build-service update

[rh-tap-build-team]

Included PRs:

• Security improvements konflux-ci/build-service#701

Changelog

• 47bb650 chore(deps): update github/codeql-action action to v4.37.6 (#693) - @red-hat-konflux[bot]
• 07b0146 chore(deps): update konflux references - @red-hat-konflux[bot]
• 80acf09 Merge pull request #696 from konflux-ci/konflux/references/main - @mkosiarc
• 87e991d chore(deps): update konflux references - @red-hat-konflux[bot]
• 46f07f4 chore(deps): update github/codeql-action action to v4.37.7 (#700) - @red-hat-konflux[bot]
• 7e1a8b2 Merge pull request #699 from konflux-ci/konflux/references/main - @rcerven
• 11be0c4 Restrict ability to bind build pipeline clusterrole by name - @mmorhun
• 1ac62b0 Pin base image references by digest - @mmorhun
• ccde63a Apply pod-security labels to the operator namespace - @mmorhun

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: rh-tap-build-team[bot]
Once this PR has been reviewed and has the lgtm label, please assign mkosiarc for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• components/build-service/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[konflux-ci-qe-bot]

🤖 Pipeline Failure Analysis

Category: Infrastructure

The pipeline failed because the GitHub API rate limit was exceeded, preventing the creation or detection of a Pull Request and subsequently failing to trigger the expected PipelineRun.

📋 Technical Details

Immediate Cause

The appstudio-e2e-tests/redhat-appstudio-conformance-tests step encountered a 403 Forbidden error from the GitHub API, explicitly stating "API rate limit exceeded" with x-ratelimit-remaining="0". This indicates that the job's access to the GitHub API was temporarily blocked due to excessive requests.

Contributing Factors

The exhaustion of the GitHub API rate limit directly prevented the necessary GitHub operations (likely PR creation or status checks) required by the conformance tests. This infrastructural limitation stalled the test execution flow before any application-specific logic could proceed.

Impact

As a direct consequence of the inability to interact with GitHub, the system failed to create or detect the requisite Pull Request, which in turn meant that the PipelineRun for component "konflux-ci-upstream-uljn" was never triggered or located. This resulted in the test step timing out after 300 seconds, leading to the overall failure of the conformance tests and the pipeline.

🔍 Evidence

appstudio-e2e-tests/redhat-appstudio-conformance-tests

Category: infrastructure
Root Cause: The GitHub API rate limit was exceeded, preventing the successful creation or detection of a Pull Request and subsequently failing to trigger the expected PipelineRun within the configured timeout.

Logs:

artifacts/appstudio-e2e-tests/redhat-appstudio-conformance-tests/build-log.txt

E0817 17:32:03.469523   29534 diagnostics.go:321] diagnostic: GitHub API probe (test) GET http://127.0.0.1:44231: status=403 retry-after="" x-ratelimit-limit="60" x-ratelimit-remaining="0" x-ratelimit-reset="" x-ratelimit-resource="core" body-prefix="{\"message\":\"API rate limit exceeded\"}"

artifacts/appstudio-e2e-tests/redhat-appstudio-conformance-tests/build-log.txt

[FAILED] Timed out after 300.003s.
  timed out waiting for pull-request PipelineRun
  Expected success, but got an error:
      <*errors.errorString | 0x3a16066067c0>: 
      no pipelinerun found for component konflux-ci-upstream-uljn

artifacts/appstudio-e2e-tests/redhat-appstudio-conformance-tests/build-log.txt

FAIL
FAIL	github.com/konflux-ci/konflux-ci/test/go-tests/tests/conformance	358.729s
FAIL

---

Analysis powered by prow-failure-analysis | Build: 2089399113962491904

[github-actions]

Kustomize Render Diff

Comparing bb58c8e57 → 9d5662c9e

Component	Environment	Changes
components/build-service/development	development	+8 -1
components/build-service/staging/base	staging	+8 -1
components/build-service/staging/stone-stage-p01	staging	+8 -1

Total: 3 components, +24 -3 lines

📋 Full diff available in the workflow summary and as a downloadable artifact.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 60.38%. Comparing base (bb58c8e) to head (3b03550).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #13557   +/-   ##
=======================================
  Coverage   60.38%   60.38%           
=======================================
  Files          24       24           
  Lines        1628     1628           
=======================================
  Hits          983      983           
  Misses        563      563           
  Partials       82       82           

Flag	Coverage Δ
go	60.38% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.