise-contract/0.1/README.md @@ -40,7 +40,7 @@ kubectl apply -f https://raw.githubusercontent.com/conforma/cli/main/tasks/verif * **HOMEDIR**: Value for the HOME environment variable. (default: "/tekton/home") * **EFFECTIVE_TIME**: Run policy checks with the provided time. (default: "now") * **EXTRA_RULE_DATA**: Merge additional Rego variables into the policy data. Use syntax "key=value,key2=value2..." (default: "") -* **WORKERS**: Number of parallel workers to use for policy evaluation. (default: "1") +* **WORKERS**: Number of parallel workers to use for policy evaluation. (default: "2") * **SINGLE_COMPONENT**: Reduce the Snapshot to only the component whose build caused the Snapshot to be created (default: "false") * **SINGLE_COMPONENT_CUSTOM_RESOURCE**: Name, including kind, of the Kubernetes resource to query for labels when single component mode is enabled, e.g. pr/somepipeline. (default: "unknown") * **SINGLE_COMPONENT_CUSTOM_RESOURCE_NS**: Kubernetes namespace where the SINGLE_COMPONENT_NAME is found. Only used when single component mode is enabled. (default: "") diff --git a/tasks/verify-enterprise-contract/0.1/verify-enterprise-contract.yaml b/tasks/verify-enterprise-contract/0.1/verify-enterprise-contract.yaml index b5282ebe6..3ba08a4fb 100644 --- a/tasks/verify-enterprise-contract/0.1/verify-enterprise-contract.yaml +++ b/tasks/verify-enterprise-contract/0.1/verify-enterprise-contract.yaml @@ -183,7 +183,7 @@ spec: - name: WORKERS type: string description: Number of parallel workers to use for policy evaluation. - default: "1" + default: "2" - name: EC_USE_OPA type: string