Skip to content

fix(EC-1994): correct off-by-one in validate image worker loop #3425

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
cuipinghuo wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix(EC-1994): correct off-by-one in validate image worker loop #3425

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion cmd/validate/image.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -401,7 +401,7 @@ func validateImageCmd(validate imageValidationFunc) *cobra.Command {
results := make(chan validate_utils.Result, numComponents)
// Initialize each worker. They will wait patiently until a job is sent to the jobs
// channel, or the jobs channel is closed.
for i := 0; i <= numWorkers; i++ {
for i := 0; i < numWorkers; i++ {

@fullsend-ai-review fullsend-ai-review Bot Aug 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] test-adequacy

No test covers the worker loop to verify that exactly numWorkers goroutines are spawned. The off-by-one existed since the loop was introduced and was not caught by tests. A regression test would prevent reintroduction.

Suggested fix: Consider adding a test that asserts the number of concurrent workers matches the --workers flag value.

@simonbaird simonbaird Aug 13, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure that's worth it.

go worker(i, jobs, results)
}
// Initialize all the jobs. Each worker will pick a job from the channel when the worker
Expand Down
2 changes: 1 addition & 1 deletion docs/modules/ROOT/pages/verify-conforma-konflux-ta.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,7 +67,7 @@ paths can be provided by using the `:` separator.
*WORKERS* (`string`):: Number of parallel workers to use for policy evaluation.

+
*Default*: `4`
*Default*: `5`
*EC_USE_OPA* (`string`):: Use the OPA evaluator instead of the default conftest evaluator. Set to "1" to enable.
*SINGLE_COMPONENT* (`string`):: Reduce the Snapshot to only the component whose build caused the Snapshot to be created
+
Expand Down
2 changes: 1 addition & 1 deletion docs/modules/ROOT/pages/verify-enterprise-contract.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,7 +77,7 @@ paths can be provided by using the `:` separator.
*Default*: `sha256:f904979d405a39a3cc492439b379b4b117c622bbe7126a0e1ba76527ec3ce6a2`
*WORKERS* (`string`):: Number of parallel workers to use for policy evaluation.
+
*Default*: `1`
*Default*: `2`
*EC_USE_OPA* (`string`):: Use the OPA evaluator instead of the default conftest evaluator. Set to "1" to enable.
*SINGLE_COMPONENT* (`string`):: Reduce the Snapshot to only the component whose build caused the Snapshot to be created
+
Expand Down
2 changes: 1 addition & 1 deletion pipelines/enterprise-contract/0.1/enterprise-contract.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,7 @@ spec:
- name: WORKERS
type: string
description: Number of parallel workers to use for policy evaluation.
default: "1"
default: "2"
- name: CA_TRUST_CONFIGMAP_NAME
type: string
description: The name of the ConfigMap to read CA bundle data from.
Expand Down
2 changes: 1 addition & 1 deletion tasks/verify-conforma-konflux-ta/0.1/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ kubectl apply -f https://raw.githubusercontent.com/conforma/cli/main/tasks/verif
* **HOMEDIR**: Value for the HOME environment variable. (default: "/tekton/home")
* **EFFECTIVE_TIME**: Run policy checks with the provided time. (default: "now")
* **EXTRA_RULE_DATA**: Merge additional Rego variables into the policy data. Use syntax "key=value,key2=value2..." (default: "")
* **WORKERS**: Number of parallel workers to use for policy evaluation. This parameter is currently not used. All policy evaluations are run with 35 workers. (default: "35")
Comment thread
cuipinghuo marked this conversation as resolved.
* **WORKERS**: Number of parallel workers to use for policy evaluation. Note: managed release pipelines in `release-service-catalog` override this to 35 via `conforma.workerCount` in `konflux-release-data`. (default: "5")
* **SINGLE_COMPONENT**: Reduce the Snapshot to only the component whose build caused the Snapshot to be created (default: "false")
* **SINGLE_COMPONENT_CUSTOM_RESOURCE**: Name, including kind, of the Kubernetes resource to query for labels when single component mode is enabled, e.g. pr/somepipeline. (default: "unknown")
* **SINGLE_COMPONENT_CUSTOM_RESOURCE_NS**: Kubernetes namespace where the SINGLE_COMPONENT_NAME is found. Only used when single component mode is enabled. (default: "")
Expand Down
2 changes: 1 addition & 1 deletion tasks/verify-conforma-konflux-ta/0.1/verify-conforma-konflux-ta.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -181,7 +181,7 @@ spec:
type: string
description: >
Number of parallel workers to use for policy evaluation.
default: "4"
default: "5"
Comment thread
cuipinghuo marked this conversation as resolved.

- name: EC_USE_OPA
type: string
Expand Down
2 changes: 1 addition & 1 deletion tasks/verify-enterprise-contract/0.1/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ kubectl apply -f https://raw.githubusercontent.com/conforma/cli/main/tasks/verif
* **HOMEDIR**: Value for the HOME environment variable. (default: "/tekton/home")
* **EFFECTIVE_TIME**: Run policy checks with the provided time. (default: "now")
* **EXTRA_RULE_DATA**: Merge additional Rego variables into the policy data. Use syntax "key=value,key2=value2..." (default: "")
* **WORKERS**: Number of parallel workers to use for policy evaluation. (default: "1")
* **WORKERS**: Number of parallel workers to use for policy evaluation. (default: "2")
* **SINGLE_COMPONENT**: Reduce the Snapshot to only the component whose build caused the Snapshot to be created (default: "false")
* **SINGLE_COMPONENT_CUSTOM_RESOURCE**: Name, including kind, of the Kubernetes resource to query for labels when single component mode is enabled, e.g. pr/somepipeline. (default: "unknown")
* **SINGLE_COMPONENT_CUSTOM_RESOURCE_NS**: Kubernetes namespace where the SINGLE_COMPONENT_NAME is found. Only used when single component mode is enabled. (default: "")
Expand Down
2 changes: 1 addition & 1 deletion tasks/verify-enterprise-contract/0.1/verify-enterprise-contract.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -187,7 +187,7 @@ spec:
- name: WORKERS
type: string
description: Number of parallel workers to use for policy evaluation.
default: "1"
default: "2"
Comment thread
cuipinghuo marked this conversation as resolved.

- name: EC_USE_OPA
type: string
Expand Down
Loading