From 80f557361df1507f7307be6035bc82dc38b44c8b Mon Sep 17 00:00:00 2001
From: Matthias Bertschy <matthias.bertschy@gmail.com>
Date: Tue, 1 Sep 2026 17:57:36 +0200
Subject: [PATCH] fix: skip component_image_tags for components outside the
 kubescape-operator chart
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

incluster-comp-pr-merged.yaml unconditionally appended
client_payload[component_image_tags]=<COMPONENT_NAME>-tag=<tag> to every
Helm E2E dispatch. That's only meaningful for the seven components the
kubescape-operator chart actually has a "<name>-tag" value for
(kubescape, operator, kubevuln, kollector, gateway, storage, nodeAgent).

Consumers like http-request and prometheus-exporter aren't chart
components, so their "-tag" override was silently dropped by
armosec/system-tests until PR armosec/system-tests#1236 (merged
2026-08-31) added a fail-closed check for unrecognised "-tag" kwargs.
Since then, every http-request/prometheus-exporter release has failed
ks_microservice_on_demand with:

  unknown component image tag kwargs ['http-request-tag'] — expected
  one of ['gateway-tag', 'kollector-tag', 'kubescape-tag',
  'kubevuln-tag', 'nodeAgent-tag', 'operator-tag', 'storage-tag']

blocking create-release-and-retag (see
https://github.com/armosec/shared-workflows/actions/runs/33526635646/job/99921734558,
triggered by kubescape/http-request#29).

Now the override is only sent when COMPONENT_NAME is one of the chart's
known components; the receiver already defaults
component_image_tags to '' when absent
(armosec/shared-workflows/.github/workflows/helm-e2e-receiver.yaml:60),
so this is a no-op for the existing chart-component consumers.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .github/workflows/incluster-comp-pr-merged.yaml | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/incluster-comp-pr-merged.yaml b/.github/workflows/incluster-comp-pr-merged.yaml
index efd8671..837c1c2 100644
--- a/.github/workflows/incluster-comp-pr-merged.yaml
+++ b/.github/workflows/incluster-comp-pr-merged.yaml
@@ -285,6 +285,20 @@ jobs:
                   echo "Dispatching E2E tests with correlation_id: ${CORRELATION_ID}"
                   echo "Using tests group: ${TESTS_GROUP}"
 
+                  # Only components actually built into the kubescape-operator chart have a
+                  # "<name>-tag" helm value to override. Sending one for any other component
+                  # (e.g. http-request, prometheus-exporter) makes armosec/system-tests reject
+                  # the dispatch as an unrecognised override.
+                  COMPONENT_TAG_ARGS=()
+                  case "${{ inputs.COMPONENT_NAME }}" in
+                    kubescape|operator|kubevuln|kollector|gateway|storage|nodeAgent)
+                      COMPONENT_TAG_ARGS=(-f "client_payload[component_image_tags]=${{ inputs.COMPONENT_NAME }}-tag=${{ needs.docker-build.outputs.IMAGE_TAG_PRERELEASE }}")
+                      ;;
+                    *)
+                      echo "Component '${{ inputs.COMPONENT_NAME }}' is not part of the kubescape-operator chart; skipping component_image_tags override"
+                      ;;
+                  esac
+
                   gh api "repos/armosec/shared-workflows/dispatches" \
                     -f event_type="e2e-test-trigger" \
                     -f "client_payload[correlation_id]=${CORRELATION_ID}" \
@@ -296,7 +310,7 @@ jobs:
                     -f "client_payload[in_cluster_chart_branch]=${{ inputs.HELM_BRANCH }}" \
                     -f "client_payload[ks_branch]=release" \
                     -f "client_payload[charts_repo]=kubescape/helm-charts" \
-                    -f "client_payload[component_image_tags]=${{ inputs.COMPONENT_NAME }}-tag=${{ needs.docker-build.outputs.IMAGE_TAG_PRERELEASE }}"
+                    "${COMPONENT_TAG_ARGS[@]}"
 
                   echo "Dispatch completed"