qontract-reconcile 0.9.1rc298__py3-none-any.whl → 0.10.1.dev1203__py3-none-any.whl

reconcile/utils/saasherder/saasherder.py

@@ -5,22 +5,22 @@ import json
 import logging
 import os
 import re
-from collections import ChainMap
+from collections import (
+    ChainMap,
+    defaultdict,
+)
 from collections.abc import (
+    Generator,
     Iterable,
     Mapping,
     MutableMapping,
     Sequence,
 )
 from contextlib import suppress
+from datetime import UTC, datetime, timedelta
 from types import TracebackType
-from typing import (
-    Any,
-    Generator,
-    Optional,
-    Type,
-    Union,
-)
+from typing import Any
+from urllib.parse import urlparse
 
 import yaml
 from github import (
@@ -39,10 +39,10 @@ from sretoolbox.utils import (
 
 from reconcile.github_org import get_default_config
 from reconcile.status import RunningState
+from reconcile.utils import helm
 from reconcile.utils.gitlab_api import GitLabApi
 from reconcile.utils.jenkins_api import JenkinsApi
 from reconcile.utils.jjb_client import JJB
-from reconcile.utils.mr.base import MRClient
 from reconcile.utils.oc import (
     OCLocal,
     StatusCodeError,
@@ -51,6 +51,7 @@ from reconcile.utils.openshift_resource import OpenshiftResource as OR
 from reconcile.utils.openshift_resource import (
     ResourceInventory,
     ResourceKeyExistsError,
+    ResourceNotManagedError,
     fully_qualified_kind,
 )
 from reconcile.utils.promotion_state import (
@@ -58,8 +59,6 @@ from reconcile.utils.promotion_state import (
     PromotionState,
 )
 from reconcile.utils.saasherder.interfaces import (
-    HasParameters,
-    HasSecretParameters,
     SaasFile,
     SaasParentSaasPromotion,
     SaasResourceTemplate,
@@ -69,6 +68,7 @@ from reconcile.utils.saasherder.interfaces import (
     SaasSecretParameters,
 )
 from reconcile.utils.saasherder.models import (
+    Channel,
     ImageAuth,
     Namespace,
     Promotion,
@@ -87,7 +87,8 @@ from reconcile.utils.state import State
 TARGET_CONFIG_HASH = "target_config_hash"
 
 
-UNIQUE_SAAS_FILE_ENV_COMBO_LEN = 50
+UNIQUE_SAAS_FILE_ENV_COMBO_LEN = 56
+REQUEST_TIMEOUT = 60
 
 
 def is_commit_sha(ref: str) -> bool:
@@ -95,7 +96,8 @@ def is_commit_sha(ref: str) -> bool:
     return bool(re.search(r"^[0-9a-f]{40}$", ref))
 
 
-RtRef = tuple[str, str, str]
+# saas_name, resource_template_name, resource_template_url, target_uid
+RtRef = tuple[str, str, str, str]
 Resource = dict[str, Any]
 Resources = list[Resource]
 
@@ -112,15 +114,17 @@ class SaasHerder:  # pylint: disable=too-many-public-methods
         secret_reader: SecretReaderBase,
         hash_length: int,
         repo_url: str,
-        gitlab: Optional[GitLabApi] = None,
-        jenkins_map: Optional[dict[str, JenkinsApi]] = None,
-        state: Optional[State] = None,
+        gitlab: GitLabApi | None = None,
+        jenkins_map: dict[str, JenkinsApi] | None = None,
+        state: State | None = None,
         validate: bool = False,
         include_trigger_trace: bool = False,
+        all_saas_files: Iterable[SaasFile] | None = None,
     ):
         self.error_registered = False
         self.saas_files = saas_files
         self.repo_urls = self._collect_repo_urls()
+        self.image_patterns = self._collect_image_patterns()
         self.resolve_templated_parameters(self.saas_files)
         if validate:
             self._validate_saas_files()
@@ -138,6 +142,10 @@ class SaasHerder:  # pylint: disable=too-many-public-methods
         self.include_trigger_trace = include_trigger_trace
         self.state = state
         self._promotion_state = PromotionState(state=state) if state else None
+        self._channel_map = self._assemble_channels(saas_files=all_saas_files)
+        self.images: set[str] = set()
+        self.blocked_versions = self._collect_blocked_versions()
+        self.hotfix_versions = self._collect_hotfix_versions()
 
         # each namespace is in fact a target,
         # so we can use it to calculate.
@@ -151,15 +159,18 @@ class SaasHerder:  # pylint: disable=too-many-public-methods
         self.compare = self._get_saas_file_feature_enabled("compare", default=True)
         self.publish_job_logs = self._get_saas_file_feature_enabled("publish_job_logs")
         self.cluster_admin = self._get_saas_file_feature_enabled("cluster_admin")
+        self.validate_planned_data = self._get_saas_file_feature_enabled(
+            "validate_planned_data", default=True
+        )
 
     def __enter__(self) -> "SaasHerder":
         return self
 
     def __exit__(
         self,
-        exc_type: Optional[Type[BaseException]],
-        exc_value: Optional[BaseException],
-        traceback: Optional[TracebackType],
+        exc_type: type[BaseException] | None,
+        exc_value: BaseException | None,
+        traceback: TracebackType | None,
     ) -> None:
         self.cleanup()
 
@@ -189,8 +200,8 @@ class SaasHerder:  # pylint: disable=too-many-public-methods
                     yield (saas_file, resource_template, target)
 
     def _get_saas_file_feature_enabled(
-        self, name: str, default: Optional[bool] = None
-    ) -> Optional[bool]:
+        self, name: str, default: bool | None = None
+    ) -> bool | None:
         """Returns a bool indicating if a feature is enabled in a saas file,
         or a supplied default. Returns False if there are multiple
         saas files in the process.
@@ -231,26 +242,34 @@ class SaasHerder:  # pylint: disable=too-many-public-methods
                     f"secret parameter path '{sp.secret.path}' does not match any of allowedSecretParameterPaths"
                 )
 
+    def _validate_target_in_app(
+        self, saas_file: SaasFile, target: SaasResourceTemplateTarget
+    ) -> None:
+        if saas_file.validate_targets_in_app:
+            valid_app_names = {saas_file.app.name}
+            if saas_file.app.parent_app:
+                valid_app_names.add(saas_file.app.parent_app.name)
+            if target.namespace.app.name not in valid_app_names:
+                logging.error(
+                    f"[{saas_file.name}] all targets (i.e., namespaces that you deploy to) within the saas file '{saas_file.name}' must belong to app(s) {valid_app_names}. However, your saas file also deploys to namespace '{target.namespace.name}' which belongs to app '{target.namespace.app.name}'."
+                )
+                self.valid = False
+
     def _validate_saas_files(self) -> None:
         self.valid = True
         saas_file_name_path_map: dict[str, list[str]] = {}
         tkn_unique_pipelineruns: dict[str, str] = {}
 
-        publications: dict[str, RtRef] = {}
-        subscriptions: dict[str, list[RtRef]] = {}
+        publications: dict[str, set[RtRef]] = defaultdict(set)
+        subscriptions: dict[str, list[RtRef]] = defaultdict(list)
 
         for saas_file in self.saas_files:
             saas_file_name_path_map.setdefault(saas_file.name, [])
             saas_file_name_path_map[saas_file.name].append(saas_file.path)
 
-            saas_file_owners = [
-                u.org_username
-                for r in saas_file.self_service_roles or []
-                for u in list(r.users) + list(r.bots)
-            ]
-            if not saas_file_owners:
+            if not saas_file.app.self_service_roles:
                 logging.error(
-                    f"saas file {saas_file.name} has no owners: {saas_file.path}"
+                    f"app {saas_file.app.name} has no self-service roles (saas file {saas_file.name})"
                 )
                 self.valid = False
 
@@ -309,12 +328,17 @@ class SaasHerder:  # pylint: disable=too-many-public-methods
                         target.namespace.environment.secret_parameters or [],
                         saas_file.allowed_secret_parameter_paths or [],
                     )
+                    self._validate_target_in_app(saas_file, target)
 
                     if target.promotion:
                         rt_ref = (
                             saas_file.path,
                             resource_template.name,
                             resource_template.url,
+                            target.uid(
+                                parent_saas_file_name=saas_file.name,
+                                parent_resource_template_name=resource_template.name,
+                            ),
                         )
 
                         # Get publications and subscriptions for the target
@@ -395,7 +419,7 @@ class SaasHerder:  # pylint: disable=too-many-public-methods
         self,
         rt_ref: RtRef,
         promotion: SaasResourceTemplateTargetPromotion,
-        publications: MutableMapping[str, RtRef],
+        publications: MutableMapping[str, set[RtRef]],
         subscriptions: MutableMapping[str, list[RtRef]],
     ) -> None:
         """
@@ -403,23 +427,23 @@ class SaasHerder:  # pylint: disable=too-many-public-methods
         It validates a publish channel is unique across all publish targets.
         """
         for channel in promotion.publish or []:
-            if channel in publications:
+            if rt_ref in publications[channel]:
                 self.valid = False
+                # This should never be possible theoretically ...
                 logging.error(
-                    "saas file promotion publish channel"
-                    "is not unique: {}".format(channel)
+                    f"Non-unique resource template reference {rt_ref} in "
+                    f"channel {channel}"
                 )
                 continue
-            publications[channel] = rt_ref
+            publications[channel].add(rt_ref)
 
         for channel in promotion.subscribe or []:
-            subscriptions.setdefault(channel, [])
             subscriptions[channel].append(rt_ref)
 
     def _check_promotions_have_same_source(
         self,
         subscriptions: Mapping[str, list[RtRef]],
-        publications: Mapping[str, RtRef],
+        publications: Mapping[str, set[RtRef]],
     ) -> None:
         """
         Function to check that a promotion has the same repository
@@ -427,52 +451,58 @@ class SaasHerder:  # pylint: disable=too-many-public-methods
         """
 
         for sub_channel, sub_targets in subscriptions.items():
-            pub_channel_ref = publications.get(sub_channel)
-            if not pub_channel_ref:
-                self.valid = False
-            else:
-                (pub_saas, pub_rt_name, pub_rt_url) = pub_channel_ref
-
-            for sub_saas, sub_rt_name, sub_rt_url in sub_targets:
-                if not pub_channel_ref:
+            pub_channel_refs = publications.get(sub_channel, set())
+            for sub_saas, sub_rt_name, sub_rt_url, _ in sub_targets:
+                if not pub_channel_refs:
+                    self.valid = False
                     logging.error(
                         "Channel is not published by any target\n"
-                        "subscriber_saas: {}\n"
-                        "subscriber_rt: {}\n"
-                        "channel: {}".format(sub_saas, sub_rt_name, sub_channel)
+                        f"subscriber_saas: {sub_saas}\n"
+                        f"subscriber_rt: {sub_rt_name}\n"
+                        f"channel: {sub_channel}"
                     )
-                else:
+                for pub_ref in pub_channel_refs:
+                    (pub_saas, pub_rt_name, pub_rt_url, _) = pub_ref
                     if sub_rt_url != pub_rt_url:
                         self.valid = False
                         logging.error(
                             "Subscriber and Publisher targets have different "
                             "source repositories\n"
-                            "publisher_saas: {}\n"
-                            "publisher_rt: {}\n"
-                            "publisher_repo: {}\n"
-                            "subscriber_saas: {}\n"
-                            "subscriber_rt: {}\n"
-                            "subscriber_repo: {}\n".format(
-                                pub_saas,
-                                pub_rt_name,
-                                pub_rt_url,
-                                sub_saas,
-                                sub_rt_name,
-                                sub_rt_url,
-                            )
+                            f"publisher_saas: {pub_saas}\n"
+                            f"publisher_rt: {pub_rt_name}\n"
+                            f"publisher_repo: {pub_rt_url}\n"
+                            f"subscriber_saas: {sub_saas}\n"
+                            f"subscriber_rt: {sub_rt_name}\n"
+                            f"subscriber_repo: {sub_rt_url}\n"
                         )
 
+    @staticmethod
+    def build_saas_file_env_combo(
+        saas_file_name: str,
+        env_name: str,
+    ) -> tuple[str, str]:
+        """
+        Build a tuple of short and long names for a saas file and environment combo,
+        max tekton pipelinerun name length can be 63,
+        leaving 7 for the rerun leaves us with 56 to create a unique pipelinerun name.
+
+        :param saas_file_name: name of the saas file
+        :param env_name: name of the environment
+        :return: (tkn_name, tkn_long_name)
+        """
+        tkn_long_name = f"{saas_file_name}-{env_name}"
+        tkn_name = tkn_long_name[:UNIQUE_SAAS_FILE_ENV_COMBO_LEN].rstrip("-")
+        return tkn_name, tkn_long_name
+
     def _check_saas_file_env_combo_unique(
         self,
         saas_file_name: str,
         env_name: str,
         tkn_unique_pipelineruns: Mapping[str, str],
     ) -> tuple[str, str]:
-        # max tekton pipelinerun name length can be 63.
-        # leaving 12 for the timestamp leaves us with 51
-        # to create a unique pipelinerun name
-        tkn_long_name = f"{saas_file_name}-{env_name}"
-        tkn_name = tkn_long_name[:UNIQUE_SAAS_FILE_ENV_COMBO_LEN]
+        tkn_name, tkn_long_name = self.build_saas_file_env_combo(
+            saas_file_name, env_name
+        )
         if (
             tkn_name in tkn_unique_pipelineruns
             and tkn_unique_pipelineruns[tkn_name] != tkn_long_name
@@ -663,43 +693,24 @@ class SaasHerder:  # pylint: disable=too-many-public-methods
                             environment=target.namespace.environment,
                             app=target.namespace.app,
                             cluster=target.namespace.cluster,
-                            # managedResourceTypes is defined per saas_file
-                            # add it to each namespace in the current saas_file
+                            # managedResourceTypes and managedResourceNames are defined per saas_file
+                            # add them to each namespace in the current saas_file
                             managed_resource_types=saas_file.managed_resource_types,
+                            managed_resource_names=saas_file.managed_resource_names,
                         )
                     )
         return namespaces
 
     def _collect_repo_urls(self) -> set[str]:
-        return set(
+        return {
             rt.url
             for saas_file in self.saas_files
             for rt in saas_file.resource_templates
-        )
-
-    @staticmethod
-    def _collect_parameters(container: HasParameters) -> dict[str, str]:
-        parameters = container.parameters or {}
-        if isinstance(parameters, str):
-            parameters = json.loads(parameters)
-        # adjust Python's True/False
-        for k, v in parameters.items():
-            if v is True:
-                parameters[k] = "true"
-            elif v is False:
-                parameters[k] = "false"
-            elif any(isinstance(v, t) for t in [dict, list, tuple]):
-                parameters[k] = json.dumps(v)
-        return parameters
-
-    def _collect_secret_parameters(
-        self, container: HasSecretParameters
-    ) -> dict[str, str]:
-        return {
-            sp.name: self.secret_reader.read_secret(sp.secret)
-            for sp in container.secret_parameters or []
         }
 
+    def _collect_image_patterns(self) -> set[str]:
+        return {p for sf in self.saas_files for p in sf.image_patterns}
+
     @staticmethod
     def _get_file_contents_github(repo: Repository, path: str, commit_sha: str) -> str:
         f = repo.get_contents(path, commit_sha)
@@ -718,11 +729,31 @@ class SaasHerder:  # pylint: disable=too-many-public-methods
 
         return ""
 
+    @retry(max_attempts=20)
+    def get_archive_info(
+        self,
+        saas_file: SaasFile,
+        trigger_reason: str,
+    ) -> tuple[str, str]:
+        [url, sha] = trigger_reason.split(" ")[0].split("/commit/")
+        repo_name = urlparse(url).path.strip("/")
+        file_name = f"{repo_name.replace('/', '-')}-{sha}.tar.gz"
+        if "github" in url:
+            github = self._initiate_github(saas_file, base_url="https://api.github.com")
+            repo = github.get_repo(repo_name)
+            # get_archive_link get redirect url form header, it does not work with github-mirror
+            archive_url = repo.get_archive_link("tarball", ref=sha)
+        elif "gitlab" in url:
+            archive_url = f"{url}/-/archive/{sha}/{file_name}"
+        else:
+            raise Exception(f"Only GitHub and GitLab are supported: {url}")
+
+        return file_name, archive_url
+
     @retry(max_attempts=20)
     def _get_file_contents(
         self, url: str, path: str, ref: str, github: Github
-    ) -> tuple[Any, str, str]:
-        html_url = f"{url}/blob/{ref}{path}"
+    ) -> tuple[Any, str]:
         commit_sha = self._get_commit_sha(url, ref, github)
 
         if "github" in url:
@@ -738,15 +769,14 @@ class SaasHerder:  # pylint: disable=too-many-public-methods
         else:
             raise Exception(f"Only GitHub and GitLab are supported: {url}")
 
-        return yaml.safe_load(content), html_url, commit_sha
+        return yaml.safe_load(content), commit_sha
 
     @retry()
     def _get_directory_contents(
         self, url: str, path: str, ref: str, github: Github
-    ) -> tuple[list[Any], str, str]:
-        html_url = f"{url}/tree/{ref}{path}"
+    ) -> tuple[list[Any], str]:
         commit_sha = self._get_commit_sha(url, ref, github)
-        resources = []
+        resources: list[Any] = []
         if "github" in url:
             repo_name = url.rstrip("/").replace("https://github.com/", "")
             repo = github.get_repo(repo_name)
@@ -758,8 +788,8 @@ class SaasHerder:  # pylint: disable=too-many-public-methods
                 file_contents_decoded = self._get_file_contents_github(
                     repo, file_path, commit_sha
                 )
-                resource = yaml.safe_load(file_contents_decoded)
-                resources.append(resource)
+                result_resources = yaml.safe_load_all(file_contents_decoded)
+                resources.extend(result_resources)
         elif "gitlab" in url:
             if not self.gitlab:
                 raise Exception("gitlab is not initialized")
@@ -775,7 +805,7 @@ class SaasHerder:  # pylint: disable=too-many-public-methods
         else:
             raise Exception(f"Only GitHub and GitLab are supported: {url}")
 
-        return resources, html_url, commit_sha
+        return resources, commit_sha
 
     @retry()
     def _get_commit_sha(self, url: str, ref: str, github: Github) -> str:
@@ -789,7 +819,7 @@ class SaasHerder:  # pylint: disable=too-many-public-methods
             if not self.gitlab:
                 raise Exception("gitlab is not initialized")
             project = self.gitlab.get_project(url)
-            commits = project.commits.list(ref_name=ref)
+            commits = project.commits.list(ref_name=ref, per_page=1, page=1)
             commit_sha = commits[0].id
 
         return commit_sha
@@ -838,60 +868,32 @@ class SaasHerder:  # pylint: disable=too-many-public-methods
                 return True
         return False
 
-    def _process_template(
-        self,
-        saas_file_name: str,
-        resource_template_name: str,
-        image_auth: ImageAuth,
-        url: str,
-        path: str,
-        provider: str,
-        hash_length: int,
-        target: SaasResourceTemplateTarget,
-        parameters: dict[str, str],
-        github: Github,
-        target_config_hash: str,
-    ) -> tuple[list[Any], str, Optional[Promotion]]:
-        if provider == "openshift-template":
-            environment_parameters = self._collect_parameters(
-                target.namespace.environment
-            )
-            environment_secret_parameters = self._collect_secret_parameters(
-                target.namespace.environment
-            )
-            target_parameters = self._collect_parameters(target)
-            target_secret_parameters = self._collect_secret_parameters(target)
-
-            consolidated_parameters = {}
-            consolidated_parameters.update(environment_parameters)
-            consolidated_parameters.update(environment_secret_parameters)
-            consolidated_parameters.update(parameters)
-            consolidated_parameters.update(target_parameters)
-            consolidated_parameters.update(target_secret_parameters)
-
-            for replace_key, replace_value in consolidated_parameters.items():
-                if not isinstance(replace_value, str):
-                    continue
-                replace_pattern = "${" + replace_key + "}"
-                for k, v in consolidated_parameters.items():
-                    if not isinstance(v, str):
-                        continue
-                    if replace_pattern in v:
-                        consolidated_parameters[k] = v.replace(
-                            replace_pattern, replace_value
-                        )
+    def _process_template(self, spec: TargetSpec) -> tuple[list[Any], Promotion | None]:
+        saas_file_name = spec.saas_file_name
+        resource_template_name = spec.resource_template_name
+        url = spec.url
+        path = spec.path
+        ref = spec.ref
+        provider = spec.provider
+        hash_length = spec.hash_length
+        target = spec.target
+        github = spec.github
+        target_config_hash = spec.target_config_hash
+        error_prefix = spec.error_prefix
 
+        if provider == "openshift-template":
+            consolidated_parameters = spec.parameters()
             try:
-                template, html_url, commit_sha = self._get_file_contents(
-                    url=url, path=path, ref=target.ref, github=github
+                template, commit_sha = self._get_file_contents(
+                    url=url, path=path, ref=ref, github=github
                 )
             except Exception as e:
-                logging.error(
-                    f"[{url}/blob/{target.ref}{path}] "
-                    + f"error fetching template: {str(e)}"
-                )
+                logging.error(f"{error_prefix} error fetching template: {e!s}")
                 raise
 
+            # add COMMIT_SHA only if it is unspecified
+            consolidated_parameters.setdefault("COMMIT_SHA", commit_sha)
+
             # add IMAGE_TAG only if it is unspecified
             if not (image_tag := consolidated_parameters.get("IMAGE_TAG", "")):
                 sha_substring = commit_sha[:hash_length]
@@ -904,8 +906,7 @@ class SaasHerder:  # pylint: disable=too-many-public-methods
                         channel = consolidated_parameters["CHANNEL"]
                     except KeyError:
                         logging.error(
-                            f"[{saas_file_name}/{resource_template_name}] "
-                            + f"{html_url}: CHANNEL is required when "
+                            f"{error_prefix} CHANNEL is required when "
                             + "'use_channel_in_image_tag' is true."
                         )
                         raise
@@ -927,71 +928,129 @@ class SaasHerder:  # pylint: disable=too-many-public-methods
                     registry_image = consolidated_parameters["REGISTRY_IMG"]
                 except KeyError as e:
                     logging.error(
-                        f"[{saas_file_name}/{resource_template_name}] "
-                        + f"{html_url}: error generating REPO_DIGEST. "
+                        f"{error_prefix} error generating REPO_DIGEST. "
                         + "Is REGISTRY_IMG missing? "
-                        + f"{str(e)}"
-                    )
-                    raise
-                try:
-                    image_uri = f"{registry_image}:{image_tag}"
-                    img = Image(
-                        url=image_uri,
-                        username=image_auth.username,
-                        password=image_auth.password,
-                        auth_server=image_auth.auth_server,
-                    )
-                    if need_repo_digest:
-                        consolidated_parameters["REPO_DIGEST"] = img.url_digest
-                    if need_image_digest:
-                        consolidated_parameters["IMAGE_DIGEST"] = img.digest
-                except (rqexc.ConnectionError, rqexc.HTTPError) as e:
-                    logging.error(
-                        f"[{saas_file_name}/{resource_template_name}] "
-                        + f"{html_url}: error generating REPO_DIGEST for "
-                        + f"{image_uri}: {str(e)}"
+                        + f"{e!s}"
                     )
                     raise
 
+                image_uri = f"{registry_image}:{image_tag}"
+                img = self._get_image(
+                    image=image_uri,
+                    image_patterns=spec.image_patterns,
+                    image_auth=spec.image_auth,
+                    error_prefix=error_prefix,
+                )
+                if not img:
+                    msg = f"{error_prefix} error get image for {image_uri}"
+                    logging.error(msg)
+                    raise Exception(msg)
+
+                if need_repo_digest:
+                    consolidated_parameters["REPO_DIGEST"] = img.url_digest
+                if need_image_digest:
+                    consolidated_parameters["IMAGE_DIGEST"] = img.digest
+
             oc = OCLocal("cluster", None, None, local=True)
             try:
                 resources = oc.process(template, consolidated_parameters)
             except StatusCodeError as e:
-                logging.error(
-                    f"[{saas_file_name}/{resource_template_name}] "
-                    + f"{html_url}: error processing template: {str(e)}"
-                )
+                logging.error(f"{error_prefix} error processing template: {e!s}")
 
         elif provider == "directory":
             try:
-                resources, html_url, commit_sha = self._get_directory_contents(
-                    url=url, path=path, ref=target.ref, github=github
+                resources, commit_sha = self._get_directory_contents(
+                    url=url, path=path, ref=ref, github=github
                 )
             except Exception as e:
                 logging.error(
-                    f"[{url}/tree/{target.ref}{path}] "
-                    + f"error fetching directory: {str(e)}"
+                    f"{error_prefix} error fetching directory: {e!s} "
+                    + "(We do not support nested directories. Do you by chance have subdirectories?)"
                 )
                 raise
 
-        else:
-            logging.error(
-                f"[{saas_file_name}/{resource_template_name}] "
-                + f"unknown provider: {provider}"
+        elif provider == "helm":
+            ssl_verify = (
+                self.gitlab.ssl_verify
+                if self.gitlab and url.startswith(self.gitlab.server)
+                else True
+            )
+            consolidated_parameters = spec.parameters(adjust=False)
+            resources = helm.template_all(
+                url=url,
+                path=path,
+                ref=ref,
+                namespace=spec.target.namespace.name,
+                values=consolidated_parameters,
+                ssl_verify=ssl_verify,
             )
 
+        else:
+            logging.error(f"{error_prefix} unknown provider: {provider}")
+
         target_promotion = None
         if target.promotion:
+            channels = [
+                self._channel_map[sub] for sub in target.promotion.subscribe or []
+            ]
             target_promotion = Promotion(
+                url=url,
                 auto=target.promotion.auto,
                 publish=target.promotion.publish,
-                subscribe=target.promotion.subscribe,
+                subscribe=channels,
                 promotion_data=target.promotion.promotion_data,
                 commit_sha=commit_sha,
                 saas_file=saas_file_name,
                 target_config_hash=target_config_hash,
+                saas_target_uid=target.uid(
+                    parent_resource_template_name=resource_template_name,
+                    parent_saas_file_name=saas_file_name,
+                ),
+                soak_days=target.promotion.soak_days or 0,
             )
-        return resources, html_url, target_promotion
+        return resources, target_promotion
+
+    def _assemble_channels(
+        self, saas_files: Iterable[SaasFile] | None
+    ) -> dict[str, Channel]:
+        """
+        We need to assemble all publisher_uids that are publishing to a channel.
+        These uids are required to validate correctness of promotions.
+        """
+        channel_map: dict[str, Channel] = {}
+        for saas_file in saas_files or []:
+            for tmpl in saas_file.resource_templates:
+                for target in tmpl.targets:
+                    if not target.promotion:
+                        continue
+                    for publish in target.promotion.publish or []:
+                        publisher_uid = target.uid(
+                            parent_saas_file_name=saas_file.name,
+                            parent_resource_template_name=tmpl.name,
+                        )
+                        if publish not in channel_map:
+                            channel_map[publish] = Channel(
+                                name=publish,
+                                publisher_uids=[],
+                            )
+                        channel_map[publish].publisher_uids.append(publisher_uid)
+        return channel_map
+
+    def _collect_blocked_versions(self) -> dict[str, set[str]]:
+        blocked_versions: dict[str, set[str]] = {}
+        for saas_file in self.saas_files:
+            for cc in saas_file.app.code_components or []:
+                for v in cc.blocked_versions or []:
+                    blocked_versions.setdefault(cc.url, set()).add(v)
+        return blocked_versions
+
+    def _collect_hotfix_versions(self) -> dict[str, set[str]]:
+        hotfix_versions: dict[str, set[str]] = {}
+        for saas_file in self.saas_files:
+            for cc in saas_file.app.code_components or []:
+                for v in cc.hotfix_versions or []:
+                    hotfix_versions.setdefault(cc.url, set()).add(v)
+        return hotfix_versions
 
     @staticmethod
     def _collect_images(resource: Resource) -> set[str]:
@@ -1028,79 +1087,114 @@ class SaasHerder:  # pylint: disable=too-many-public-methods
         return images
 
     @staticmethod
-    def _check_image(
+    def _get_image(
         image: str,
         image_patterns: Iterable[str],
         image_auth: ImageAuth,
         error_prefix: str,
-    ) -> bool:
-        error = False
+    ) -> Image | None:
         if not image_patterns:
-            error = True
             logging.error(
                 f"{error_prefix} imagePatterns is empty (does not contain {image})"
             )
+            return None
         if image_patterns and not any(image.startswith(p) for p in image_patterns):
-            error = True
             logging.error(f"{error_prefix} Image is not in imagePatterns: {image}")
+            return None
+
+        # .dockerconfigjson
+        if image_auth.docker_config:
+            # we rely on the secret in vault being ordered
+            # https://peps.python.org/pep-0468/
+            for registry, auth in image_auth.docker_config["auths"].items():
+                if not image.startswith(registry):
+                    continue
+                username, password = (
+                    base64.b64decode(auth["auth"]).decode("utf-8").split(":")
+                )
+
+                return SaasHerder._get_and_validate_image(
+                    full_image_path=image,
+                    username=username,
+                    password=password,
+                    auth_server=image_auth.auth_server,
+                    timeout=REQUEST_TIMEOUT,
+                    error_prefix=error_prefix,
+                )
+
+        # basic auth fallback for backwards compatibility
+        return SaasHerder._get_and_validate_image(
+            full_image_path=image,
+            username=image_auth.username,
+            password=image_auth.password,
+            auth_server=image_auth.auth_server,
+            timeout=REQUEST_TIMEOUT,
+            error_prefix=error_prefix,
+        )
+
+    @staticmethod
+    def _get_and_validate_image(
+        full_image_path: str,
+        username: str | Any,
+        password: str | Any,
+        auth_server: str | Any,
+        timeout: int,
+        error_prefix: str,
+    ) -> Image | None:
         try:
-            valid = Image(
-                image,
-                username=image_auth.username,
-                password=image_auth.password,
-                auth_server=image_auth.auth_server,
+            img = Image(
+                full_image_path,
+                username=username,
+                password=password,
+                auth_server=auth_server,
+                timeout=timeout,
             )
-            if not valid:
-                error = True
-                logging.error(f"{error_prefix} Image does not exist: {image}")
+            if img:
+                return img
+            else:
+                logging.error(
+                    f"{error_prefix} Image : {full_image_path} does not exist"
+                )
         except Exception as e:
-            error = True
             logging.error(
-                f"{error_prefix} Image is invalid: {image}. " + f"details: {str(e)}"
+                f"{error_prefix} Image is invalid: {full_image_path}. "
+                + f"details: {e!s}"
             )
-
-        return error
+        return None
 
     def _check_images(
         self,
-        saas_file_name: str,
-        resource_template_name: str,
-        image_auth: ImageAuth,
-        image_patterns: list[str],
-        html_url: str,
+        spec: TargetSpec,
         resources: Resources,
     ) -> bool:
-        error_prefix = f"[{saas_file_name}/{resource_template_name}] {html_url}:"
         images_list = threaded.run(
             self._collect_images, resources, self.available_thread_pool_size
         )
         images = set(itertools.chain.from_iterable(images_list))
+        self.images.update(images)
         if not images:
             return False  # no errors
-        errors = threaded.run(
-            self._check_image,
+        images = threaded.run(
+            self._get_image,
             images,
             self.available_thread_pool_size,
-            image_patterns=image_patterns,
-            image_auth=image_auth,
-            error_prefix=error_prefix,
+            image_patterns=spec.image_patterns,
+            image_auth=spec.image_auth,
+            error_prefix=spec.error_prefix,
         )
-        return any(errors)
+        return None in images
 
-    def _initiate_github(self, saas_file: SaasFile) -> Github:
+    def _initiate_github(
+        self, saas_file: SaasFile, base_url: str | None = None
+    ) -> Github:
         token = (
             self.secret_reader.read_secret(saas_file.authentication.code)
             if saas_file.authentication and saas_file.authentication.code
             else get_default_config()["token"]
         )
-
-        base_url = os.environ.get("GITHUB_API", "https://api.github.com")
-        # This is a threaded world. Let's define a big
-        # connections pool to live in that world
-        # (this avoids the warning "Connection pool is
-        # full, discarding connection: api.github.com")
-        pool_size = 100
-        return Github(token, base_url=base_url, pool_size=pool_size)
+        if not base_url:
+            base_url = os.environ.get("GITHUB_API", "https://api.github.com")
+        return Github(token, base_url=base_url)
 
     def _initiate_image_auth(self, saas_file: SaasFile) -> ImageAuth:
         """
@@ -1121,20 +1215,24 @@ class SaasHerder:  # pylint: disable=too-many-public-methods
             return ImageAuth()
 
         creds = self.secret_reader.read_all_secret(saas_file.authentication.image)
-        required_keys = ["user", "token"]
-        ok = all(k in creds.keys() for k in required_keys)
+        required_docker_config_keys = [".dockerconfigjson"]
+        required_keys_basic_auth = ["user", "token"]
+        ok = all(k in creds for k in required_keys_basic_auth) or all(
+            k in creds for k in required_docker_config_keys
+        )
         if not ok:
             logging.warning(
                 "the specified image authentication secret "
                 + f"found in path {saas_file.authentication.image.path} "
-                + f"does not contain all required keys: {required_keys}"
+                + f"does not contain all required keys: {required_docker_config_keys} or {required_keys_basic_auth}"
             )
             return ImageAuth()
 
         return ImageAuth(
-            username=creds["user"],
-            password=creds["token"],
+            username=creds.get("user"),
+            password=creds.get("token"),
             auth_server=creds.get("url"),
+            docker_config=json.loads(creds.get(".dockerconfigjson") or "{}"),
         )
 
     def populate_desired_state(self, ri: ResourceInventory) -> None:
@@ -1150,7 +1248,7 @@ class SaasHerder:  # pylint: disable=too-many-public-methods
             self.thread_pool_size,
             ri=ri,
         )
-        self.promotions: list[Optional[Promotion]] = promotions
+        self.promotions: list[Promotion | None] = promotions
 
     def _init_populate_desired_state_specs(
         self, saas_file: SaasFile
@@ -1158,23 +1256,10 @@ class SaasHerder:  # pylint: disable=too-many-public-methods
         specs = []
         github = self._initiate_github(saas_file)
         image_auth = self._initiate_image_auth(saas_file)
-        saas_file_parameters = self._collect_parameters(saas_file)
-        saas_file_secret_parameters = self._collect_secret_parameters(saas_file)
-
         all_trigger_specs = self.get_saas_targets_config_trigger_specs(saas_file)
         # iterate over resource templates (multiple per saas_file)
         for rt in saas_file.resource_templates:
-            provider = rt.provider or "openshift-template"
             hash_length = rt.hash_length or self.hash_length
-            resource_template_parameters = self._collect_parameters(rt)
-            resource_template_secret_parameters = self._collect_secret_parameters(rt)
-
-            consolidated_parameters = {}
-            consolidated_parameters.update(saas_file_parameters)
-            consolidated_parameters.update(saas_file_secret_parameters)
-            consolidated_parameters.update(resource_template_parameters)
-            consolidated_parameters.update(resource_template_secret_parameters)
-
             # Iterate over targets (each target is a namespace).
             for target in rt.targets:
                 if target.disable:
@@ -1198,25 +1283,15 @@ class SaasHerder:  # pylint: disable=too-many-public-methods
 
                 specs.append(
                     TargetSpec(
-                        saas_file_name=saas_file.name,
-                        cluster=target.namespace.cluster.name,
-                        namespace=target.namespace.name,
-                        managed_resource_types=saas_file.managed_resource_types,
-                        delete=bool(target.delete),
-                        privileged=bool(saas_file.cluster_admin),
+                        saas_file=saas_file,
+                        resource_template=rt,
+                        target=target,
                         # process_template options
-                        resource_template_name=rt.name,
                         image_auth=image_auth,
-                        url=rt.url,
-                        path=rt.path,
-                        provider=provider,
                         hash_length=hash_length,
-                        target=target,
-                        parameters=consolidated_parameters,
                         github=github,
                         target_config_hash=digest,
-                        # check_image options
-                        image_patterns=saas_file.image_patterns,
+                        secret_reader=self.secret_reader,
                     )
                 )
 
@@ -1224,27 +1299,18 @@ class SaasHerder:  # pylint: disable=too-many-public-methods
 
     def populate_desired_state_saas_file(
         self, spec: TargetSpec, ri: ResourceInventory
-    ) -> Optional[Promotion]:
+    ) -> Promotion | None:
         if spec.delete:
             # to delete resources, we avoid adding them to the desired state
             return None
 
+        html_url = spec.html_url
         try:
-            resources, html_url, promotion = self._process_template(
-                saas_file_name=spec.saas_file_name,
-                resource_template_name=spec.resource_template_name,
-                image_auth=spec.image_auth,
-                url=spec.url,
-                path=spec.path,
-                provider=spec.provider,
-                hash_length=spec.hash_length,
-                target=spec.target,
-                parameters=spec.parameters,
-                github=spec.github,
-                target_config_hash=spec.target_config_hash,
-            )
-        except Exception:
-            # log message send in _process_template
+            resources, promotion = self._process_template(spec)
+        except Exception as e:
+            # error log message send in _process_template. We cannot just
+            # register an error without logging as inventory errors don't have details.
+            logging.error(f"Error in populate_desired_state_saas_file: {e}")
             ri.register_error()
             return None
 
@@ -1274,11 +1340,7 @@ class SaasHerder:  # pylint: disable=too-many-public-methods
         self._additional_resource_process(resources, html_url)
         # check images
         image_error = self._check_images(
-            saas_file_name=spec.saas_file_name,
-            resource_template_name=spec.resource_template_name,
-            image_auth=spec.image_auth,
-            image_patterns=spec.image_patterns,
-            html_url=html_url,
+            spec=spec,
             resources=resources,
         )
         if image_error:
@@ -1310,18 +1372,25 @@ class SaasHerder:  # pylint: disable=too-many-public-methods
                     + f"{spec.resource_template_name}."
                 )
                 logging.error(msg)
+            except ResourceNotManagedError:
+                msg = (
+                    f"[{spec.cluster}/{spec.namespace}] desired item "
+                    + f"not managed, skipping: {oc_resource.kind}/{oc_resource.name}. "
+                    + f"saas file name: {spec.saas_file_name}, "
+                    + "resource template name: "
+                    + f"{spec.resource_template_name}."
+                )
+                logging.info(msg)
 
         return promotion
 
     def get_diff(
         self, trigger_type: TriggerTypes, dry_run: bool
     ) -> tuple[
-        Union[
-            list[TriggerSpecConfig],
-            list[TriggerSpecMovingCommit],
-            list[TriggerSpecUpstreamJob],
-            list[TriggerSpecContainerImage],
-        ],
+        list[TriggerSpecConfig]
+        | list[TriggerSpecMovingCommit]
+        | list[TriggerSpecUpstreamJob]
+        | list[TriggerSpecContainerImage],
         bool,
     ]:
         if trigger_type == TriggerTypes.MOVING_COMMITS:
@@ -1562,10 +1631,10 @@ class SaasHerder:  # pylint: disable=too-many-public-methods
                     image_uri = f"{image_registry}:{desired_image_tag}"
                     image_auth = self._initiate_image_auth(saas_file)
                     error_prefix = f"[{saas_file.name}/{rt.name}] {target.ref}:"
-                    error = self._check_image(
+                    image = self._get_image(
                         image_uri, saas_file.image_patterns, image_auth, error_prefix
                     )
-                    if error:
+                    if not image:
                         continue
 
                     trigger_spec = TriggerSpecContainerImage(
@@ -1580,7 +1649,9 @@ class SaasHerder:  # pylint: disable=too-many-public-methods
                         state_content=desired_image_tag,
                     )
                     if self.include_trigger_trace:
-                        trigger_spec.reason = image_uri
+                        trigger_spec.reason = (
+                            f"{rt.url}/commit/{commit_sha} build {image_uri}"
+                        )
                     if not self.state:
                         raise Exception("state is not initialized")
                     current_image_tag = self.state.get(trigger_spec.state_key, None)
@@ -1613,7 +1684,7 @@ class SaasHerder:  # pylint: disable=too-many-public-methods
         return list(itertools.chain.from_iterable(results))
 
     @staticmethod
-    def remove_none_values(d: Optional[dict[Any, Any]]) -> dict[Any, Any]:
+    def remove_none_values(d: dict[Any, Any] | None) -> dict[Any, Any]:
         if d is None:
             return {}
         new = {}
@@ -1647,6 +1718,13 @@ class SaasHerder:  # pylint: disable=too-many-public-methods
 
             if self.include_trigger_trace:
                 trigger_spec.reason = f"{self.repo_url}/commit/{RunningState().commit}"
+                # For now we count every saas config change as an auto-promotion
+                # if the auto promotion field is enabled in the saas target.
+                # Ideally, we check if there was an actual ref change in order
+                # to reduce false-positives.
+                promotion = trigger_spec.state_content.get("promotion")
+                if promotion and promotion.get("auto", False):
+                    trigger_spec.reason += " [auto-promotion]"
             trigger_specs.append(trigger_spec)
         return trigger_specs
 
@@ -1690,9 +1768,9 @@ class SaasHerder:  # pylint: disable=too-many-public-methods
                 )
 
                 # add managed resource types to target config
-                desired_target_config[
-                    "saas_file_managed_resource_types"
-                ] = saas_file.managed_resource_types
+                desired_target_config["saas_file_managed_resource_types"] = (
+                    saas_file.managed_resource_types
+                )
                 desired_target_config["url"] = rt.url
                 desired_target_config["path"] = rt.path
                 # before the GQL classes are introduced, the parameters attribute
@@ -1702,6 +1780,17 @@ class SaasHerder:  # pylint: disable=too-many-public-methods
                     if rt.parameters is not None
                     else None
                 )
+
+                # include secret parameters from resource template and saas file
+                if rt.secret_parameters:
+                    desired_target_config["rt_secretparameters"] = [
+                        p.dict() for p in rt.secret_parameters
+                    ]
+                if saas_file.secret_parameters:
+                    desired_target_config["saas_file_secretparameters"] = [
+                        p.dict() for p in saas_file.secret_parameters
+                    ]
+
                 # Convert to dict, ChainMap is not JSON serializable
                 # desired_target_config needs to be serialized to generate
                 # its config hash and to be stored in S3
@@ -1733,84 +1822,115 @@ class SaasHerder:  # pylint: disable=too-many-public-methods
                 "cluster": {"name": True, "server_url": True},
                 "app": {"name": True},
             },
+            # TODO: add environment.parameters to the include list!?!?
         )
 
-    def validate_promotions(self) -> bool:
-        """
-        If there were promotion sections in the participating saas files
-        validate that the conditions are met."""
+    def _validate_promotion(self, promotion: Promotion) -> bool:
+        # Placing this check here to make mypy happy
         if not (self.state and self._promotion_state):
             raise Exception("state is not initialized")
 
-        for promotion in self.promotions:
-            if promotion is None:
-                continue
-            # validate that the commit sha being promoted
-            # was successfully published to the subscribed channel(s)
-            if promotion.subscribe:
-                for channel in promotion.subscribe:
-                    info = self._promotion_state.get_promotion_data(
-                        sha=promotion.commit_sha, channel=channel, local_lookup=False
-                    )
-                    if not (info and info.success):
-                        logging.error(
-                            f"Commit {promotion.commit_sha} was not "
-                            + f"published with success to channel {channel}"
-                        )
-                        return False
-                    state_config_hash = info.target_config_hash
-
-                    # This code supports current saas targets that does
-                    # not have promotion_data yet
-                    if not state_config_hash or not promotion.promotion_data:
-                        logging.info(
-                            "Promotion data is missing; rely on the success "
-                            "state only"
-                        )
-                        return True
-
-                    # Validate the promotion_data section.
-                    # Just validate parent_saas_config hash
-                    # promotion_data type by now.
-                    parent_saas_config = None
-                    for pd in promotion.promotion_data:
-                        if pd.channel == channel:
-                            for data in pd.data or []:
-                                if isinstance(data, SaasParentSaasPromotion):
-                                    parent_saas_config = data
-
-                    # This section might not exist due to a manual MR.
-                    # Promotion shall continue if this data is missing.
-                    # The parent at the same ref has succeed if this code
-                    # is reached though.
-                    if not parent_saas_config:
-                        logging.info(
-                            "Parent Saas config missing on target "
-                            "rely on the success state only"
-                        )
-                        return True
+        if not promotion.subscribe:
+            return True
 
-                    # Validate that the state config_hash set by the parent
-                    # matches with the hash set in promotion_data
-                    if parent_saas_config.target_config_hash == state_config_hash:
-                        return True
+        if promotion.commit_sha in self.blocked_versions.get(promotion.url, set()):
+            logging.error(f"Commit {promotion.commit_sha} is blocked!")
+            return False
 
+        # hotfix must run before further gates are evaluated to override them
+        if promotion.commit_sha in self.hotfix_versions.get(promotion.url, set()):
+            return True
+
+        now = datetime.now(UTC)
+        passed_soak_days = timedelta(days=0)
+
+        for channel in promotion.subscribe:
+            config_hashes: set[str] = set()
+            for target_uid in channel.publisher_uids:
+                deployment = self._promotion_state.get_promotion_data(
+                    sha=promotion.commit_sha,
+                    channel=channel.name,
+                    target_uid=target_uid,
+                    pre_check_sha_exists=False,
+                )
+                if not (
+                    deployment and (deployment.success or deployment.has_succeeded_once)
+                ):
                     logging.error(
-                        "Parent saas target has run with a newer "
-                        "configuration and the same commit (ref). "
-                        "Check if other MR exists for this target, "
-                        f"or update {parent_saas_config.target_config_hash} "
-                        f"to {state_config_hash} for channel {channel}"
+                        f"Commit {promotion.commit_sha} was not "
+                        + f"published with success to channel {channel.name}"
                     )
                     return False
+                if check_in := deployment.check_in:
+                    passed_soak_days += now - datetime.fromisoformat(check_in)
+                if deployment.target_config_hash:
+                    config_hashes.add(deployment.target_config_hash)
+
+            # This code supports current saas targets that does
+            # not have promotion_data yet
+            if not config_hashes or not promotion.promotion_data:
+                logging.info(
+                    "Promotion data is missing; rely on the success " "state only"
+                )
+                continue
+
+            # Validate the promotion_data section.
+            # Just validate parent_saas_config hash
+            # promotion_data type by now.
+            parent_saas_config = None
+            for pd in promotion.promotion_data:
+                if pd.channel == channel.name:
+                    for data in pd.data or []:
+                        if isinstance(data, SaasParentSaasPromotion):
+                            parent_saas_config = data
+
+            # This section might not exist due to a manual MR.
+            # Promotion shall continue if this data is missing.
+            # The parent at the same ref has succeed if this code
+            # is reached though.
+            if not parent_saas_config:
+                logging.info(
+                    "Parent Saas config missing on target "
+                    "rely on the success state only"
+                )
+                continue
+
+            # Validate that the state config_hash set by the parent
+            # matches with the hash set in promotion_data
+            if parent_saas_config.target_config_hash in config_hashes:
+                continue
+
+            logging.error(
+                "Parent saas target has run with a newer "
+                "configuration and the same commit (ref). "
+                "Check if other MR exists for this target, "
+                f"or update {parent_saas_config.target_config_hash} "
+                f"to any in {config_hashes} for channel {channel.name}"
+            )
+            return False
+
+        if passed_soak_days < timedelta(days=promotion.soak_days):
+            logging.error(
+                f"SoakDays in publishers did not pass. So far accumulated soakDays is {passed_soak_days},"
+                f"but we have a soakDays setting of {promotion.soak_days}. We cannot proceed with this promotion."
+            )
+            return False
         return True
 
+    def validate_promotions(self) -> bool:
+        """
+        If there were promotion sections in the participating saas files
+        validate that the conditions are met."""
+        return all(
+            self._validate_promotion(promotion)
+            for promotion in self.promotions
+            if promotion is not None
+        )
+
     def publish_promotions(
         self,
         success: bool,
         all_saas_files: Iterable[SaasFile],
-        mr_cli: MRClient,
-        auto_promote: bool = False,
     ) -> None:
         """
         If there were promotion sections in the participating saas file
@@ -1819,17 +1939,11 @@ class SaasHerder:  # pylint: disable=too-many-public-methods
             subscribe_saas_file_path_map,
             subscribe_target_path_map,
         ) = self._get_subscribe_path_map(all_saas_files, auto_only=True)
-        trigger_promotion = False
-
-        if self.promotions and not auto_promote:
-            logging.info(
-                "Auto-promotions to next stages are disabled. "
-                "Promotions are being handled by SAPM."
-            )
 
         if not (self.state and self._promotion_state):
             raise Exception("state is not initialized")
 
+        now = datetime.now(UTC)
         for promotion in self.promotions:
             if promotion is None:
                 continue
@@ -1838,14 +1952,43 @@ class SaasHerder:  # pylint: disable=too-many-public-methods
                 all_subscribed_saas_file_paths = set()
                 all_subscribed_target_paths = set()
                 for channel in promotion.publish:
+                    # make sure we keep some attributes on re-deployments of same ref
+                    has_succeeded_once = success
+                    current_state = self._promotion_state.get_promotion_data(
+                        sha=promotion.commit_sha,
+                        channel=channel,
+                        target_uid=promotion.saas_target_uid,
+                        use_cache=True,
+                    )
+                    if current_state and current_state.has_succeeded_once:
+                        has_succeeded_once = True
+
+                    check_in = str(now)
+                    if (
+                        success
+                        and current_state
+                        and current_state.check_in
+                        and current_state.success
+                    ):
+                        # We want to avoid an override of the timestamp.
+                        # This can happen on re-deployments of the same ref.
+                        # We only re-use the check_in time if the previous
+                        # and current deployment was successful.
+                        # On unsuccessful deployments, we
+                        # update the check_in time to current time.
+                        check_in = current_state.check_in
+
                     # publish to state to pass promotion gate
                     self._promotion_state.publish_promotion_data(
                         sha=promotion.commit_sha,
                         channel=channel,
+                        target_uid=promotion.saas_target_uid,
                         data=PromotionData(
                             saas_file=promotion.saas_file,
                             success=success,
                             target_config_hash=promotion.target_config_hash,
+                            has_succeeded_once=has_succeeded_once,
+                            check_in=check_in,
                         ),
                     )
                     logging.info(
@@ -1869,19 +2012,6 @@ class SaasHerder:  # pylint: disable=too-many-public-methods
                 promotion.saas_file_paths = list(all_subscribed_saas_file_paths)
                 promotion.target_paths = list(all_subscribed_target_paths)
 
-                if auto_promote and (
-                    all_subscribed_saas_file_paths or all_subscribed_target_paths
-                ):
-                    trigger_promotion = True
-
-        if success and trigger_promotion:
-            from reconcile.utils.mr.auto_promoter import (
-                AutoPromoter,  # avoid circular import
-            )
-
-            mr = AutoPromoter([p for p in self.promotions if p is not None])
-            mr.submit(cli=mr_cli)
-
     @staticmethod
     def _get_subscribe_path_map(
         saas_files: Iterable[SaasFile], auto_only: bool = False
@@ -1917,8 +2047,8 @@ class SaasHerder:  # pylint: disable=too-many-public-methods
     @staticmethod
     def resolve_templated_parameters(saas_files: Iterable[SaasFile]) -> None:
         """Resolve templated target parameters in saas files."""
-        from reconcile.openshift_resources_base import (
-            compile_jinja2_template,  # avoid circular import
+        from reconcile.utils.jinja2.utils import (  # noqa: PLC0415 - # avoid circular import
+            compile_jinja2_template,
         )
 
         for saas_file in saas_files: