3.1 Golden-path source

Overview

Application source must live on in-cluster Gitea in organization lw-student. It must not live on GitHub. It must not stay under workshop-templates. The scored remote is lw-student/spring-boot-lw-poc (student_repo_url).

The scored path is the seed script. That script also adds renovate-bot, which 3.3 requires. Red Hat Developer Hub (RHDH) lightwell-java-service is an optional golden path, not this Check.

Do not change Dockerfile FROM here. That is 3.2. Do not merge a fake Renovate PR. That is 3.3.

Why it matters

Pins and FROM lines only count if later Checks can see them on a remote you own. Operator templates are a starting tree. Your org is where you pin, promote, and prove the rest of the chain.

Lightwell Network and Clearinghouse Premier do not host application source. They supply the GAVs you will commit in 3.2 and that Renovate will bump in 3.3. Premier member remediations still require this remote on your git.

What does it solve

  • Application source that is not yours to pin and promote

  • Cloning GitHub in the lab

  • Shipping from operator templates

Why your git

You do not ship from an operator template. The golden path copies a prepared tree into your org. After that you own every later commit (pins, FROM, pipeline, GitOps).

workshop-templates versus your lw-student remotes

Discover Gitea (never paste a hostname from this page)

oc -n gitea get configmap demo-userinfo-gitea \
  -o jsonpath='gitea_url={.data.gitea_url}{"\n"}user={.data.student_username}{"\n"}org={.data.student_gitea_org}{"\n"}app={.data.student_repo_url}{"\n"}templates={.data.template_app_repo_url}{"\n"}password={.data.student_password}{"\n"}'

Expect user student and org lw-student. The Gitea password is the value of ConfigMap key student_password (not the key name). Do not put that value in Git or a screenshot.

Ensure the Gitea user can sign in (no-op if the seed Job already created the account)
export STUDENT_USER=student
: "${STUDENT_PASS:=$(oc -n gitea get configmap demo-userinfo-gitea -o jsonpath='{.data.student_password}')}"
: "${GITEA_URL:=$(oc -n gitea get configmap demo-userinfo-gitea -o jsonpath='{.data.gitea_url}')}"

oc -n gitea get configmap gitea-student-repo-seed \
  -o jsonpath='{.data.learner-ensure-gitea-user\.sh}' > /tmp/learner-ensure-gitea-user.sh
chmod +x /tmp/learner-ensure-gitea-user.sh
/tmp/learner-ensure-gitea-user.sh

Open gitea_url and sign in as student with the password value from that ConfigMap.

Worked example (not the Check)

GitHub or the operator template org. If student_repo_url still points here, the Check fails.

# Worked example ONLY — not the scored remote.
git clone https://github.com/example/spring-boot-lw-poc.git
# or: git clone <template_app_repo_url>   # workshop-templates, not lw-student

Your change: org, empty repos, seed script

  1. In Gitea: + → New Organization. Name exactly lw-student. Visibility Public → Create Organization.

Gitea New Organization form with name lw-student

  1. Under lw-student, create three empty repositories (do not initialize with a README):

    • spring-boot-lw-poc

    • gitops-spring-boot-lw-poc (stage)

    • gitops-prod-spring-boot-lw-poc (prod)

  2. Seed from templates (adds renovate-bot as a write collaborator on the app repo):

export STUDENT_USER=student
: "${STUDENT_PASS:=$(oc -n gitea get configmap demo-userinfo-gitea -o jsonpath='{.data.student_password}')}"
: "${GITEA_URL:=$(oc -n gitea get configmap demo-userinfo-gitea -o jsonpath='{.data.gitea_url}')}"

oc -n gitea get configmap gitea-student-repo-seed \
  -o jsonpath='{.data.learner-seed-from-templates\.sh}' > /tmp/learner-seed.sh
chmod +x /tmp/learner-seed.sh
/tmp/learner-seed.sh

Check: your remote exists and is not the template org

oc -n gitea get configmap demo-userinfo-gitea \
  -o jsonpath='{.data.student_repo_url}{"\n"}{.data.template_app_repo_url}{"\n"}'
curl -sk -o /dev/null -w "%{http_code}\n" \
  "$(oc -n gitea get configmap demo-userinfo-gitea -o jsonpath='{.data.student_repo_url}')"

Expect HTTP 200 on student_repo_url. Open lw-student/spring-boot-lw-poc and confirm pom.xml is at the repository root. Default <commons.lang3.version> is still the affected upstream 3.14.0 (not 3.18.0, not yet 3.14.0.rhlw-00001). workshop-templates is not the scored remote.

Seeded lw-student spring-boot-lw-poc repository root showing pom.xml
Fill the report

The Job also grades ConfigMap report-05-golden-path-source key git_home. Set it to gitea-not-github. Empty or REPLACE_ME fails even if cluster state is correct. Do not copy validate-docs.

oc -n lw-poc-validate edit configmap report-05-golden-path-source

The scored Check is Job validate-05-golden-path-source in lw-poc-validate. Direct nav URLs still work (honor system). Unlimited retries. There is no Solve.

Run the Validate Job
oc -n lw-poc-validate delete job validate-05-golden-path-source --ignore-not-found
TPL='job-05.yaml'
oc -n lw-poc-validate get configmap validate-job-templates \
  -o go-template="{{ index .data \"${TPL}\" }}" | oc create -f -
oc -n lw-poc-validate logs -f job/validate-05-golden-path-source

Expect CHECK PASSED: before you continue. CHECK FAILED: names the object to fix. Delete the Job and create it again as often as you need.

Honor system: 3.2 still opens. The Validate Job grades the Gitea remotes, not a screenshot.

Callout: RHDH (optional)

Software Template lightwell-java-service can publish into the same org. It is not required for this Check. lightwell-python-service is the same golden-path idea (requirements.txt at repo root). That template is not enabled on this cluster.

Official documentation

Key takeaways

  • TSSC source of truth is your git. Golden path is Gitea plus templates (or RHDH), not a zip from GitHub.

  • Lightwell Network / Clearinghouse Premier GAVs are committed in 3.2. renovate-bot on the app repo is a side effect of seed (3.3 scores the PR).

cd ~/ocp5-rhacs-showroom
bash setup/lab-cleanup.sh --module tssc-05