ROX-25321: convert konflux builds to OCI artifacts (#1573)

.tekton/determine-image-tag-oci-ta.yaml

@@ -0,0 +1,44 @@
+apiVersion: tekton.dev/v1
+kind: Task
+metadata:
+  name: determine-image-tag-oci-ta
+  namespace: rh-acs-tenant
+# TODO(ROX-23812): Refactor to a task bundle
+spec:
+  description: Determines the tag for the output image using the StackRox convention from 'make tag' output.
+  params:
+  - name: TAG_SUFFIX
+    description: Suffix to append to generated image tag.
+    type: string
+  - name: SOURCE_ARTIFACT
+    description: The Trusted Artifact URI pointing to the artifact with
+      the application source code. This should be the result of the git-clone task,
+      results from other tasks might fail as dirty.
+    type: string
+  results:
+  - name: IMAGE_TAG
+    description: Image Tag determined by custom logic.
+  volumes:
+    - name: workdir
+      emptyDir: {}
+  stepTemplate:
+    volumeMounts:
+      - mountPath: /var/workdir
+        name: workdir
+  steps:
+  - name: use-trusted-artifact
+    image: quay.io/redhat-appstudio/build-trusted-artifacts:latest@sha256:4e39fb97f4444c2946944482df47b39c5bbc195c54c6560b0647635f553ab23d
+    args:
+      - use
+      - $(params.SOURCE_ARTIFACT)=/var/workdir/source
+  - name: determine-image-tag
+    image: registry.access.redhat.com/ubi8:latest
+    workingDir: /var/workdir/source
+    script: |
+      #!/usr/bin/env bash
+      set -euo pipefail
+      dnf -y upgrade --nobest
+      dnf -y install git make
+
+      scripts/konflux/fail-build-if-git-is-dirty.sh
+      echo -n "$(make --quiet --no-print-directory tag)$(params.TAG_SUFFIX)" | tee "$(results.IMAGE_TAG.path)"

.tekton/fetch-scanner-data-oci-ta-task.yaml

@@ -0,0 +1,71 @@
+apiVersion: tekton.dev/v1
+kind: Task
+metadata:
+  name: fetch-scanner-data-oci-ta
+  namespace: rh-acs-tenant
+# TODO(ROX-22196): Make the task EC-compliant (e.g. move to a bundle)
+spec:
+  description: Downloads blobs from definitions.stackrox.io GCloud bucket to be included in Scanner container builds.
+  params:
+  - name: blobs-to-fetch
+    description: |
+      List of scanner-data file names to fetch to include in the container build.
+      An empty list is allowed which results in no-op.
+    type: array
+  - name: target-dir
+    description: Target directory relative to workspace where to save downloaded blobs.
+    type: string
+    default: "."
+  - name: SOURCE_ARTIFACT
+    description: The Trusted Artifact URI pointing to the artifact with
+      the application source code. This should be the result of the git-clone task,
+      results from other tasks might fail as dirty.
+    type: string
+  - name: ociStorage
+    description: The OCI repository where the Trusted Artifacts are stored.
+    type: string
+  - name: ociArtifactExpiresAfter
+    description: Expiration date for the trusted artifacts created in the
+      OCI repository.
+    type: string
+  results:
+  - name: SOURCE_ARTIFACT
+    description: The Trusted Artifact URI pointing to the artifact with the application source code
+      and additional smuggled activation key.
+    type: string
+  volumes:
+    - name: workdir
+      emptyDir: {}
+  stepTemplate:
+    volumeMounts:
+      - mountPath: /var/workdir
+        name: workdir
+  steps:
+  - name: use-trusted-artifact
+    image: quay.io/redhat-appstudio/build-trusted-artifacts:latest@sha256:4e39fb97f4444c2946944482df47b39c5bbc195c54c6560b0647635f553ab23d
+    args:
+      - use
+      - $(params.SOURCE_ARTIFACT)=/var/workdir/source
+  - name: fetch-scanner-data
+    image: registry.access.redhat.com/ubi8/ubi-minimal:latest
+    # The only functioning way to pass array parameter that I found is through args array.
+    # Array params have weird limitations, see https://github.com/tektoncd/pipeline/blob/main/docs/tasks.md#substituting-array-parameters
+    # Attempts to pass this in other places result in webhook errors and pipeline not starting.
+    args: [ "$(params.blobs-to-fetch[*])" ]
+    workingDir: /var/workdir/source
+    script: |
+      #!/usr/bin/env bash
+      set -euo pipefail
+      scripts/konflux/fetch-scanner-data.sh "$(params.target-dir)" "$@"
+    # It should not take long to download blobs otherwise there's something odd going on.
+    timeout: 10m
+  - name: create-trusted-artifact
+    image: quay.io/redhat-appstudio/build-trusted-artifacts:latest@sha256:4e39fb97f4444c2946944482df47b39c5bbc195c54c6560b0647635f553ab23d
+    args:
+      - create
+      - --store
+      - $(params.ociStorage)
+      - $(results.SOURCE_ARTIFACT.path)=/var/workdir/source
+    env:
+      - name: IMAGE_EXPIRES_AFTER
+        value: $(params.ociArtifactExpiresAfter)

.tekton/scanner-build.yaml

@@ -53,16 +53,6 @@ spec:
     value: [ 'nvd-definitions.zip', 'k8s-definitions.zip', 'repo2cpe.zip', 'genesis_manifests.json' ]
 
   workspaces:
-  - name: workspace
-    volumeClaimTemplate:
-      metadata:
-        creationTimestamp: null
-      spec:
-        accessModes:
-        - ReadWriteOnce
-        resources:
-          requests:
-            storage: 1Gi
   - name: git-auth
     secret:
       secretName: '{{ git_auth_secret }}'