feat(tikv/migration): migrate CI artifacts from fileserver to OCI registry by Copilot · Pull Request #4272 · PingCAP-QE/ci

Copilot · 2026-02-28T15:25:39Z

Migrates tikv/migration integration CI jobs from fileserver.pingcap.net to OCI artifacts in hub-zot.pingcap.net/mirrors/hub.

Changes

update pull_integration_test.groovy and pull_integration_kafka_test.groovy to prepare integration binaries via OCI
preserve make prepare_test_binaries semantics by downloading required artifacts into cdc/scripts/bin (tidb-server, tikv-server, pd-server, pd-ctl, etcdctl, go-ycsb)
set OCI_ARTIFACT_HOST to hub-zot.pingcap.net/mirrors/hub in integration pipelines
add utils sidecar (ghcr.io/pingcap-qe/cd/utils/release) in integration pod templates for OCI tooling support
keep integration presubmit triggers in prow-jobs/tikv/migration/latest-presubmits.yaml with shared YAML anchors

Follow-up split out

pull_unit_test removal is tracked separately in ci(tikv/migration): remove pull_unit_test job from ci repo #4300 and implemented in ci(tikv/migration): remove pull_unit_test job #4301

Fixes #4215

ti-chi-bot · 2026-02-28T15:25:49Z

Hi @Copilot. Thanks for your PR.

I'm waiting for a PingCAP-QE member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

…OCI registry Co-authored-by: wuhuizuo <2574558+wuhuizuo@users.noreply.github.com>

## Summary - remove `pull_unit_test` presubmit from `prow-jobs/tikv/migration/latest-presubmits.yaml` - delete the Jenkins job DSL `jobs/tikv/migration/latest/pull_unit_test.groovy` - delete the pipeline and pod template used by this job under `pipelines/tikv/migration/latest/` ## Context - this is a follow-up split from #4272 Fixes #4300 Related to #4215

…in OCI step

ti-chi-bot · 2026-03-06T10:54:54Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: wuhuizuo

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~pipelines/OWNERS~~ [wuhuizuo]
~~prow-jobs/OWNERS~~ [wuhuizuo]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

ti-chi-bot · 2026-03-06T10:54:55Z

[LGTM Timeline notifier]

Timeline:

2026-03-06 10:54:55.174547524 +0000 UTC m=+1926.686605195: ☑️ agreed by wuhuizuo.

wuhuizuo · 2026-03-06T10:55:09Z

/ok-to-test

Copilot

Pull request overview

This PR migrates the tikv/migration integration presubmit pipelines away from fileserver.pingcap.net by downloading required CI binaries from OCI registries (hub-zot mirror), aligning these jobs with the repo’s broader OCI artifact migration approach.

Changes:

Refactors tikv/migration presubmits YAML to use shared YAML anchors for branch and Jenkins job defaults.
Updates integration pipelines to download tidb/tikv/pd (+ pd-ctl, etcdctl, go-ycsb) via download_pingcap_oci_artifact.sh and sets OCI_ARTIFACT_HOST to the hub-zot mirror.
Adds a utils sidecar container to the integration pod templates to provide OCI tooling (oras, yq, etc.).

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
prow-jobs/tikv/migration/latest-presubmits.yaml	Uses shared YAML anchors to DRY up presubmit definitions (branches + Jenkins defaults).
pipelines/tikv/migration/latest/pull_integration_test.groovy	Switches binary preparation from fileserver to OCI downloads using the utils container + mirror host env.
pipelines/tikv/migration/latest/pull_integration_kafka_test.groovy	Same OCI-based binary preparation change for the Kafka integration job.
pipelines/tikv/migration/latest/pod-pull_integration_test.yaml	Adds `utils` sidecar needed for OCI artifact tooling.
pipelines/tikv/migration/latest/pod-pull_integration_kafka_test.yaml	Adds `utils` sidecar needed for OCI artifact tooling in the Kafka pod.

Copilot · 2026-03-06T11:04:11Z

pipelines/tikv/migration/latest/pull_integration_test.groovy

+                            sh label: 'download test binaries via OCI', script: """
+                                mkdir -p ./cdc/scripts/bin
+                                cd ./cdc/scripts/bin
+                                ${WORKSPACE}/scripts/artifacts/download_pingcap_oci_artifact.sh \
+                                    --tidb=${OCI_TAG_TIDB} \
+                                    --tikv=${OCI_TAG_TIKV} \
+                                    --pd=${OCI_TAG_PD} \
+                                    --pd-ctl=${OCI_TAG_PD} \
+                                    --etcdctl=${OCI_TAG_ETCD} \
+                                    --ycsb=${OCI_TAG_YCSB}
+                                chmod +x tidb-server tikv-server pd-server pd-ctl etcdctl go-ycsb
+                                cd ../../
+                                touch prepare_test_binaries
+                                ls -alh
+                            """


The OCI download step is doing network fetches but isn’t wrapped in retry(...), unlike similar pipelines in this repo. Consider adding a small retry around the download script invocation to reduce CI flakiness from transient registry/network errors.

Suggested change

sh label: 'download test binaries via OCI', script: """

mkdir -p ./cdc/scripts/bin

cd ./cdc/scripts/bin

${WORKSPACE}/scripts/artifacts/download_pingcap_oci_artifact.sh \

--tidb=${OCI_TAG_TIDB} \

--tikv=${OCI_TAG_TIKV} \

--pd=${OCI_TAG_PD} \

--pd-ctl=${OCI_TAG_PD} \

--etcdctl=${OCI_TAG_ETCD} \

--ycsb=${OCI_TAG_YCSB}

chmod +x tidb-server tikv-server pd-server pd-ctl etcdctl go-ycsb

cd ../../

touch prepare_test_binaries

ls -alh

"""

retry(3) {

sh label: 'download test binaries via OCI', script: """

mkdir -p ./cdc/scripts/bin

cd ./cdc/scripts/bin

${WORKSPACE}/scripts/artifacts/download_pingcap_oci_artifact.sh \

--tidb=${OCI_TAG_TIDB} \

--tikv=${OCI_TAG_TIKV} \

--pd=${OCI_TAG_PD} \

--pd-ctl=${OCI_TAG_PD} \

--etcdctl=${OCI_TAG_ETCD} \

--ycsb=${OCI_TAG_YCSB}

chmod +x tidb-server tikv-server pd-server pd-ctl etcdctl go-ycsb

cd ../../

touch prepare_test_binaries

ls -alh

"""

}

Copilot · 2026-03-06T11:04:12Z

pipelines/tikv/migration/latest/pull_integration_kafka_test.groovy

+        // tidb-server: hub-zot.pingcap.net/mirrors/hub/pingcap/tidb/package:<tag>_linux_amd64
+        // tikv-server: hub-zot.pingcap.net/mirrors/hub/tikv/tikv/package:<tag>_linux_amd64
+        // pd-server:   hub-zot.pingcap.net/mirrors/hub/tikv/pd/package:<tag>_linux_amd64
+        OCI_ARTIFACT_HOST = 'hub-zot.pingcap.net/mirrors/hub'


download_pingcap_oci_artifact.sh uses OCI_ARTIFACT_HOST_COMMUNITY (defaulting to us-docker.pkg.dev/.../hub) for third-party artifacts like --etcdctl and --ycsb. If these jobs are intended to pull all artifacts via the hub-zot mirror, also set OCI_ARTIFACT_HOST_COMMUNITY (or export it just for the script invocation) to the mirror registry; otherwise these downloads will still hit the community registry.

Suggested change

OCI_ARTIFACT_HOST = 'hub-zot.pingcap.net/mirrors/hub'

OCI_ARTIFACT_HOST = 'hub-zot.pingcap.net/mirrors/hub'

OCI_ARTIFACT_HOST_COMMUNITY = 'hub-zot.pingcap.net/mirrors/hub'

Copilot · 2026-03-06T11:04:12Z

pipelines/tikv/migration/latest/pull_integration_kafka_test.groovy

+                            sh label: 'download test binaries via OCI', script: """
+                                mkdir -p ./cdc/scripts/bin
+                                cd ./cdc/scripts/bin
+                                ${WORKSPACE}/scripts/artifacts/download_pingcap_oci_artifact.sh \
+                                    --tidb=${OCI_TAG_TIDB} \
+                                    --tikv=${OCI_TAG_TIKV} \
+                                    --pd=${OCI_TAG_PD} \
+                                    --pd-ctl=${OCI_TAG_PD} \
+                                    --etcdctl=${OCI_TAG_ETCD} \
+                                    --ycsb=${OCI_TAG_YCSB}
+                                chmod +x tidb-server tikv-server pd-server pd-ctl etcdctl go-ycsb
+                                cd ../../
+                                touch prepare_test_binaries
+                                ls -alh
+                            """


The OCI download step is doing network fetches but isn’t wrapped in retry(...), unlike similar pipelines in this repo. Consider adding a small retry around the download script invocation to reduce CI flakiness from transient registry/network errors.

Suggested change

sh label: 'download test binaries via OCI', script: """

mkdir -p ./cdc/scripts/bin

cd ./cdc/scripts/bin

${WORKSPACE}/scripts/artifacts/download_pingcap_oci_artifact.sh \

--tidb=${OCI_TAG_TIDB} \

--tikv=${OCI_TAG_TIKV} \

--pd=${OCI_TAG_PD} \

--pd-ctl=${OCI_TAG_PD} \

--etcdctl=${OCI_TAG_ETCD} \

--ycsb=${OCI_TAG_YCSB}

chmod +x tidb-server tikv-server pd-server pd-ctl etcdctl go-ycsb

cd ../../

touch prepare_test_binaries

ls -alh

"""

retry(2) {

sh label: 'download test binaries via OCI', script: """

mkdir -p ./cdc/scripts/bin

cd ./cdc/scripts/bin

${WORKSPACE}/scripts/artifacts/download_pingcap_oci_artifact.sh \

--tidb=${OCI_TAG_TIDB} \

--tikv=${OCI_TAG_TIKV} \

--pd=${OCI_TAG_PD} \

--pd-ctl=${OCI_TAG_PD} \

--etcdctl=${OCI_TAG_ETCD} \

--ycsb=${OCI_TAG_YCSB}

chmod +x tidb-server tikv-server pd-server pd-ctl etcdctl go-ycsb

cd ../../

touch prepare_test_binaries

ls -alh

"""

}

Copilot · 2026-03-06T11:04:12Z

pipelines/tikv/migration/latest/pull_integration_test.groovy

+        // tidb-server: hub-zot.pingcap.net/mirrors/hub/pingcap/tidb/package:<tag>_linux_amd64
+        // tikv-server: hub-zot.pingcap.net/mirrors/hub/tikv/tikv/package:<tag>_linux_amd64
+        // pd-server:   hub-zot.pingcap.net/mirrors/hub/tikv/pd/package:<tag>_linux_amd64
+        OCI_ARTIFACT_HOST = 'hub-zot.pingcap.net/mirrors/hub'


download_pingcap_oci_artifact.sh uses OCI_ARTIFACT_HOST_COMMUNITY (defaulting to us-docker.pkg.dev/.../hub) for third-party artifacts like --etcdctl and --ycsb. If these jobs are intended to pull all artifacts via the hub-zot mirror, also set OCI_ARTIFACT_HOST_COMMUNITY (or export it just for the script invocation) to the mirror registry; otherwise these downloads will still hit the community registry.

Suggested change

OCI_ARTIFACT_HOST = 'hub-zot.pingcap.net/mirrors/hub'

OCI_ARTIFACT_HOST = 'hub-zot.pingcap.net/mirrors/hub'

// Community / third-party artifacts (e.g. etcdctl, ycsb) via the same mirror

OCI_ARTIFACT_HOST_COMMUNITY = 'hub-zot.pingcap.net/mirrors/hub'

Copilot · 2026-03-06T11:04:12Z

pipelines/tikv/migration/latest/pull_integration_test.groovy

+                                ${WORKSPACE}/scripts/artifacts/download_pingcap_oci_artifact.sh \
+                                    --tidb=${OCI_TAG_TIDB} \
+                                    --tikv=${OCI_TAG_TIKV} \
+                                    --pd=${OCI_TAG_PD} \
+                                    --pd-ctl=${OCI_TAG_PD} \
+                                    --etcdctl=${OCI_TAG_ETCD} \
+                                    --ycsb=${OCI_TAG_YCSB}


The sh step builds a shell command line where --tidb=${OCI_TAG_TIDB}, --tikv=${OCI_TAG_TIKV}, and other flags interpolate values derived from the PR title into an unquoted shell context. Because OCI_TAG_* values come from component.computeArtifactOciTagFromPR, which can be influenced via the PR title and allows shell metacharacters like ;, an attacker can craft a PR title such that the resulting tag injects arbitrary commands executed in the CI container. Treat OCI_TAG_* as untrusted: strictly validate/whitelist allowed characters for tags and ensure they are passed as safely quoted arguments (or via an array/parameter mechanism) so no shell metacharacters can break out of the intended argument.

Copilot · 2026-03-06T11:04:13Z

pipelines/tikv/migration/latest/pull_integration_kafka_test.groovy

+                                ${WORKSPACE}/scripts/artifacts/download_pingcap_oci_artifact.sh \
+                                    --tidb=${OCI_TAG_TIDB} \
+                                    --tikv=${OCI_TAG_TIKV} \
+                                    --pd=${OCI_TAG_PD} \
+                                    --pd-ctl=${OCI_TAG_PD} \
+                                    --etcdctl=${OCI_TAG_ETCD} \
+                                    --ycsb=${OCI_TAG_YCSB}


This sh invocation interpolates OCI_TAG_* values (computed from PR metadata via component.computeArtifactOciTagFromPR) directly into a shell command as unquoted arguments like --tidb=${OCI_TAG_TIDB}. Since the PR title can include shell metacharacters (e.g., ;, &) that are preserved by computeArtifactOciTagFromPR, a malicious PR author could craft a title that turns these arguments into a command-injection vector, executing arbitrary commands in the CI utils container. Please treat these tag values as untrusted: constrain them to a safe character set and ensure they are safely quoted/passed to the script so injected shell syntax cannot alter the command flow.

Copilot AI self-assigned this Feb 28, 2026

Initial plan

a4dff08

Copilot AI assigned wuhuizuo Feb 28, 2026

github-project-automation bot added this to EE - CI/CD system Feb 28, 2026

ti-chi-bot bot added the do-not-merge/work-in-progress label Feb 28, 2026

ti-chi-bot bot added needs-ok-to-test size/XS labels Feb 28, 2026

Copilot started work on behalf of wuhuizuo February 28, 2026 15:30 View session

feat(pipelines/tikv/migration): migrate artifacts from fileserver to …

4de60e6

…OCI registry Co-authored-by: wuhuizuo <2574558+wuhuizuo@users.noreply.github.com>

ti-chi-bot bot added area/jenkins-pipelines area/jobs/prow size/L and removed size/XS labels Feb 28, 2026

Copilot AI changed the title ~~[WIP] Migrate tikv/migration artifacts to OCI registry~~ feat(tikv/migration): migrate CI artifacts from fileserver to OCI registry Feb 28, 2026

Copilot finished work on behalf of wuhuizuo February 28, 2026 15:42

wuhuizuo and others added 3 commits March 4, 2026 20:46

Merge branch 'main' into copilot/migrate-artifacts-to-oci-please-work

a51df4d

Merge branch 'main' into copilot/migrate-artifacts-to-oci-please-work

37a2c45

ci(tikv/migration): revert pull-unit-test changes from oci migration pr

21ce4b2

This was referenced Mar 6, 2026

ci(tikv/migration): remove pull_unit_test job from ci repo #4300

Closed

ci(tikv/migration): remove pull_unit_test job #4301

Merged

chore(tikv/migration): keep pull_unit_test stanza unchanged

4e1f83f

wuhuizuo added 3 commits March 6, 2026 18:27

ci(tikv/migration): point OCI_ARTIFACT_HOST to hub-zot mirror

28235e5

Merge branch 'main' into copilot/migrate-artifacts-to-oci-please-work

0175ffe

fix(pipelines/tikv/migration): cover prepare_test_binaries artifacts …

4f85537

…in OCI step

wuhuizuo marked this pull request as ready for review March 6, 2026 10:54

ti-chi-bot bot removed the do-not-merge/work-in-progress label Mar 6, 2026

wuhuizuo requested review from Copilot and wuhuizuo March 6, 2026 10:54

Copilot started reviewing on behalf of wuhuizuo March 6, 2026 10:54 View session

wuhuizuo approved these changes Mar 6, 2026

View reviewed changes

ti-chi-bot bot added the lgtm label Mar 6, 2026

ti-chi-bot bot added the approved label Mar 6, 2026

ti-chi-bot bot added ok-to-test and removed needs-ok-to-test labels Mar 6, 2026

ti-chi-bot bot merged commit 9e255f9 into main Mar 6, 2026
7 of 8 checks passed

ti-chi-bot bot deleted the copilot/migrate-artifacts-to-oci-please-work branch March 6, 2026 11:00

github-project-automation bot moved this to ✅ Done in EE - CI/CD system Mar 6, 2026

Copilot AI reviewed Mar 6, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(tikv/migration): migrate CI artifacts from fileserver to OCI registry#4272

feat(tikv/migration): migrate CI artifacts from fileserver to OCI registry#4272
ti-chi-bot[bot] merged 9 commits intomainfrom
copilot/migrate-artifacts-to-oci-please-work

Copilot AI commented Feb 28, 2026 •

edited by wuhuizuo

Loading

Uh oh!

ti-chi-bot bot commented Feb 28, 2026

Uh oh!

ti-chi-bot bot commented Mar 6, 2026

Uh oh!

ti-chi-bot bot commented Mar 6, 2026

Uh oh!

wuhuizuo commented Mar 6, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 6, 2026

Uh oh!

Copilot AI Mar 6, 2026

Uh oh!

Copilot AI Mar 6, 2026

Uh oh!

Copilot AI Mar 6, 2026

Uh oh!

Copilot AI Mar 6, 2026

Uh oh!

Copilot AI Mar 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

	OCI_ARTIFACT_HOST = 'hub-zot.pingcap.net/mirrors/hub'
	OCI_ARTIFACT_HOST = 'hub-zot.pingcap.net/mirrors/hub'
	OCI_ARTIFACT_HOST_COMMUNITY = 'hub-zot.pingcap.net/mirrors/hub'

Conversation

Copilot AI commented Feb 28, 2026 • edited by wuhuizuo Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Follow-up split out

Uh oh!

ti-chi-bot bot commented Feb 28, 2026

Uh oh!

ti-chi-bot bot commented Mar 6, 2026

Uh oh!

ti-chi-bot bot commented Mar 6, 2026

[LGTM Timeline notifier]

Uh oh!

wuhuizuo commented Mar 6, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Feb 28, 2026 •

edited by wuhuizuo

Loading