Skip to content

fix(EC-1994): correct off-by-one in validate image worker loop #3425

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
cuipinghuo wants to merge 1 commit into
base: main
Choose a base branch
from
+7 −7
Open

fix(EC-1994): correct off-by-one in validate image worker loop #3425

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion cmd/validate/image.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -400,7 +400,7 @@ func validateImageCmd(validate imageValidationFunc) *cobra.Command {
results := make(chan validate_utils.Result, numComponents)
// Initialize each worker. They will wait patiently until a job is sent to the jobs
// channel, or the jobs channel is closed.
for i := 0; i <= numWorkers; i++ {
for i := 0; i < numWorkers; i++ {
go worker(i, jobs, results)
}
// Initialize all the jobs. Each worker will pick a job from the channel when the worker
Expand Down
2 changes: 1 addition & 1 deletion docs/modules/ROOT/pages/verify-conforma-konflux-ta.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,7 +64,7 @@ paths can be provided by using the `:` separator.
*WORKERS* (`string`):: Number of parallel workers to use for policy evaluation.

+
*Default*: `4`
*Default*: `5`
*EC_USE_OPA* (`string`):: Use the OPA evaluator instead of the default conftest evaluator. Set to "1" to enable.
*SINGLE_COMPONENT* (`string`):: Reduce the Snapshot to only the component whose build caused the Snapshot to be created
+
Expand Down
2 changes: 1 addition & 1 deletion docs/modules/ROOT/pages/verify-enterprise-contract.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,7 +74,7 @@ paths can be provided by using the `:` separator.
*Default*: `sha256:f904979d405a39a3cc492439b379b4b117c622bbe7126a0e1ba76527ec3ce6a2`
*WORKERS* (`string`):: Number of parallel workers to use for policy evaluation.
+
*Default*: `1`
*Default*: `2`
*EC_USE_OPA* (`string`):: Use the OPA evaluator instead of the default conftest evaluator. Set to "1" to enable.
*SINGLE_COMPONENT* (`string`):: Reduce the Snapshot to only the component whose build caused the Snapshot to be created
+
Expand Down
2 changes: 1 addition & 1 deletion tasks/verify-conforma-konflux-ta/0.1/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ kubectl apply -f https://raw.githubusercontent.com/conforma/cli/main/tasks/verif
* **HOMEDIR**: Value for the HOME environment variable. (default: "/tekton/home")
* **EFFECTIVE_TIME**: Run policy checks with the provided time. (default: "now")
* **EXTRA_RULE_DATA**: Merge additional Rego variables into the policy data. Use syntax "key=value,key2=value2..." (default: "")
* **WORKERS**: Number of parallel workers to use for policy evaluation. This parameter is currently not used. All policy evaluations are run with 35 workers. (default: "35")

@simonbaird simonbaird Jul 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This was some left-over incorrect documentation, right??

@cuipinghuo cuipinghuo Jul 23, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, it was stale/incorrect documentation. It was introduced in 5302c52 (fix(ec-1404)) — that commit rewrote this README line to say "This parameter is currently not used. All policy evaluations are run with 35 workers." The "35" likely came from conforma.workerCount: 35 which is set in ~107 ReleasePlanAdmission CRDs in konflux-release-data. However, that workerCount field is never wired to the task's WORKERS param — the release pipelines in release-service-catalog don't pass a WORKERS param at all, so the task YAML default always controlled --workers. The README was wrong from the moment it was written.

@cuipinghuo cuipinghuo Jul 23, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Correction to my previous comment: my local clone of release-service-catalog was stale. The upstream konflux-ci/release-service-catalog does pass WORKERS in the managed pipelines (under pipelines/managed/), e.g. https://github.com/konflux-ci/release-service-catalog/blob/main/pipelines/managed/rh-advisories/rh-advisories.yaml — the value comes from $(tasks.collect-task-params.results.extractedValues[0]), which extracts conforma.workerCount: 35 from konflux-release-data.

So for release pipelines, the task default doesn't matter — it gets overridden to 35 (which with the old <= bug meant 36 actual goroutines). The task default only applies when the task is invoked without an explicit WORKERS param (e.g. integration pipelines via verify-conforma-konflux-ta).

The README text "This parameter is currently not used" was still misleading though — the parameter is used, it's just that the release pipelines override it.

* **WORKERS**: Number of parallel workers to use for policy evaluation. Note: managed release pipelines in `release-service-catalog` override this to 35 via `conforma.workerCount` in `konflux-release-data`. (default: "5")
* **SINGLE_COMPONENT**: Reduce the Snapshot to only the component whose build caused the Snapshot to be created (default: "false")
* **SINGLE_COMPONENT_CUSTOM_RESOURCE**: Name, including kind, of the Kubernetes resource to query for labels when single component mode is enabled, e.g. pr/somepipeline. (default: "unknown")
* **SINGLE_COMPONENT_CUSTOM_RESOURCE_NS**: Kubernetes namespace where the SINGLE_COMPONENT_NAME is found. Only used when single component mode is enabled. (default: "")
Expand Down
2 changes: 1 addition & 1 deletion tasks/verify-conforma-konflux-ta/0.1/verify-conforma-konflux-ta.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -177,7 +177,7 @@ spec:
type: string
description: >
Number of parallel workers to use for policy evaluation.
default: "4"
default: "5"
Comment thread
cuipinghuo marked this conversation as resolved.

- name: EC_USE_OPA
type: string
Expand Down
2 changes: 1 addition & 1 deletion tasks/verify-enterprise-contract/0.1/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ kubectl apply -f https://raw.githubusercontent.com/conforma/cli/main/tasks/verif
* **HOMEDIR**: Value for the HOME environment variable. (default: "/tekton/home")
* **EFFECTIVE_TIME**: Run policy checks with the provided time. (default: "now")
* **EXTRA_RULE_DATA**: Merge additional Rego variables into the policy data. Use syntax "key=value,key2=value2..." (default: "")
* **WORKERS**: Number of parallel workers to use for policy evaluation. (default: "1")
* **WORKERS**: Number of parallel workers to use for policy evaluation. (default: "2")
* **SINGLE_COMPONENT**: Reduce the Snapshot to only the component whose build caused the Snapshot to be created (default: "false")
* **SINGLE_COMPONENT_CUSTOM_RESOURCE**: Name, including kind, of the Kubernetes resource to query for labels when single component mode is enabled, e.g. pr/somepipeline. (default: "unknown")
* **SINGLE_COMPONENT_CUSTOM_RESOURCE_NS**: Kubernetes namespace where the SINGLE_COMPONENT_NAME is found. Only used when single component mode is enabled. (default: "")
Expand Down
2 changes: 1 addition & 1 deletion tasks/verify-enterprise-contract/0.1/verify-enterprise-contract.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -183,7 +183,7 @@ spec:
- name: WORKERS
type: string
description: Number of parallel workers to use for policy evaluation.
default: "1"
default: "2"
Comment thread
cuipinghuo marked this conversation as resolved.

- name: EC_USE_OPA
type: string
Expand Down
Loading