-
Notifications
You must be signed in to change notification settings - Fork 12
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
ROX-25321: convert konflux builds to OCI artifacts
- Loading branch information
Showing
7 changed files
with
157 additions
and
118 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,44 @@ | ||
| apiVersion: tekton.dev/v1 | ||
| kind: Task | ||
| metadata: | ||
| name: determine-image-tag-oci-ta | ||
| namespace: rh-acs-tenant | ||
| # TODO(ROX-23812): Refactor to a task bundle | ||
| spec: | ||
| description: Determines the tag for the output image using the StackRox convention from 'make tag' output. | ||
| params: | ||
| - name: TAG_SUFFIX | ||
| description: Suffix to append to generated image tag. | ||
| type: string | ||
| - name: SOURCE_ARTIFACT | ||
| description: The Trusted Artifact URI pointing to the artifact with | ||
| the application source code. This should be the result of the git-clone task, | ||
| results from other tasks might fail as dirty. | ||
| type: string | ||
| results: | ||
| - name: IMAGE_TAG | ||
| description: Image Tag determined by custom logic. | ||
| volumes: | ||
| - name: workdir | ||
| emptyDir: {} | ||
| stepTemplate: | ||
| volumeMounts: | ||
| - mountPath: /var/workdir | ||
| name: workdir | ||
| steps: | ||
| - name: use-trusted-artifact | ||
| image: quay.io/redhat-appstudio/build-trusted-artifacts:latest@sha256:4e39fb97f4444c2946944482df47b39c5bbc195c54c6560b0647635f553ab23d | ||
| args: | ||
| - use | ||
| - $(params.SOURCE_ARTIFACT)=/var/workdir/source | ||
| - name: determine-image-tag | ||
| image: registry.access.redhat.com/ubi8:latest | ||
| workingDir: /var/workdir/source | ||
| script: | | ||
| #!/usr/bin/env bash | ||
| set -euo pipefail | ||
| dnf -y upgrade --nobest | ||
| dnf -y install git make | ||
| .konflux/scripts/fail-build-if-git-is-dirty.sh | ||
| echo -n "$(make --quiet --no-print-directory tag)$(params.TAG_SUFFIX)" | tee "$(results.IMAGE_TAG.path)" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,70 @@ | ||
| apiVersion: tekton.dev/v1 | ||
| kind: Task | ||
| metadata: | ||
| name: fetch-scanner-data-oci-ta | ||
| namespace: rh-acs-tenant | ||
| # TODO(ROX-22196): Make the task EC-compliant (e.g. move to a bundle) | ||
| spec: | ||
| description: Downloads blobs from definitions.stackrox.io GCloud bucket to be included in Scanner container builds. | ||
| params: | ||
| - name: blobs-to-fetch | ||
| description: | | ||
| List of scanner-data file names to fetch to include in the container build. | ||
| An empty list is allowed which results in no-op. | ||
| type: array | ||
| - name: target-dir | ||
| description: Target directory relative to workspace where to save downloaded blobs. | ||
| type: string | ||
| default: "source" | ||
| - name: SOURCE_ARTIFACT | ||
| description: The Trusted Artifact URI pointing to the artifact with | ||
| the application source code. This should be the result of the git-clone task, | ||
| results from other tasks might fail as dirty. | ||
| type: string | ||
| - name: ociStorage | ||
| description: The OCI repository where the Trusted Artifacts are stored. | ||
| type: string | ||
| - name: ociArtifactExpiresAfter | ||
| description: Expiration date for the trusted artifacts created in the | ||
| OCI repository. | ||
| type: string | ||
| results: | ||
| - name: SOURCE_ARTIFACT | ||
| description: The Trusted Artifact URI pointing to the artifact with the application source code | ||
| and additional smuggled activation key. | ||
| type: string | ||
| volumes: | ||
| - name: workdir | ||
| emptyDir: {} | ||
| stepTemplate: | ||
| volumeMounts: /var/workdir | ||
| name: workdir | ||
| steps: | ||
| - name: use-trusted-artifact | ||
| image: quay.io/redhat-appstudio/build-trusted-artifacts:latest@sha256:4e39fb97f4444c2946944482df47b39c5bbc195c54c6560b0647635f553ab23d | ||
| args: | ||
| - use | ||
| - $(params.SOURCE_ARTIFACT)=/var/workdir/source | ||
| - name: fetch-scanner-data | ||
| image: registry.access.redhat.com/ubi8/ubi-minimal:latest | ||
| # The only functioning way to pass array parameter that I found is through args array. | ||
| # Array params have weird limitations, see https://github.com/tektoncd/pipeline/blob/main/docs/tasks.md#substituting-array-parameters | ||
| # Attempts to pass this in other places result in webhook errors and pipeline not starting. | ||
| args: [ "$(params.blobs-to-fetch[*])" ] | ||
| workingDir: /var/workdir/source | ||
| script: | | ||
| #!/usr/bin/env bash | ||
| set -euo pipefail | ||
| exec "scripts/konflux/fetch-scanner-data.sh" "$(params.target-dir)" "$@" | ||
| # It should not take long to download blobs otherwise there's something odd going on. | ||
| timeout: 10m | ||
| - name: create-trusted-artifact | ||
| image: quay.io/redhat-appstudio/build-trusted-artifacts:latest@sha256:4e39fb97f4444c2946944482df47b39c5bbc195c54c6560b0647635f553ab23d | ||
| args: | ||
| - create | ||
| - --store | ||
| - $(params.ociStorage) | ||
| - $(results.SOURCE_ARTIFACT.path)=/var/workdir/source | ||
| env: | ||
| - name: IMAGE_EXPIRES_AFTER | ||
| value: $(params.ociArtifactExpiresAfter) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.