OCPBUGS-87004: Add -L flag to curl to follow redirects automatically

[pawanpinjarkar]

The GitHub API for /repos/containers/skopeo/releases/latest returns a 301 redirect to the canonical repository URL, causing the JSON parsing to fail with:

KeyError: 'tag_name'

The redirect response contains:
{
"message": "Moved Permanently",
"url": "https://api.github.com/repositories/53356367/releases/latest"
}

Example: https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_machine-config-operator/6109/pull-ci-openshift-machine-config-operator-main-e2e-gcp-op-ocl-part1/2061846639768768512

- What I did

- How to verify it

- Description for the changelog

Summary by CodeRabbit

• Bug Fixes
  • Improved reliability of the skopeo installation process by ensuring proper handling of redirects when fetching the latest version information.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[coderabbitai]

Walkthrough

The installation script for skopeo is updated to follow HTTP redirects when fetching GitHub's latest release metadata. The curl command on line 35 now uses the -sL flags instead of -s to ensure the request resolves through any redirects before extracting the release version.

Changes

Skopeo installation script update

Layer / File(s)	Summary
Add redirect following to latest release fetch hack/install-skopeo.sh	The curl command fetching GitHub's latest release endpoint is updated to include -L flag, enabling redirect following when determining the skopeo version.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR modifies only hack/install-skopeo.sh (a shell script), not any Go test files. No Ginkgo test names or test code was changed.
Test Structure And Quality	✅ Passed	PR modifies hack/install-skopeo.sh (bash script), not Ginkgo test code. Custom check for Ginkgo test quality is not applicable to this PR.
Microshift Test Compatibility	✅ Passed	This PR modifies hack/install-skopeo.sh (a shell script) only. No new Ginkgo e2e tests are added, so the MicroShift Test Compatibility check is not applicable.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No Ginkgo e2e tests are added in this PR. Only hack/install-skopeo.sh is modified, a shell script that adds the -L flag to curl.
Topology-Aware Scheduling Compatibility	✅ Passed	PR modifies only hack/install-skopeo.sh, a bash utility script with no scheduling constraints. Not a deployment manifest, operator code, or controller.
Ote Binary Stdout Contract	✅ Passed	PR only modifies hack/install-skopeo.sh shell script; does not affect OTE binary (cmd/machine-config-tests-ext) or any process-level test code subject to stdout contract.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PR modifies only hack/install-skopeo.sh (bash script), not Ginkgo e2e tests. Custom check for IPv6/disconnected network test compatibility is not applicable to shell scripts.
No-Weak-Crypto	✅ Passed	PR modifies only hack/install-skopeo.sh, adding -L flag to curl command for redirect handling. No weak cryptographic patterns, custom crypto implementations, or insecure secret comparisons detected.
Container-Privileges	✅ Passed	PR modifies only hack/install-skopeo.sh shell script; no container or K8s manifests changed, making the container-privileges check not applicable.
No-Sensitive-Data-In-Logs	✅ Passed	The -L flag only enables HTTP redirects. No credentials, tokens, PII, or sensitive data are logged—only public version tags and URLs.
Title check	✅ Passed	The title accurately describes the main change: adding the -L flag to curl to follow redirects. This directly addresses the core fix in the pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[pawanpinjarkar]

/cc @bfournie

[bfournie]

/lgtm

[openshift-merge-bot]

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-ovn
/test e2e-aws-ovn-upgrade
/test e2e-gcp-op-ocl-part1
/test e2e-gcp-op-ocl-part2
/test e2e-gcp-op-part1
/test e2e-gcp-op-part2
/test e2e-gcp-op-single-node
/test e2e-hypershift

[zaneb]

/approve

[bfournie]

/verified by ci/prow/e2e-gcp-op-part1

[openshift-ci-robot]

@bfournie: This PR has been marked as verified by ci/prow/e2e-gcp-op-part1.

Details

In response to this:

/verified by ci/prow/e2e-gcp-op-part1

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[zaneb]

/retest-required
/retitle NO-ISSUE: Add -L flag to curl to follow redirects automatically

[openshift-ci-robot]

@pawanpinjarkar: This pull request explicitly references no jira issue.

Details

In response to this:

The GitHub API for /repos/containers/skopeo/releases/latest returns a 301 redirect to the canonical repository URL, causing the JSON parsing to fail with:

KeyError: 'tag_name'

The redirect response contains:
{
"message": "Moved Permanently",
"url": "https://api.github.com/repositories/53356367/releases/latest"
}

Example: https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_machine-config-operator/6109/pull-ci-openshift-machine-config-operator-main-e2e-gcp-op-ocl-part1/2061846639768768512

- What I did

- How to verify it

- Description for the changelog

Summary by CodeRabbit

• Bug Fixes
• Improved reliability of the skopeo installation process by ensuring proper handling of redirects when fetching the latest version information.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[zaneb]

I'm going to add the approved label manually, since all tests pass, the change is self-evidently correct, and this is blocking required jobs.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by: bfournie, pawanpinjarkar, zaneb

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-merge-bot]

/retest-required

Remaining retests: 0 against base HEAD c13cdd8 and 2 for PR HEAD 8c54b9a in total

[openshift-ci]

@pawanpinjarkar: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci-robot]

@pawanpinjarkar: Jira Issue Verification Checks: Jira Issue OCPBUGS-87004
✔️ This pull request was pre-merge verified.
✔️ All associated pull requests have merged.
✔️ All associated, merged pull requests were pre-merge verified.

Jira Issue OCPBUGS-87004 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓

Details

In response to this:

The GitHub API for /repos/containers/skopeo/releases/latest returns a 301 redirect to the canonical repository URL, causing the JSON parsing to fail with:

KeyError: 'tag_name'

The redirect response contains:
{
"message": "Moved Permanently",
"url": "https://api.github.com/repositories/53356367/releases/latest"
}

Example: https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_machine-config-operator/6109/pull-ci-openshift-machine-config-operator-main-e2e-gcp-op-ocl-part1/2061846639768768512

- What I did

- How to verify it

- Description for the changelog

Summary by CodeRabbit

• Bug Fixes
• Improved reliability of the skopeo installation process by ensuring proper handling of redirects when fetching the latest version information.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[pawanpinjarkar]

/jira backport release-4.22, release-4.21, release-4.20

[openshift-ci-robot]

@pawanpinjarkar: The following backport issues have been created:

• OCPBUGS-87005 for branch release-4.22
• OCPBUGS-87006 for branch release-4.21
• OCPBUGS-87007 for branch release-4.20

Queuing cherrypicks to the requested branches to be created after this PR merges:
/cherrypick release-4.22
/cherrypick release-4.21
/cherrypick release-4.20

Details

In response to this:

/jira backport release-4.22, release-4.21, release-4.20

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-cherrypick-robot]

@openshift-ci-robot: new pull request created: #6135

Details

In response to this:

@pawanpinjarkar: The following backport issues have been created:

• OCPBUGS-87005 for branch release-4.22
• OCPBUGS-87006 for branch release-4.21
• OCPBUGS-87007 for branch release-4.20

Queuing cherrypicks to the requested branches to be created after this PR merges:
/cherrypick release-4.22
/cherrypick release-4.21
/cherrypick release-4.20

In response to this:

/jira backport release-4.22, release-4.21, release-4.20

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[pawanpinjarkar]

/cherrypick release-4.22, release-4.21, release-4.20

[openshift-cherrypick-robot]

@openshift-ci-robot: new pull request created: #6136

Details

In response to this:

@pawanpinjarkar: The following backport issues have been created:

• OCPBUGS-87005 for branch release-4.22
• OCPBUGS-87006 for branch release-4.21
• OCPBUGS-87007 for branch release-4.20

Queuing cherrypicks to the requested branches to be created after this PR merges:
/cherrypick release-4.22
/cherrypick release-4.21
/cherrypick release-4.20

In response to this:

/jira backport release-4.22, release-4.21, release-4.20

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-cherrypick-robot]

@pawanpinjarkar: cannot checkout release-4.22,: error checking out "release-4.22,": exit status 1 error: pathspec 'release-4.22,' did not match any file(s) known to git

Details

In response to this:

/cherrypick release-4.22, release-4.21, release-4.20

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-cherrypick-robot]

@openshift-ci-robot: new pull request created: #6137

Details

In response to this:

@pawanpinjarkar: The following backport issues have been created:

• OCPBUGS-87005 for branch release-4.22
• OCPBUGS-87006 for branch release-4.21
• OCPBUGS-87007 for branch release-4.20

Queuing cherrypicks to the requested branches to be created after this PR merges:
/cherrypick release-4.22
/cherrypick release-4.21
/cherrypick release-4.20

In response to this:

/jira backport release-4.22, release-4.21, release-4.20

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.