forked from RedHatInsights/export-service-go
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Red Hat Konflux update export-service (RedHatInsights#188)
Signed-off-by: red-hat-konflux <[email protected]> Co-authored-by: red-hat-konflux <[email protected]>
1 parent
440205a
commit bd96186
Showing
2 changed files
with
901 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,452 @@ | ||
| apiVersion: tekton.dev/v1 | ||
| kind: PipelineRun | ||
| metadata: | ||
| annotations: | ||
| build.appstudio.openshift.io/repo: https://github.com/RedHatInsights/export-service-go?rev={{revision}} | ||
| build.appstudio.redhat.com/commit_sha: '{{revision}}' | ||
| build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}' | ||
| build.appstudio.redhat.com/target_branch: '{{target_branch}}' | ||
| pipelinesascode.tekton.dev/max-keep-runs: "3" | ||
| pipelinesascode.tekton.dev/on-cel-expression: event == "pull_request" && target_branch | ||
| == "main" | ||
| creationTimestamp: null | ||
| labels: | ||
| appstudio.openshift.io/application: export-service | ||
| appstudio.openshift.io/component: export-service | ||
| pipelines.appstudio.openshift.io/type: build | ||
| name: export-service-on-pull-request | ||
| namespace: hcc-integrations-tenant | ||
| spec: | ||
| params: | ||
| - name: git-url | ||
| value: '{{source_url}}' | ||
| - name: revision | ||
| value: '{{revision}}' | ||
| - name: output-image | ||
| value: quay.io/redhat-user-workloads/hcc-integrations-tenant/export-service/export-service:on-pr-{{revision}} | ||
| - name: image-expires-after | ||
| value: 5d | ||
| - name: dockerfile | ||
| value: Dockerfile | ||
| pipelineSpec: | ||
| description: | | ||
| This pipeline is ideal for building container images from a Containerfile while maintaining trust after pipeline customization. | ||
| _Uses `buildah` to create a container image leveraging [trusted artifacts](https://konflux-ci.dev/architecture/ADR/0036-trusted-artifacts.html). It also optionally creates a source image and runs some build-time tests. Information is shared between tasks using OCI artifacts instead of PVCs. EC will pass the [`trusted_task.trusted`](https://enterprisecontract.dev/docs/ec-policies/release_policy.html#trusted_task__trusted) policy as long as all data used to build the artifact is generated from trusted tasks. | ||
| This pipeline is pushed as a Tekton bundle to [quay.io](https://quay.io/repository/konflux-ci/tekton-catalog/pipeline-docker-build-oci-ta?tab=tags)_ | ||
| finally: | ||
| - name: show-sbom | ||
| params: | ||
| - name: IMAGE_URL | ||
| value: $(tasks.build-image-index.results.IMAGE_URL) | ||
| taskRef: | ||
| params: | ||
| - name: name | ||
| value: show-sbom | ||
| - name: bundle | ||
| value: quay.io/konflux-ci/tekton-catalog/task-show-sbom:0.1@sha256:9bfc6b99ef038800fe131d7b45ff3cd4da3a415dd536f7c657b3527b01c4a13b | ||
| - name: kind | ||
| value: task | ||
| resolver: bundles | ||
| params: | ||
| - description: Source Repository URL | ||
| name: git-url | ||
| type: string | ||
| - default: "" | ||
| description: Revision of the Source Repository | ||
| name: revision | ||
| type: string | ||
| - description: Fully Qualified Output Image | ||
| name: output-image | ||
| type: string | ||
| - default: . | ||
| description: Path to the source code of an application's component from where | ||
| to build image. | ||
| name: path-context | ||
| type: string | ||
| - default: Dockerfile | ||
| description: Path to the Dockerfile inside the context specified by parameter | ||
| path-context | ||
| name: dockerfile | ||
| type: string | ||
| - default: "false" | ||
| description: Force rebuild image | ||
| name: rebuild | ||
| type: string | ||
| - default: "false" | ||
| description: Skip checks against built image | ||
| name: skip-checks | ||
| type: string | ||
| - default: "false" | ||
| description: Execute the build with network isolation | ||
| name: hermetic | ||
| type: string | ||
| - default: "" | ||
| description: Build dependencies to be prefetched by Cachi2 | ||
| name: prefetch-input | ||
| type: string | ||
| - default: "" | ||
| description: Image tag expiration time, time values could be something like | ||
| 1h, 2d, 3w for hours, days, and weeks, respectively. | ||
| name: image-expires-after | ||
| - default: "false" | ||
| description: Build a source image. | ||
| name: build-source-image | ||
| type: string | ||
| - default: "false" | ||
| description: Add built image into an OCI image index | ||
| name: build-image-index | ||
| type: string | ||
| - default: [] | ||
| description: Array of --build-arg values ("arg=value" strings) for buildah | ||
| name: build-args | ||
| type: array | ||
| - default: "" | ||
| description: Path to a file with build arguments for buildah, see https://www.mankier.com/1/buildah-build#--build-arg-file | ||
| name: build-args-file | ||
| type: string | ||
| results: | ||
| - description: "" | ||
| name: IMAGE_URL | ||
| value: $(tasks.build-image-index.results.IMAGE_URL) | ||
| - description: "" | ||
| name: IMAGE_DIGEST | ||
| value: $(tasks.build-image-index.results.IMAGE_DIGEST) | ||
| - description: "" | ||
| name: CHAINS-GIT_URL | ||
| value: $(tasks.clone-repository.results.url) | ||
| - description: "" | ||
| name: CHAINS-GIT_COMMIT | ||
| value: $(tasks.clone-repository.results.commit) | ||
| tasks: | ||
| - name: init | ||
| params: | ||
| - name: image-url | ||
| value: $(params.output-image) | ||
| - name: rebuild | ||
| value: $(params.rebuild) | ||
| - name: skip-checks | ||
| value: $(params.skip-checks) | ||
| taskRef: | ||
| params: | ||
| - name: name | ||
| value: init | ||
| - name: bundle | ||
| value: quay.io/konflux-ci/tekton-catalog/task-init:0.2@sha256:092c113b614f6551113f17605ae9cb7e822aa704d07f0e37ed209da23ce392cc | ||
| - name: kind | ||
| value: task | ||
| resolver: bundles | ||
| - name: clone-repository | ||
| params: | ||
| - name: url | ||
| value: $(params.git-url) | ||
| - name: revision | ||
| value: $(params.revision) | ||
| - name: ociStorage | ||
| value: $(params.output-image).git | ||
| - name: ociArtifactExpiresAfter | ||
| value: $(params.image-expires-after) | ||
| runAfter: | ||
| - init | ||
| taskRef: | ||
| params: | ||
| - name: name | ||
| value: git-clone-oci-ta | ||
| - name: bundle | ||
| value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.1@sha256:b03bb5e21665b17ae2f645496013a072b00f1a174024dc1ff41dc626f364c66b | ||
| - name: kind | ||
| value: task | ||
| resolver: bundles | ||
| when: | ||
| - input: $(tasks.init.results.build) | ||
| operator: in | ||
| values: | ||
| - "true" | ||
| workspaces: | ||
| - name: basic-auth | ||
| workspace: git-auth | ||
| - name: prefetch-dependencies | ||
| params: | ||
| - name: input | ||
| value: $(params.prefetch-input) | ||
| - name: SOURCE_ARTIFACT | ||
| value: $(tasks.clone-repository.results.SOURCE_ARTIFACT) | ||
| - name: ociStorage | ||
| value: $(params.output-image).prefetch | ||
| - name: ociArtifactExpiresAfter | ||
| value: $(params.image-expires-after) | ||
| runAfter: | ||
| - clone-repository | ||
| taskRef: | ||
| params: | ||
| - name: name | ||
| value: prefetch-dependencies-oci-ta | ||
| - name: bundle | ||
| value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.1@sha256:ad15707d97026d6d462e4c02a09e73a3cffdcdae3a91b03f39d2675d5a000d2b | ||
| - name: kind | ||
| value: task | ||
| resolver: bundles | ||
| workspaces: | ||
| - name: git-basic-auth | ||
| workspace: git-auth | ||
| - name: netrc | ||
| workspace: netrc | ||
| - name: build-container | ||
| params: | ||
| - name: IMAGE | ||
| value: $(params.output-image) | ||
| - name: DOCKERFILE | ||
| value: $(params.dockerfile) | ||
| - name: CONTEXT | ||
| value: $(params.path-context) | ||
| - name: HERMETIC | ||
| value: $(params.hermetic) | ||
| - name: PREFETCH_INPUT | ||
| value: $(params.prefetch-input) | ||
| - name: IMAGE_EXPIRES_AFTER | ||
| value: $(params.image-expires-after) | ||
| - name: COMMIT_SHA | ||
| value: $(tasks.clone-repository.results.commit) | ||
| - name: BUILD_ARGS | ||
| value: | ||
| - $(params.build-args[*]) | ||
| - name: BUILD_ARGS_FILE | ||
| value: $(params.build-args-file) | ||
| - name: SOURCE_ARTIFACT | ||
| value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) | ||
| - name: CACHI2_ARTIFACT | ||
| value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) | ||
| runAfter: | ||
| - prefetch-dependencies | ||
| taskRef: | ||
| params: | ||
| - name: name | ||
| value: buildah-oci-ta | ||
| - name: bundle | ||
| value: quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta:0.2@sha256:6620f885c459e0e062c44797a4fc7b0f28c54c117de3771234b065c76714f663 | ||
| - name: kind | ||
| value: task | ||
| resolver: bundles | ||
| when: | ||
| - input: $(tasks.init.results.build) | ||
| operator: in | ||
| values: | ||
| - "true" | ||
| - name: build-image-index | ||
| params: | ||
| - name: IMAGE | ||
| value: $(params.output-image) | ||
| - name: COMMIT_SHA | ||
| value: $(tasks.clone-repository.results.commit) | ||
| - name: IMAGE_EXPIRES_AFTER | ||
| value: $(params.image-expires-after) | ||
| - name: ALWAYS_BUILD_INDEX | ||
| value: $(params.build-image-index) | ||
| - name: IMAGES | ||
| value: | ||
| - $(tasks.build-container.results.IMAGE_URL)@$(tasks.build-container.results.IMAGE_DIGEST) | ||
| runAfter: | ||
| - build-container | ||
| taskRef: | ||
| params: | ||
| - name: name | ||
| value: build-image-index | ||
| - name: bundle | ||
| value: quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.1@sha256:8619eabd7cf3340d1123afadac1f4296dc14472c8db0f774497748c762f46f33 | ||
| - name: kind | ||
| value: task | ||
| resolver: bundles | ||
| when: | ||
| - input: $(tasks.init.results.build) | ||
| operator: in | ||
| values: | ||
| - "true" | ||
| - name: build-source-image | ||
| params: | ||
| - name: BINARY_IMAGE | ||
| value: $(params.output-image) | ||
| - name: SOURCE_ARTIFACT | ||
| value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) | ||
| - name: CACHI2_ARTIFACT | ||
| value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) | ||
| runAfter: | ||
| - build-image-index | ||
| taskRef: | ||
| params: | ||
| - name: name | ||
| value: source-build-oci-ta | ||
| - name: bundle | ||
| value: quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta:0.1@sha256:639995e4221da90f5a9fc14dacd0dba384e2a37e3a2c7aa5dafec3c2ab3f5f74 | ||
| - name: kind | ||
| value: task | ||
| resolver: bundles | ||
| when: | ||
| - input: $(tasks.init.results.build) | ||
| operator: in | ||
| values: | ||
| - "true" | ||
| - input: $(params.build-source-image) | ||
| operator: in | ||
| values: | ||
| - "true" | ||
| - name: deprecated-base-image-check | ||
| params: | ||
| - name: IMAGE_URL | ||
| value: $(tasks.build-image-index.results.IMAGE_URL) | ||
| - name: IMAGE_DIGEST | ||
| value: $(tasks.build-image-index.results.IMAGE_DIGEST) | ||
| runAfter: | ||
| - build-image-index | ||
| taskRef: | ||
| params: | ||
| - name: name | ||
| value: deprecated-image-check | ||
| - name: bundle | ||
| value: quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.4@sha256:d1836ac902bea0cd7aad61201434f03fc0cdea29e212604dce180e0eef620ba6 | ||
| - name: kind | ||
| value: task | ||
| resolver: bundles | ||
| when: | ||
| - input: $(params.skip-checks) | ||
| operator: in | ||
| values: | ||
| - "false" | ||
| - name: clair-scan | ||
| params: | ||
| - name: image-digest | ||
| value: $(tasks.build-image-index.results.IMAGE_DIGEST) | ||
| - name: image-url | ||
| value: $(tasks.build-image-index.results.IMAGE_URL) | ||
| runAfter: | ||
| - build-image-index | ||
| taskRef: | ||
| params: | ||
| - name: name | ||
| value: clair-scan | ||
| - name: bundle | ||
| value: quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.2@sha256:abe1bf2ca3e77b457b95859e47ec1ab7c0c8c4ef0c173b194cc353b0f18de6e8 | ||
| - name: kind | ||
| value: task | ||
| resolver: bundles | ||
| when: | ||
| - input: $(params.skip-checks) | ||
| operator: in | ||
| values: | ||
| - "false" | ||
| - name: ecosystem-cert-preflight-checks | ||
| params: | ||
| - name: image-url | ||
| value: $(tasks.build-image-index.results.IMAGE_URL) | ||
| runAfter: | ||
| - build-image-index | ||
| taskRef: | ||
| params: | ||
| - name: name | ||
| value: ecosystem-cert-preflight-checks | ||
| - name: bundle | ||
| value: quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.1@sha256:5131cce0f93d0b728c7bcc0d6cee4c61d4c9f67c6d619c627e41e3c9775b497d | ||
| - name: kind | ||
| value: task | ||
| resolver: bundles | ||
| when: | ||
| - input: $(params.skip-checks) | ||
| operator: in | ||
| values: | ||
| - "false" | ||
| - name: sast-snyk-check | ||
| params: | ||
| - name: image-digest | ||
| value: $(tasks.build-image-index.results.IMAGE_DIGEST) | ||
| - name: image-url | ||
| value: $(tasks.build-image-index.results.IMAGE_URL) | ||
| - name: SOURCE_ARTIFACT | ||
| value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) | ||
| - name: CACHI2_ARTIFACT | ||
| value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) | ||
| runAfter: | ||
| - build-image-index | ||
| taskRef: | ||
| params: | ||
| - name: name | ||
| value: sast-snyk-check-oci-ta | ||
| - name: bundle | ||
| value: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.2@sha256:786dafaa98ab131705a0be96d8e4b06ff96f61b9ab8199fb43f1893f0f888076 | ||
| - name: kind | ||
| value: task | ||
| resolver: bundles | ||
| when: | ||
| - input: $(params.skip-checks) | ||
| operator: in | ||
| values: | ||
| - "false" | ||
| - name: clamav-scan | ||
| params: | ||
| - name: image-digest | ||
| value: $(tasks.build-image-index.results.IMAGE_DIGEST) | ||
| - name: image-url | ||
| value: $(tasks.build-image-index.results.IMAGE_URL) | ||
| runAfter: | ||
| - build-image-index | ||
| taskRef: | ||
| params: | ||
| - name: name | ||
| value: clamav-scan | ||
| - name: bundle | ||
| value: quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.1@sha256:9254f82eea9b8b00a8f5c896089185e07693a3a195a065b283d5bfc256486c95 | ||
| - name: kind | ||
| value: task | ||
| resolver: bundles | ||
| when: | ||
| - input: $(params.skip-checks) | ||
| operator: in | ||
| values: | ||
| - "false" | ||
| - name: apply-tags | ||
| params: | ||
| - name: IMAGE | ||
| value: $(tasks.build-image-index.results.IMAGE_URL) | ||
| runAfter: | ||
| - build-image-index | ||
| taskRef: | ||
| params: | ||
| - name: name | ||
| value: apply-tags | ||
| - name: bundle | ||
| value: quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.1@sha256:e6beb161ed59d7be26317da03e172137b31b26648d3e139558e9a457bc56caff | ||
| - name: kind | ||
| value: task | ||
| resolver: bundles | ||
| - name: push-dockerfile | ||
| params: | ||
| - name: IMAGE | ||
| value: $(tasks.build-image-index.results.IMAGE_URL) | ||
| - name: IMAGE_DIGEST | ||
| value: $(tasks.build-image-index.results.IMAGE_DIGEST) | ||
| - name: DOCKERFILE | ||
| value: $(params.dockerfile) | ||
| - name: CONTEXT | ||
| value: $(params.path-context) | ||
| - name: SOURCE_ARTIFACT | ||
| value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) | ||
| runAfter: | ||
| - build-image-index | ||
| taskRef: | ||
| params: | ||
| - name: name | ||
| value: push-dockerfile-oci-ta | ||
| - name: bundle | ||
| value: quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.1@sha256:4327183045ffd4d3329e927ed5c26f23b3e9998b858b1958d26842289d7fee3d | ||
| - name: kind | ||
| value: task | ||
| resolver: bundles | ||
| workspaces: | ||
| - name: git-auth | ||
| optional: true | ||
| - name: netrc | ||
| optional: true | ||
| taskRunTemplate: {} | ||
| workspaces: | ||
| - name: git-auth | ||
| secret: | ||
| secretName: '{{ git_auth_secret }}' | ||
| status: {} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,449 @@ | ||
| apiVersion: tekton.dev/v1 | ||
| kind: PipelineRun | ||
| metadata: | ||
| annotations: | ||
| build.appstudio.openshift.io/repo: https://github.com/RedHatInsights/export-service-go?rev={{revision}} | ||
| build.appstudio.redhat.com/commit_sha: '{{revision}}' | ||
| build.appstudio.redhat.com/target_branch: '{{target_branch}}' | ||
| pipelinesascode.tekton.dev/max-keep-runs: "3" | ||
| pipelinesascode.tekton.dev/on-cel-expression: event == "push" && target_branch | ||
| == "main" | ||
| creationTimestamp: null | ||
| labels: | ||
| appstudio.openshift.io/application: export-service | ||
| appstudio.openshift.io/component: export-service | ||
| pipelines.appstudio.openshift.io/type: build | ||
| name: export-service-on-push | ||
| namespace: hcc-integrations-tenant | ||
| spec: | ||
| params: | ||
| - name: git-url | ||
| value: '{{source_url}}' | ||
| - name: revision | ||
| value: '{{revision}}' | ||
| - name: output-image | ||
| value: quay.io/redhat-user-workloads/hcc-integrations-tenant/export-service/export-service:{{revision}} | ||
| - name: dockerfile | ||
| value: Dockerfile | ||
| pipelineSpec: | ||
| description: | | ||
| This pipeline is ideal for building container images from a Containerfile while maintaining trust after pipeline customization. | ||
| _Uses `buildah` to create a container image leveraging [trusted artifacts](https://konflux-ci.dev/architecture/ADR/0036-trusted-artifacts.html). It also optionally creates a source image and runs some build-time tests. Information is shared between tasks using OCI artifacts instead of PVCs. EC will pass the [`trusted_task.trusted`](https://enterprisecontract.dev/docs/ec-policies/release_policy.html#trusted_task__trusted) policy as long as all data used to build the artifact is generated from trusted tasks. | ||
| This pipeline is pushed as a Tekton bundle to [quay.io](https://quay.io/repository/konflux-ci/tekton-catalog/pipeline-docker-build-oci-ta?tab=tags)_ | ||
| finally: | ||
| - name: show-sbom | ||
| params: | ||
| - name: IMAGE_URL | ||
| value: $(tasks.build-image-index.results.IMAGE_URL) | ||
| taskRef: | ||
| params: | ||
| - name: name | ||
| value: show-sbom | ||
| - name: bundle | ||
| value: quay.io/konflux-ci/tekton-catalog/task-show-sbom:0.1@sha256:9bfc6b99ef038800fe131d7b45ff3cd4da3a415dd536f7c657b3527b01c4a13b | ||
| - name: kind | ||
| value: task | ||
| resolver: bundles | ||
| params: | ||
| - description: Source Repository URL | ||
| name: git-url | ||
| type: string | ||
| - default: "" | ||
| description: Revision of the Source Repository | ||
| name: revision | ||
| type: string | ||
| - description: Fully Qualified Output Image | ||
| name: output-image | ||
| type: string | ||
| - default: . | ||
| description: Path to the source code of an application's component from where | ||
| to build image. | ||
| name: path-context | ||
| type: string | ||
| - default: Dockerfile | ||
| description: Path to the Dockerfile inside the context specified by parameter | ||
| path-context | ||
| name: dockerfile | ||
| type: string | ||
| - default: "false" | ||
| description: Force rebuild image | ||
| name: rebuild | ||
| type: string | ||
| - default: "false" | ||
| description: Skip checks against built image | ||
| name: skip-checks | ||
| type: string | ||
| - default: "false" | ||
| description: Execute the build with network isolation | ||
| name: hermetic | ||
| type: string | ||
| - default: "" | ||
| description: Build dependencies to be prefetched by Cachi2 | ||
| name: prefetch-input | ||
| type: string | ||
| - default: "" | ||
| description: Image tag expiration time, time values could be something like | ||
| 1h, 2d, 3w for hours, days, and weeks, respectively. | ||
| name: image-expires-after | ||
| - default: "false" | ||
| description: Build a source image. | ||
| name: build-source-image | ||
| type: string | ||
| - default: "false" | ||
| description: Add built image into an OCI image index | ||
| name: build-image-index | ||
| type: string | ||
| - default: [] | ||
| description: Array of --build-arg values ("arg=value" strings) for buildah | ||
| name: build-args | ||
| type: array | ||
| - default: "" | ||
| description: Path to a file with build arguments for buildah, see https://www.mankier.com/1/buildah-build#--build-arg-file | ||
| name: build-args-file | ||
| type: string | ||
| results: | ||
| - description: "" | ||
| name: IMAGE_URL | ||
| value: $(tasks.build-image-index.results.IMAGE_URL) | ||
| - description: "" | ||
| name: IMAGE_DIGEST | ||
| value: $(tasks.build-image-index.results.IMAGE_DIGEST) | ||
| - description: "" | ||
| name: CHAINS-GIT_URL | ||
| value: $(tasks.clone-repository.results.url) | ||
| - description: "" | ||
| name: CHAINS-GIT_COMMIT | ||
| value: $(tasks.clone-repository.results.commit) | ||
| tasks: | ||
| - name: init | ||
| params: | ||
| - name: image-url | ||
| value: $(params.output-image) | ||
| - name: rebuild | ||
| value: $(params.rebuild) | ||
| - name: skip-checks | ||
| value: $(params.skip-checks) | ||
| taskRef: | ||
| params: | ||
| - name: name | ||
| value: init | ||
| - name: bundle | ||
| value: quay.io/konflux-ci/tekton-catalog/task-init:0.2@sha256:092c113b614f6551113f17605ae9cb7e822aa704d07f0e37ed209da23ce392cc | ||
| - name: kind | ||
| value: task | ||
| resolver: bundles | ||
| - name: clone-repository | ||
| params: | ||
| - name: url | ||
| value: $(params.git-url) | ||
| - name: revision | ||
| value: $(params.revision) | ||
| - name: ociStorage | ||
| value: $(params.output-image).git | ||
| - name: ociArtifactExpiresAfter | ||
| value: $(params.image-expires-after) | ||
| runAfter: | ||
| - init | ||
| taskRef: | ||
| params: | ||
| - name: name | ||
| value: git-clone-oci-ta | ||
| - name: bundle | ||
| value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.1@sha256:b03bb5e21665b17ae2f645496013a072b00f1a174024dc1ff41dc626f364c66b | ||
| - name: kind | ||
| value: task | ||
| resolver: bundles | ||
| when: | ||
| - input: $(tasks.init.results.build) | ||
| operator: in | ||
| values: | ||
| - "true" | ||
| workspaces: | ||
| - name: basic-auth | ||
| workspace: git-auth | ||
| - name: prefetch-dependencies | ||
| params: | ||
| - name: input | ||
| value: $(params.prefetch-input) | ||
| - name: SOURCE_ARTIFACT | ||
| value: $(tasks.clone-repository.results.SOURCE_ARTIFACT) | ||
| - name: ociStorage | ||
| value: $(params.output-image).prefetch | ||
| - name: ociArtifactExpiresAfter | ||
| value: $(params.image-expires-after) | ||
| runAfter: | ||
| - clone-repository | ||
| taskRef: | ||
| params: | ||
| - name: name | ||
| value: prefetch-dependencies-oci-ta | ||
| - name: bundle | ||
| value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.1@sha256:ad15707d97026d6d462e4c02a09e73a3cffdcdae3a91b03f39d2675d5a000d2b | ||
| - name: kind | ||
| value: task | ||
| resolver: bundles | ||
| workspaces: | ||
| - name: git-basic-auth | ||
| workspace: git-auth | ||
| - name: netrc | ||
| workspace: netrc | ||
| - name: build-container | ||
| params: | ||
| - name: IMAGE | ||
| value: $(params.output-image) | ||
| - name: DOCKERFILE | ||
| value: $(params.dockerfile) | ||
| - name: CONTEXT | ||
| value: $(params.path-context) | ||
| - name: HERMETIC | ||
| value: $(params.hermetic) | ||
| - name: PREFETCH_INPUT | ||
| value: $(params.prefetch-input) | ||
| - name: IMAGE_EXPIRES_AFTER | ||
| value: $(params.image-expires-after) | ||
| - name: COMMIT_SHA | ||
| value: $(tasks.clone-repository.results.commit) | ||
| - name: BUILD_ARGS | ||
| value: | ||
| - $(params.build-args[*]) | ||
| - name: BUILD_ARGS_FILE | ||
| value: $(params.build-args-file) | ||
| - name: SOURCE_ARTIFACT | ||
| value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) | ||
| - name: CACHI2_ARTIFACT | ||
| value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) | ||
| runAfter: | ||
| - prefetch-dependencies | ||
| taskRef: | ||
| params: | ||
| - name: name | ||
| value: buildah-oci-ta | ||
| - name: bundle | ||
| value: quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta:0.2@sha256:6620f885c459e0e062c44797a4fc7b0f28c54c117de3771234b065c76714f663 | ||
| - name: kind | ||
| value: task | ||
| resolver: bundles | ||
| when: | ||
| - input: $(tasks.init.results.build) | ||
| operator: in | ||
| values: | ||
| - "true" | ||
| - name: build-image-index | ||
| params: | ||
| - name: IMAGE | ||
| value: $(params.output-image) | ||
| - name: COMMIT_SHA | ||
| value: $(tasks.clone-repository.results.commit) | ||
| - name: IMAGE_EXPIRES_AFTER | ||
| value: $(params.image-expires-after) | ||
| - name: ALWAYS_BUILD_INDEX | ||
| value: $(params.build-image-index) | ||
| - name: IMAGES | ||
| value: | ||
| - $(tasks.build-container.results.IMAGE_URL)@$(tasks.build-container.results.IMAGE_DIGEST) | ||
| runAfter: | ||
| - build-container | ||
| taskRef: | ||
| params: | ||
| - name: name | ||
| value: build-image-index | ||
| - name: bundle | ||
| value: quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.1@sha256:8619eabd7cf3340d1123afadac1f4296dc14472c8db0f774497748c762f46f33 | ||
| - name: kind | ||
| value: task | ||
| resolver: bundles | ||
| when: | ||
| - input: $(tasks.init.results.build) | ||
| operator: in | ||
| values: | ||
| - "true" | ||
| - name: build-source-image | ||
| params: | ||
| - name: BINARY_IMAGE | ||
| value: $(params.output-image) | ||
| - name: SOURCE_ARTIFACT | ||
| value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) | ||
| - name: CACHI2_ARTIFACT | ||
| value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) | ||
| runAfter: | ||
| - build-image-index | ||
| taskRef: | ||
| params: | ||
| - name: name | ||
| value: source-build-oci-ta | ||
| - name: bundle | ||
| value: quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta:0.1@sha256:639995e4221da90f5a9fc14dacd0dba384e2a37e3a2c7aa5dafec3c2ab3f5f74 | ||
| - name: kind | ||
| value: task | ||
| resolver: bundles | ||
| when: | ||
| - input: $(tasks.init.results.build) | ||
| operator: in | ||
| values: | ||
| - "true" | ||
| - input: $(params.build-source-image) | ||
| operator: in | ||
| values: | ||
| - "true" | ||
| - name: deprecated-base-image-check | ||
| params: | ||
| - name: IMAGE_URL | ||
| value: $(tasks.build-image-index.results.IMAGE_URL) | ||
| - name: IMAGE_DIGEST | ||
| value: $(tasks.build-image-index.results.IMAGE_DIGEST) | ||
| runAfter: | ||
| - build-image-index | ||
| taskRef: | ||
| params: | ||
| - name: name | ||
| value: deprecated-image-check | ||
| - name: bundle | ||
| value: quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.4@sha256:d1836ac902bea0cd7aad61201434f03fc0cdea29e212604dce180e0eef620ba6 | ||
| - name: kind | ||
| value: task | ||
| resolver: bundles | ||
| when: | ||
| - input: $(params.skip-checks) | ||
| operator: in | ||
| values: | ||
| - "false" | ||
| - name: clair-scan | ||
| params: | ||
| - name: image-digest | ||
| value: $(tasks.build-image-index.results.IMAGE_DIGEST) | ||
| - name: image-url | ||
| value: $(tasks.build-image-index.results.IMAGE_URL) | ||
| runAfter: | ||
| - build-image-index | ||
| taskRef: | ||
| params: | ||
| - name: name | ||
| value: clair-scan | ||
| - name: bundle | ||
| value: quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.2@sha256:abe1bf2ca3e77b457b95859e47ec1ab7c0c8c4ef0c173b194cc353b0f18de6e8 | ||
| - name: kind | ||
| value: task | ||
| resolver: bundles | ||
| when: | ||
| - input: $(params.skip-checks) | ||
| operator: in | ||
| values: | ||
| - "false" | ||
| - name: ecosystem-cert-preflight-checks | ||
| params: | ||
| - name: image-url | ||
| value: $(tasks.build-image-index.results.IMAGE_URL) | ||
| runAfter: | ||
| - build-image-index | ||
| taskRef: | ||
| params: | ||
| - name: name | ||
| value: ecosystem-cert-preflight-checks | ||
| - name: bundle | ||
| value: quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.1@sha256:5131cce0f93d0b728c7bcc0d6cee4c61d4c9f67c6d619c627e41e3c9775b497d | ||
| - name: kind | ||
| value: task | ||
| resolver: bundles | ||
| when: | ||
| - input: $(params.skip-checks) | ||
| operator: in | ||
| values: | ||
| - "false" | ||
| - name: sast-snyk-check | ||
| params: | ||
| - name: image-digest | ||
| value: $(tasks.build-image-index.results.IMAGE_DIGEST) | ||
| - name: image-url | ||
| value: $(tasks.build-image-index.results.IMAGE_URL) | ||
| - name: SOURCE_ARTIFACT | ||
| value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) | ||
| - name: CACHI2_ARTIFACT | ||
| value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) | ||
| runAfter: | ||
| - build-image-index | ||
| taskRef: | ||
| params: | ||
| - name: name | ||
| value: sast-snyk-check-oci-ta | ||
| - name: bundle | ||
| value: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.2@sha256:786dafaa98ab131705a0be96d8e4b06ff96f61b9ab8199fb43f1893f0f888076 | ||
| - name: kind | ||
| value: task | ||
| resolver: bundles | ||
| when: | ||
| - input: $(params.skip-checks) | ||
| operator: in | ||
| values: | ||
| - "false" | ||
| - name: clamav-scan | ||
| params: | ||
| - name: image-digest | ||
| value: $(tasks.build-image-index.results.IMAGE_DIGEST) | ||
| - name: image-url | ||
| value: $(tasks.build-image-index.results.IMAGE_URL) | ||
| runAfter: | ||
| - build-image-index | ||
| taskRef: | ||
| params: | ||
| - name: name | ||
| value: clamav-scan | ||
| - name: bundle | ||
| value: quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.1@sha256:9254f82eea9b8b00a8f5c896089185e07693a3a195a065b283d5bfc256486c95 | ||
| - name: kind | ||
| value: task | ||
| resolver: bundles | ||
| when: | ||
| - input: $(params.skip-checks) | ||
| operator: in | ||
| values: | ||
| - "false" | ||
| - name: apply-tags | ||
| params: | ||
| - name: IMAGE | ||
| value: $(tasks.build-image-index.results.IMAGE_URL) | ||
| runAfter: | ||
| - build-image-index | ||
| taskRef: | ||
| params: | ||
| - name: name | ||
| value: apply-tags | ||
| - name: bundle | ||
| value: quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.1@sha256:e6beb161ed59d7be26317da03e172137b31b26648d3e139558e9a457bc56caff | ||
| - name: kind | ||
| value: task | ||
| resolver: bundles | ||
| - name: push-dockerfile | ||
| params: | ||
| - name: IMAGE | ||
| value: $(tasks.build-image-index.results.IMAGE_URL) | ||
| - name: IMAGE_DIGEST | ||
| value: $(tasks.build-image-index.results.IMAGE_DIGEST) | ||
| - name: DOCKERFILE | ||
| value: $(params.dockerfile) | ||
| - name: CONTEXT | ||
| value: $(params.path-context) | ||
| - name: SOURCE_ARTIFACT | ||
| value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) | ||
| runAfter: | ||
| - build-image-index | ||
| taskRef: | ||
| params: | ||
| - name: name | ||
| value: push-dockerfile-oci-ta | ||
| - name: bundle | ||
| value: quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.1@sha256:4327183045ffd4d3329e927ed5c26f23b3e9998b858b1958d26842289d7fee3d | ||
| - name: kind | ||
| value: task | ||
| resolver: bundles | ||
| workspaces: | ||
| - name: git-auth | ||
| optional: true | ||
| - name: netrc | ||
| optional: true | ||
| taskRunTemplate: {} | ||
| workspaces: | ||
| - name: git-auth | ||
| secret: | ||
| secretName: '{{ git_auth_secret }}' | ||
| status: {} |