fix(KONFLUX-3663): format PipelineRun files and upload SAST results

[ccronca]

This update configures the SAST task to upload SARIF results to quay.io for long-term storage

Please note that this PR was automatically generated and may include unrelated changes due to automatic YAML formatting performed by yq
The YAML files will be indented using 2 spaces, if the YAML file uses indentationless list the automation will try to keep this format

The PR contains two separate commits:

1. Format YAML files: Ensures consistent indentation and formatting of the YAML files
2. Upload SAST results: Configures the PipelineRun files to enable uploading SARIF results to quay.io

Separating these changes into two commits simplifies the review process. The first commit focuses on indentation and formatting, while the second commit contains the semantic changes

Related:

• https://issues.redhat.com/browse/KONFLUX-3663
• https://issues.redhat.com/browse/KONFLUX-2263

[Molter73]

I know this sort of comment is annoying, but why do we need the first commit that does automatic formatting and nothing else? We've written our tekton files in a way that make them easy for us to work with, since we write them by hand and are not auto-generated, removing the spaces between blocks just makes them hard to spot.

If we want to keep this new style of formatting, I would ask that we add a way to enforce it in CI so it stays consistent, otherwise we drop the first commit and only keep the changes that are meaningful.

[ccronca]

I know this sort of comment is annoying, but why do we need the first commit that does automatic formatting and nothing else? We've written our tekton files in a way that make them easy for us to work with, since we write them by hand and are not auto-generated, removing the spaces between blocks just makes them hard to spot.

If we want to keep this new style of formatting, I would ask that we add a way to enforce it in CI so it stays consistent, otherwise we drop the first commit and only keep the changes that are meaningful.

Hi @Molter73 please note that this PR was done programmatically, so maintaining the same format as the original file is quite complex due to limitations in the underlying tools used. If you don't want to merge all the changes, you can implement just the changes from the second commit in the PR.

[msugakov]

Hi @ccronca

This, I think, is the first time we receive a PR contribution from the Konflux team.
Do you foresee that we'll become a common practice in the future?

Not sure about yq, but the formatting would not be lost if files are processed with Python in streaming mode. It's tiny bit more difficult than loading and saving, but it preserves the original style.

[ccronca]

Hi @ccronca

This, I think, is the first time we receive a PR contribution from the Konflux team. Do you foresee that we'll become a common practice in the future?

Not sure about yq, but the formatting would not be lost if files are processed with Python in streaming mode. It's tiny bit more difficult than loading and saving, but it preserves the original style.

Please note that I'm part of the ProdSec team, not Konfux. This PR is required to push the results to quay.io for long-term storage. Without this, the sast-snyk-check will show an error due to the results not being pushed. This ensures ProdSec can access security scans for RedHat-related products. If this doesn't apply to you, feel free to ignore this PR.

[msugakov]

There's absolutely no problem to connect it to quay, I'm re-creating these PRs for that but without formatting changes.

[msugakov]

#1801 is to replace this PR.