Image Repo Mapping

Image to Repository Mapping

Translates a container image name into the GitHub repository URL to clone for analysis. Image names appear in the ticket summary, pscomponent: labels, and the Downstream Component Name custom field.

When to Use This Skill

Use this skill when:

• An image name has been extracted from a Jira ticket (summary, label, or custom field)
• The user passes --repo=<image-name> using a short image name rather than a full GitHub URL
• Phase 0.7 needs to determine which repository to clone

Resolution Order

Apply these in order and stop at the first match:

1. Full GitHub URL supplied (--repo=https://github.com/...) → use directly, skip this skill.
2. Exact image name match — look the image name up in the table below.
3. Prefix match — strip version suffixes (e.g. -1-0, -1-12-4, -rhel9, -rhel8) and re-match.
4. Keyword match — check the per-section keyword rules at the bottom of each group.
5. NOT FOUND → Exit immediately with the error message below. Do not guess. Do not proceed with analysis.

Tip: Strip pkg:oci/ prefix before matching (e.g. pkg:oci/ose-ansible-operator → ose-ansible-operator).

Not-Found Exit

If no match is found after all steps above, stop immediately and output:

❌ Repository mapping not found for image: <image_name>

The image "<image_name>" is not in the known mapping table and could not
be resolved automatically.

To proceed, re-run with an explicit repository URL:

  --repo=https://github.com/org/repo

Or add the mapping to:
  plugins/compliance/skills/image-repo-mapping/SKILL.md

Do NOT continue analysis without a confirmed source repository.

Do NOT fall back to guessing, fuzzy matching, or prompting the user inline. Exit the command at this point.

Two Repository Patterns

Components fall into one of two patterns. The resolution output is different for each.

Pattern A — Direct repo

Clone the mapped repo directly at the mapped branch. Used by: Operator SDK, Ansible Operator, must-gather, Secrets Store CSI.

image → repo URL + branch

Pattern B — Release repo with git submodules

Some components use a dedicated -release repo that aggregates all component repos as git submodules. The release repo branch pins each submodule to the exact commit/tag used for that release. Used by: cert-manager, ZTWIM, ESO.

Resolution steps for Pattern B:

1. Clone the release repo at the mapped release branch
2. Read .gitmodules from that branch to find the submodule entry matching the target image
3. Read the pinned commit from the release repo tree (git ls-tree HEAD <submodule-path>) — do not clone from the .gitmodules branch field alone
4. Clone the component repo and check out that pinned commit for analysis

# Step 1: Clone release repo at correct branch (per-run path under REPOS_BASE)
RELEASE_CLONE_DIR="${REPOS_BASE}/.release-clones/$(echo "${RELEASE_REPO_URL}" | sed -E 's#^[a-zA-Z]+://github\.com/##; s#\.git$##; s#/$##' | tr '/' '-')-${RELEASE_BRANCH}"
rm -rf "${RELEASE_CLONE_DIR}"
mkdir -p "$(dirname "${RELEASE_CLONE_DIR}")"
git clone --depth=1 -b "${RELEASE_BRANCH}" "${RELEASE_REPO_URL}" "${RELEASE_CLONE_DIR}"

# Step 2: Read .gitmodules
cat "${RELEASE_CLONE_DIR}/.gitmodules"

# Step 3: Extract submodule path + url from .gitmodules
# Step 4: Read pinned commit from release repo tree
PINNED_COMMIT=$(git -C "${RELEASE_CLONE_DIR}" ls-tree HEAD "${SUBMODULE_PATH}" | awk '{print $3}')
if [ -z "${PINNED_COMMIT}" ]; then
  echo "ERROR: no pinned commit found for ${SUBMODULE_PATH}"
  exit 1
fi

# Step 5: Clone component repo and checkout pinned commit (fetch SHA explicitly — shallow clone alone may miss it)
git clone "${COMPONENT_URL}" "${REPO_DIR}"
git -C "${REPO_DIR}" fetch origin "${PINNED_COMMIT}"
git -C "${REPO_DIR}" checkout "${PINNED_COMMIT}"

Jira branch → release branch naming for Pattern B:

Note: Jira branch values use hyphens for separators (e.g. external-secrets-1-0) while release branches use dots (e.g. release-1.0). Strip the component prefix and convert the remaining hyphen-separated version to dot notation.

Image → Repository Map

Every image name here has appeared in real ticket summaries or labels. This table is intentionally scoped to the components this command has been validated against — extend it as new components come up (see the not-found exit message above).

cert-manager / jetstack — Pattern B (release repo + submodules)

Release repo: https://github.com/openshift/cert-manager-operator-release Submodules: cert-manager-operator, cert-manager, cert-manager-istio-csr Branch mapping: Jira cert-manager-X-Y → release-X.Y in the release repo

Clone the release repo at the correct branch, read .gitmodules to find the submodule URL and pinned ref for the target image, then clone that component at the pinned ref.

cert-manager-operator (operator + bundle only)

cert-manager-istio-csr

jetstack-cert-manager

Namespace prefix match: cert-manager → requires full image name lookup above (multiple repos in this namespace). Keyword match: cert-manager-operator / cert-manager-operator-bundle → cert-manager-operator; cert-manager-istio-csr → cert-manager-istio-csr; jetstack-cert-manager → jetstack-cert-manager.

Operator SDK / Helm Operator (non-ansible images)