RHAIENG-5164: build: remove Dockerfile symlinks and rename KONFLUX to PRODUCT (#3984)

Complete PR2 cleanup after Dockerfile.konflux.* migration: drop legacy
Dockerfile.cpu|cuda|rocm symlinks, remove the alignment checker, rename
KONFLUX=yes|no to PRODUCT=odh|rhoai, and update CI helpers, workflows,
and docs accordingly.

* RHAIENG-5164: fix: detect Dockerfile.konflux.* flavors in pylocks_generator

After symlink removal, detect_flavors() still looked for Dockerfile.cpu
and siblings, so generate_code.sh found no flavors and failed lock
generation for every notebook image.

* RHAIENG-5164: test: address CodeRabbit review on symlink tests

Clear _symlink_reverse_map after pyfakefs teardown, exercise
should_build_target via dependency matching (not directory short-circuit),
and drop stale alignment-check mention from testing docs.

* RHAIENG-5164: test: clear symlink cache via request.addfinalizer

Use request.addfinalizer instead of a yield teardown; monkeypatch has
no addfinalizer API.

* RHAIENG-5164: fix: keep pytest out of gha_pr_changed_files import path

GHA resolves COMPONENT_DIR via plain python3 without dev deps; move
pyfakefs symlink tests to gha_pr_changed_files_symlink_test.py.

* RHAIENG-5164: chore: fix ruff import order and lockfile README

Ruff wants local imports before pytest in symlink test module. Also
align lockfile manual podman example with konflux.cpu.conf.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: jiridanek

.github/workflows/build-notebooks-TEMPLATE.yaml

@@ -28,11 +28,11 @@ name: Build & Publish Notebook Servers (TEMPLATE)
         default: false
         description: "add RHEL subscription from github secret"
         type: boolean
-      konflux:
+      product:
         required: false
-        default: false
-        description: "build from Dockerfile.konflux.* instead of Dockerfile.*"
-        type: boolean
+        default: odh
+        description: "product variant: odh (midstream) or rhoai (downstream)"
+        type: string
       PLATFORM_RUNNERS:
         required: false
         # language=json
@@ -48,7 +48,7 @@ name: Build & Publish Notebook Servers (TEMPLATE)
 
 jobs:
   build:
-    name: "${{ inputs.konflux && 'rhoai' || 'odh' }}"
+    name: "${{ inputs.product }}"
     # https://docs.github.com/en/actions/how-tos/using-github-hosted-runners/using-github-hosted-runners/about-github-hosted-runners#standard-github-hosted-runners-for-public-repositories
     runs-on: ${{ fromJSON(inputs.PLATFORM_RUNNERS)[inputs.platform] || 'no-such-runner' }}
     env:
@@ -195,7 +195,7 @@ jobs:
           TARGET: ${{ inputs.target }}
           REGISTRY: ${{ env.IMAGE_REGISTRY }}
           PLATFORM: ${{ inputs.platform }}
-          KONFLUX: ${{ inputs.konflux }}
+          PRODUCT: ${{ inputs.product }}
         # language=python
         run: |
           import os, re, sys
@@ -208,7 +208,7 @@ jobs:
               TARGET: str
               REGISTRY: str
               PLATFORM: str
-              KONFLUX: str
+              PRODUCT: str
 
               @classmethod
               def from_env(cls):
@@ -228,7 +228,7 @@ jobs:
 
           # Build a suffix from build type and platform so that different
           # odh/rhoai builds and architectures get distinct tags.
-          build_type = "rhoai" if env.KONFLUX == "true" else "odh"
+          build_type = env.PRODUCT
           suffix = f"{build_type}_{sanitized_platform}"
 
           # 7-char SHA prefix is enough to identify a commit uniquely
@@ -431,7 +431,7 @@ jobs:
           CONTAINER_BUILD_CACHE_ARGS: "${{ steps.extra-container-build-args.outputs.CONTAINER_BUILD_CACHE_ARGS }} ${{ steps.prefetch.outputs.EXTRA_BUILD_ARGS }}"
           # We don't have access to image registry for PRs, so disable pushing
           PUSH_IMAGES: "${{ (fromJson(inputs.github).event_name == 'pull_request' || fromJson(inputs.github).event_name == 'pull_request_target') && 'no' || 'yes' }}"
-          KONFLUX: "${{ inputs.konflux && 'yes' || 'no' }}"
+          PRODUCT: ${{ inputs.product }}
 
       - name: "Show podman images information"
         run: podman images --digests
@@ -531,7 +531,7 @@ jobs:
           IMAGE_TAG: "${{ steps.calculated_vars.outputs.IMAGE_TAG }}"
           # for make deploy, mandatory to specify for the more exotic cases
           NOTEBOOK_TAG: "${{ inputs.target }}-${{ steps.calculated_vars.outputs.IMAGE_TAG }}"
-          KONFLUX: "${{ inputs.konflux && 'yes' || 'no' }}"
+          PRODUCT: ${{ inputs.product }}
 
       # endregion
 

.github/workflows/build-notebooks-pr-aipcc.yaml

@@ -119,5 +119,5 @@ jobs:
       platform: "${{ matrix.platform }}"
       # rhds/notebooks builds from AIPCC base images that are RHEL-based
       subscription: ${{ true }}
-      konflux: ${{ true }}
+      product: rhoai
     secrets: inherit

.github/workflows/build-notebooks-pr.yaml

@@ -113,5 +113,5 @@ jobs:
       github: "${{ toJSON(github) }}"
       platform: "${{ matrix.platform }}"
       subscription: ${{ true }}
-      konflux: ${{ true }}
+      product: rhoai
     secrets: inherit

.github/workflows/build-notebooks-push.yaml

@@ -81,5 +81,5 @@ jobs:
       platform: "${{ matrix.platform }}"
       # rhds/notebooks builds from AIPCC base images that are RHEL-based
       subscription: ${{ true }}
-      konflux: ${{ true }}
+      product: rhoai
     secrets: inherit

.github/workflows/params-env.yaml

@@ -32,10 +32,10 @@ jobs:
         include:
           - variant: odh
             packages: skopeo jq
-            konflux: ''
+            product: odh
           - variant: rhoai
             packages: skopeo jq git-crypt
-            konflux: 'yes'
+            product: rhoai
     name: validation-of-params-env-${{ matrix.variant }}
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
@@ -73,4 +73,4 @@ jobs:
         run: |
           bash ./ci/check-params-env.sh
         env:
-          KONFLUX: ${{ matrix.konflux }}
+          PRODUCT: ${{ matrix.product }}

AGENTS.md

@@ -59,7 +59,7 @@ that embeds that stage. Do not assume there is one shared parent image definitio
 
 ### ODH vs RHOAI builds
 
-`KONFLUX` selects the product variant (ODH midstream vs RHOAI downstream), not whether
+`PRODUCT` selects the product variant (ODH midstream vs RHOAI downstream), not whether
 the build runs on Konflux/Tekton. ODH workbenches stack on c9s odh-base-images;
 RHOAI stacks on RHEL 9.6 AIPCC bases (`ubi9-python-*` paths are EL9 naming only).
 See [ARCHITECTURE.md](ARCHITECTURE.md) for details and
@@ -85,7 +85,7 @@ make refresh-lock-files
 
 ## Boundaries
 
-- **Always:** Run `make test` after Dockerfile or dependency changes. Keep `KONFLUX`
+- **Always:** Run `make test` after Dockerfile or dependency changes. Keep `PRODUCT`
   consistent across `make <target>` and `make test-<target>`. Override the entrypoint
   when inspecting images (`podman run --rm -it --entrypoint="" <image> bash`).
 - **Ask first:** Adding new base images, changing CI workflow structure, modifying
@@ -108,9 +108,9 @@ Use formatting: bold, italics and code blocks.
   Without this, arguments are ignored and Jupyter starts.
 - One-off commands (no interactive shell):
   `podman run --rm --entrypoint="" <image> rpm -qa | sort`
-- `KONFLUX` must match between `make <target>` and `make test-<target>`.
+- `PRODUCT` must match between `make <target>` and `make test-<target>`.
   Mismatches cause version assertion failures because the test reads the
-  imagestream manifest selected by `KONFLUX`.
+  imagestream manifest selected by `PRODUCT`.
 - Python 3.14: `except ExcA, ExcB:` (no parentheses) is valid when there is no
   `as` clause (PEP 758). Ruff format enforces this style. Parentheses are still
   required when binding: `except (ExcA, ExcB) as e:`.
@@ -127,7 +127,7 @@ Most dependency/CVE work is `chore`. See `.coderabbit.yaml` for validation rules
 ## Repo-specific reminders
 
 - Use `uv` and `make refresh-lock-files`. Keep dependency guidance aligned with current repo tooling.
-- For local testing gotchas such as worktree naming, `pyfakefs`, `KONFLUX` matching, and CI `-n` metadata,
+- For local testing gotchas such as worktree naming, `pyfakefs`, `PRODUCT` matching, and CI `-n` metadata,
   see [CONTRIBUTING.md](CONTRIBUTING.md).
 - For GitHub Actions changes, run the SHA pinning flow in [`.github/AGENTS.md`](.github/AGENTS.md).
 - For browser tests, follow [`tests/browser/AGENTS.md`](tests/browser/AGENTS.md) instead of inventing local conventions.

ARCHITECTURE.md

@@ -86,17 +86,16 @@ make all-images                              # build everything
 make test                                    # run quick static tests (pytest + lint)
 ```
 
-The `KONFLUX` Makefile variable selects the **product variant**, not whether the build
+The `PRODUCT` Makefile variable selects the **product variant**, not whether the build
 runs on Konflux/Tekton:
 
-- **ODH mode** (default: `KONFLUX=no` or unset): uses `build-args/<variant>.conf`
+- **ODH** (default: `PRODUCT=odh` or unset): uses `build-args/<variant>.conf`
   and `manifests/odh/`
-- **RHOAI mode** (`KONFLUX=yes`): uses `build-args/konflux.<variant>.conf`
+- **RHOAI** (`PRODUCT=rhoai`): uses `build-args/konflux.<variant>.conf`
   and `manifests/rhoai/`
 
-Since RHAIENG-4516, `Dockerfile.<variant>` paths and `Dockerfile.konflux.<variant>`
-paths resolve to the same content, so the meaningful difference is the selected
-build-args file and manifest set rather than a separate Dockerfile implementation.
+Each notebook image uses a single `Dockerfile.konflux.<variant>`; `PRODUCT` selects
+which build-args conf file and manifest set the Makefile passes to the build.
 Both variants can be built locally or on Konflux/Tekton.
 
 ### OpenShift file ownership during image build (#3928)
@@ -112,9 +111,6 @@ Leaf stages do not run full-tree `fix-permissions`. Paths outside site-packages
 build steps create directly (e.g. `jupyter_server_config.py`, `labconfig/`, `pf.css`
 from `apply.sh`) get explicit modes or `chmod` at creation time; see [#3928](https://github.com/opendatahub-io/notebooks/issues/3928).
 
-Non-konflux `Dockerfile.cpu|cuda|rocm` paths are symlinks to `Dockerfile.konflux.*` and
-inherit the same ownership model.
-
 ## Testing layers
 
 | Layer | Location | What it tests | How to run |

CONTRIBUTING.md

@@ -146,16 +146,16 @@ make test-${NOTEBOOK_NAME}
 
 #### ODH vs RHOAI local builds
 
-`KONFLUX` selects the product variant, not whether the build runs on Konflux/Tekton.
+`PRODUCT` selects the product variant, not whether the build runs on Konflux/Tekton.
 Both variants are built on Konflux in CI; the variable changes which `build-args/*.conf`
 and manifest tree the Makefile uses locally.
 
-| `KONFLUX` value | Product variant | Build args | Manifests |
+| `PRODUCT` value | Product variant | Build args | Manifests |
 |-----------------|-----------------|------------|-----------|
-| unset or `no` | ODH (midstream default) | `build-args/<variant>.conf` | `manifests/odh/` |
-| `yes` | RHOAI downstream | `build-args/konflux.<variant>.conf` | `manifests/rhoai/` |
+| unset or `odh` | ODH (midstream default) | `build-args/<variant>.conf` | `manifests/odh/` |
+| `rhoai` | RHOAI downstream | `build-args/konflux.<variant>.conf` | `manifests/rhoai/` |
 
-Keep the same `KONFLUX` value for both the build step and the matching `make test-*`
+Keep the same `PRODUCT` value for both the build step and the matching `make test-*`
 step so the imagestream manifests and expected package versions line up.
 
 For deeper references:

Makefile

@@ -31,8 +31,11 @@ CONTAINER_BUILD_SECURITY_ARGS ?= $(if $(filter podman,$(CONTAINER_ENGINE)),--sec
 PUSH_IMAGES ?= yes
 # INDEX_MODE: auto (default), public-index, or rh-index - controls lock file generation
 INDEX_MODE ?= auto
-# KONFLUX: select RHOAI build-args (konflux.*.conf) vs ODH (default: no)
-KONFLUX ?= no
+# PRODUCT: select ODH (odh) vs RHOAI (rhoai) build-args conf files
+PRODUCT ?= odh
+ifneq ($(filter odh rhoai,$(PRODUCT)),$(PRODUCT))
+$(error PRODUCT must be 'odh' or 'rhoai', got '$(PRODUCT)')
+endif
 
 
 # OS dependant: Generate date, select appropriate cmd to locate container engine
@@ -153,7 +156,7 @@ define image
 	$(eval DOCKERFILE := $(BUILD_DIRECTORY)/Dockerfile.konflux.$(VARIANT))
 	$(if $(wildcard $(DOCKERFILE)),,$(error Dockerfile not found for variant '$(VARIANT)' in '$(BUILD_DIRECTORY)'))
 
-	$(eval CONF_FILE := $(BUILD_DIRECTORY)/build-args/$(if $(KONFLUX:no=),konflux.,$(empty))$(shell echo $(VARIANT)).conf)
+	$(eval CONF_FILE := $(BUILD_DIRECTORY)/build-args/$(if $(filter rhoai,$(PRODUCT)),konflux.,)$(shell echo $(VARIANT)).conf)
 	$(info #*# Image build Dockerfile: <$(DOCKERFILE)> #(MACHINE-PARSED LINE)#*#...)
 	$(info #*# Image build directory: <$(BUILD_DIRECTORY)> #(MACHINE-PARSED LINE)#*#...)
 
@@ -529,7 +532,6 @@ validate-renovate-config:
 test:
 	@echo "Running quick static tests"
 	uv run pytest -m 'not buildonlytest'
-	@./scripts/check_dockerfile_alignment.sh
 
 .PHONY: check-actions
 check-actions:

ci/cached-builds/gen_gha_matrix_jobs.py

@@ -215,7 +215,7 @@ class TestSelf(unittest.TestCase):
     def test_select_changed_targets_dockerfile(self):
         targets = extract_image_targets(makefile_dir=project_dir)
 
-        changed_files = ["jupyter/datascience/ubi9-python-3.12/Dockerfile.cpu"]
+        changed_files = ["jupyter/datascience/ubi9-python-3.12/Dockerfile.konflux.cpu"]
 
         targets = gha_pr_changed_files.filter_out_unchanged(targets, changed_files)
         assert set(targets) == {"jupyter-datascience-ubi9-python-3.12"}