{ "apiVersion": "v1", "items": [ { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.redhat.com/nudged-components": "fj-multi-component-child-lxxk", "build.appstudio.redhat.com/nudging-commit": "43e86a4fc8babc3ae86d14ce0777a7b16cfe9a2a", "build.appstudio.redhat.com/nudging-component": "fj-multi-component-parent-lxxk", "build.appstudio.redhat.com/nudging-image": "quay.io/redhat-appstudio-qe/build-e2e-bije/fj-multi-component-parent-lxxk:43e86a4fc8babc3ae86d14ce0777a7b16cfe9a2a", "build.appstudio.redhat.com/nudging-pipeline": "fj-multi-component-parent-lxxk-on-push-4cr52", "chains.tekton.dev/signed": "true", "pipeline.tekton.dev/release": "9db88e0", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-bije/results/96821243-ea1f-4ca3-a896-3e8ae3f3e921/records/d0e40b34-9187-43c9-9c47-8ceb2fe8caf1", "results.tekton.dev/result": "build-e2e-bije/results/96821243-ea1f-4ca3-a896-3e8ae3f3e921", "results.tekton.dev/stored": "true" }, "creationTimestamp": "2026-07-08T17:14:34Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "build.appstudio.redhat.com/type": "nudge", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "renovate-pipeline-1783530874-def2a", "tekton.dev/pipelineRun": "renovate-pipeline-1783530874-def2a", "tekton.dev/pipelineRunUID": "96821243-ea1f-4ca3-a896-3e8ae3f3e921", "tekton.dev/pipelineTask": "renovate" }, "name": "renovate-pipeline-1783530874-def2a-renovate", "namespace": "build-e2e-bije", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "renovate-pipeline-1783530874-def2a", "uid": "96821243-ea1f-4ca3-a896-3e8ae3f3e921" } ], "resourceVersion": "22975", "uid": "d0e40b34-9187-43c9-9c47-8ceb2fe8caf1" }, "spec": { "serviceAccountName": "build-pipeline-fj-multi-component-parent-lxxk", "taskSpec": { "steps": [ { "command": [ "bash", "-c", "RENOVATE_X_GITLAB_MERGE_REQUEST_DELAY=5000 RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS=11 RENOVATE_PR_HOURLY_LIMIT=0 RENOVATE_PR_CONCURRENT_LIMIT=0 RENOVATE_TOKEN=$TOKEN_8f8c71ef63 RENOVATE_CONFIG_FILE=/configs/fj-multi-component-child-lxxk-2e524.json RENOVATE_HOST_RULES=\"[{'matchHost':'quay.io','username':'redhat-appstudio-qe+build_e2e_bije_fj_multi_component_parent_lxxk_e7d2ba0891','password':'${TOKEN_1a3ef81df3}'}]\" renovate" ], "computeResources": {}, "env": [ { "name": "LOG_LEVEL", "value": "debug" } ], "envFrom": [ { "prefix": "TOKEN_", "secretRef": { "name": "renovate-pipeline-1783530874-def2a" } } ], "image": "quay.io/konflux-ci/mintmaker-renovate-image:29a2f31", "name": "renovate", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "seccompProfile": { "type": "RuntimeDefault" } }, "volumeMounts": [ { "mountPath": "/configs", "name": "renovate-pipeline-1783530874-def2a" } ] } ], "volumes": [ { "configMap": { "name": "renovate-pipeline-1783530874-def2a" }, "name": "renovate-pipeline-1783530874-def2a" } ] }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-07-08T17:17:42Z", "conditions": [ { "lastTransitionTime": "2026-07-08T17:17:42Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "renovate-pipeline-1783530874-def2a-renovate-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" } }, "startTime": "2026-07-08T17:14:34Z", "steps": [ { "container": "step-renovate", "imageID": "quay.io/konflux-ci/mintmaker-renovate-image@sha256:67d26b20533790565a2949a3f732d595dda9378fea506f1cba88ca17cef13873", "name": "renovate", "provenance": {}, "terminated": { "containerID": "containerd://66a9d3acdc8ed6cba58b91e21e857246d34d887a34372c0e1ba4f6a262df1ca4", "exitCode": 0, "finishedAt": "2026-07-08T17:17:42Z", "reason": "Completed", "startedAt": "2026-07-08T17:17:24Z" }, "terminationReason": "Completed" } ], "taskSpec": { "steps": [ { "command": [ "bash", "-c", "RENOVATE_X_GITLAB_MERGE_REQUEST_DELAY=5000 RENOVATE_X_GITLAB_AUTO_MERGEABLE_CHECK_ATTEMPS=11 RENOVATE_PR_HOURLY_LIMIT=0 RENOVATE_PR_CONCURRENT_LIMIT=0 RENOVATE_TOKEN=$TOKEN_8f8c71ef63 RENOVATE_CONFIG_FILE=/configs/fj-multi-component-child-lxxk-2e524.json RENOVATE_HOST_RULES=\"[{'matchHost':'quay.io','username':'redhat-appstudio-qe+build_e2e_bije_fj_multi_component_parent_lxxk_e7d2ba0891','password':'${TOKEN_1a3ef81df3}'}]\" renovate" ], "computeResources": {}, "env": [ { "name": "LOG_LEVEL", "value": "debug" } ], "envFrom": [ { "prefix": "TOKEN_", "secretRef": { "name": "renovate-pipeline-1783530874-def2a" } } ], "image": "quay.io/konflux-ci/mintmaker-renovate-image:29a2f31", "name": "renovate", "securityContext": { "allowPrivilegeEscalation": false, "capabilities": { "drop": [ "ALL" ] }, "runAsNonRoot": true, "seccompProfile": { "type": "RuntimeDefault" } }, "volumeMounts": [ { "mountPath": "/configs", "name": "renovate-pipeline-1783530874-def2a" } ] } ], "volumes": [ { "configMap": { "name": "renovate-pipeline-1783530874-def2a" }, "name": "renovate-pipeline-1783530874-def2a" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-xuxeza/commit/654b7e6852c296e5035748c2c54ff8facc142986", "build.appstudio.redhat.com/commit_sha": "654b7e6852c296e5035748c2c54ff8facc142986", "build.appstudio.redhat.com/target_branch": "base-duskcs", "chains.tekton.dev/signed": "true", "pipeline.tekton.dev/release": "9db88e0", "pipelinesascode.tekton.dev/branch": "base-duskcs", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-ypfaxy", "pipelinesascode.tekton.dev/git-provider": "gitea", "pipelinesascode.tekton.dev/log-url": "https://localhost:9443/ns/build-e2e-esuy/pipelinerun/fj-test-custom-branch-wrotuf-on-push-5dkrx", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"base-duskcs\"", "pipelinesascode.tekton.dev/original-prname": "fj-test-custom-branch-wrotuf-on-push", "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-xuxeza", "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-devfile-sample-hello-world-xuxeza", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "654b7e6852c296e5035748c2c54ff8facc142986", "pipelinesascode.tekton.dev/sha-title": "Merge pull request 'Konflux update fj-test-custom-branch-wrotuf' (#2) from konflux-fj-test-custom-branch-wrotuf into base-duskcs\n", "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-xuxeza/commit/654b7e6852c296e5035748c2c54ff8facc142986", "pipelinesascode.tekton.dev/source-branch": "refs/heads/base-duskcs", "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-xuxeza", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-xuxeza", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-esuy/results/98d20e37-1e66-49a1-8d48-363ef180aa59/records/de40757f-2ba5-41d5-8691-e91add42eaed", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"devfile-sample-hello-world-xuxeza\",\"commit\":\"654b7e6852c296e5035748c2c54ff8facc142986\",\"eventType\":\"push\"}", "results.tekton.dev/result": "build-e2e-esuy/results/98d20e37-1e66-49a1-8d48-363ef180aa59", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "konflux" }, "creationTimestamp": "2026-07-08T17:18:30Z", "deletionGracePeriodSeconds": 0, "deletionTimestamp": "2026-07-08T17:19:48Z", "finalizers": [ "results.tekton.dev/taskrun" ], "generation": 2, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.42.0", "appstudio.openshift.io/application": "build-suite-test-application-grvn", "appstudio.openshift.io/component": "fj-test-custom-branch-wrotuf", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "fj-test-custom-branch-wrotuf-on-push", "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-devfile-sample-hello-world-xuxeza", "pipelinesascode.tekton.dev/sha": "654b7e6852c296e5035748c2c54ff8facc142986", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-xuxeza", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "fj-test-custom-branch-wrotuf-on-push-5dkrx", "tekton.dev/pipelineRun": "fj-test-custom-branch-wrotuf-on-push-5dkrx", "tekton.dev/pipelineRunUID": "98d20e37-1e66-49a1-8d48-363ef180aa59", "tekton.dev/pipelineTask": "deprecated-base-image-check", "tekton.dev/task": "deprecated-image-check" }, "name": "fj-c884e0549579971ca68b2b3beb780125-deprecated-base-image-check", "namespace": "build-e2e-esuy", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "fj-test-custom-branch-wrotuf-on-push-5dkrx", "uid": "98d20e37-1e66-49a1-8d48-363ef180aa59" } ], "resourceVersion": "25385", "uid": "de40757f-2ba5-41d5-8691-e91add42eaed" }, "spec": { "params": [ { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-esuy/fj-test-custom-branch-wrotuf:654b7e6852c296e5035748c2c54ff8facc142986" }, { "name": "IMAGE_DIGEST", "value": "sha256:677aa96f8bf8e028089692b9ede3d774120928c7ea9fb09a01ee1f396891d312" } ], "serviceAccountName": "build-pipeline-fj-test-custom-branch-wrotuf", "taskRef": { "params": [ { "name": "name", "value": "deprecated-image-check" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:e78d0d3baf3c8cfc1a5ad278196b74032d9568b143a87c7a79ab780fedfb296e" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-07-08T17:18:44Z", "conditions": [ { "lastTransitionTime": "2026-07-08T17:18:44Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "fj-c884e0549579971ca68b2b3b912b7cf2b74fce1fb32330036de94085-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "e78d0d3baf3c8cfc1a5ad278196b74032d9568b143a87c7a79ab780fedfb296e" }, "entryPoint": "deprecated-image-check", "uri": "quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check" } }, "results": [ { "name": "IMAGES_PROCESSED", "type": "string", "value": "{\"image\": {\"pullspec\": \"quay.io/redhat-appstudio-qe/build-e2e-esuy/fj-test-custom-branch-wrotuf:654b7e6852c296e5035748c2c54ff8facc142986\", \"digests\": [\"sha256:677aa96f8bf8e028089692b9ede3d774120928c7ea9fb09a01ee1f396891d312\"]}}\n" }, { "name": "TEST_OUTPUT", "type": "string", "value": "{\"result\":\"WARNING\",\"timestamp\":\"2026-07-08T17:18:44+00:00\",\"note\":\"Task deprecated-image-check completed: Check result for task result.\",\"namespace\":\"required_checks\",\"successes\":0,\"failures\":0,\"warnings\":1}\n" } ], "startTime": "2026-07-08T17:18:30Z", "steps": [ { "container": "step-check-images", "imageID": "quay.io/konflux-ci/konflux-test@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "name": "check-images", "provenance": {}, "terminated": { "containerID": "containerd://3eb3c946954d91683f66f300bc1faff483b154790bfcb30be08b463e572ab9be", "exitCode": 0, "finishedAt": "2026-07-08T17:18:44Z", "message": "[{\"key\":\"IMAGES_PROCESSED\",\"value\":\"{\\\"image\\\": {\\\"pullspec\\\": \\\"quay.io/redhat-appstudio-qe/build-e2e-esuy/fj-test-custom-branch-wrotuf:654b7e6852c296e5035748c2c54ff8facc142986\\\", \\\"digests\\\": [\\\"sha256:677aa96f8bf8e028089692b9ede3d774120928c7ea9fb09a01ee1f396891d312\\\"]}}\\n\",\"type\":1},{\"key\":\"TEST_OUTPUT\",\"value\":\"{\\\"result\\\":\\\"WARNING\\\",\\\"timestamp\\\":\\\"2026-07-08T17:18:44+00:00\\\",\\\"note\\\":\\\"Task deprecated-image-check completed: Check result for task result.\\\",\\\"namespace\\\":\\\"required_checks\\\",\\\"successes\\\":0,\\\"failures\\\":0,\\\"warnings\\\":1}\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-08T17:18:36Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Identifies the unmaintained and potentially insecure deprecated base images. Pyxis API collects metadata from image repository, and Conftest applies supplied policy to identify the deprecated images using that metadata.", "params": [ { "default": "/project/repository/", "description": "Path to directory containing Conftest policies.", "name": "POLICY_DIR", "type": "string" }, { "default": "required_checks", "description": "Namespace for Conftest policy.", "name": "POLICY_NAMESPACE", "type": "string" }, { "default": "", "description": "Digests of base build images.", "name": "BASE_IMAGES_DIGESTS", "type": "string" }, { "description": "Fully qualified image name.", "name": "IMAGE_URL", "type": "string" }, { "description": "Image digest.", "name": "IMAGE_DIGEST", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from.", "name": "CA_TRUST_CONFIG_MAP_NAME", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data.", "name": "CA_TRUST_CONFIG_MAP_KEY", "type": "string" } ], "results": [ { "description": "Tekton task test output.", "name": "TEST_OUTPUT", "type": "string" }, { "description": "Images processed in the task.", "name": "IMAGES_PROCESSED", "type": "string" } ], "steps": [ { "computeResources": { "limits": { "cpu": "100m", "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "env": [ { "name": "POLICY_DIR", "value": "/project/repository/" }, { "name": "POLICY_NAMESPACE", "value": "required_checks" }, { "name": "BASE_IMAGES_DIGESTS" }, { "name": "IMAGE_URL", "value": "quay.io/redhat-appstudio-qe/build-e2e-esuy/fj-test-custom-branch-wrotuf:654b7e6852c296e5035748c2c54ff8facc142986" }, { "name": "IMAGE_DIGEST", "value": "sha256:677aa96f8bf8e028089692b9ede3d774120928c7ea9fb09a01ee1f396891d312" } ], "image": "quay.io/konflux-ci/konflux-test:v1.4.53@sha256:724ecf16a1fc9b51a1b20c91c5125556c53d471d0d8db1648d2404e4715f204e", "name": "check-images", "script": "#!/usr/bin/env bash\nset -euo pipefail\n# shellcheck disable=SC1091 # /utils.sh is only available in the container image at runtime\nsource /utils.sh\ntrap 'handle_error /tekton/results/TEST_OUTPUT' EXIT\n\nIMAGES_TO_BE_PROCESSED_PATH=\"/tmp/images_to_be_processed.txt\"\ntouch /tmp/images_to_be_processed.txt\n\nsuccess_counter=0\nfailure_counter=0\nerror_counter=0\nwarnings_counter=0\n\nimages_processed_template='{\"image\": {\"pullspec\": \"'\"$IMAGE_URL\"'\", \"digests\": [%s]}}'\ndigests_processed=()\n\nimagewithouttag=$(echo -n \"$IMAGE_URL\" | sed \"s/\\(.*\\):.*/\\1/\")\n# strip new-line escape symbol from parameter and save it to variable\nimageanddigest=\"${imagewithouttag}@${IMAGE_DIGEST}\"\n\n# Get the arch and image manifests by inspecting the image. This is mainly for identifying image indexes\nimage_manifests=$(get_image_manifests -i \"${imageanddigest}\")\nif [ -n \"$image_manifests\" ]; then\n while read -r arch arch_sha; do\n SBOM_FILE_PATH=\"/tmp/sbom-${arch}.json\"\n arch_imageanddigest=\"${imagewithouttag}@${arch_sha}\"\n\n # Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\n mkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"${arch_imageanddigest}\" \u003e/tmp/auth/config.json\n export DOCKER_CONFIG=/tmp/auth\n\n # Get base images from SBOM\n if ! cosign download sbom \"$arch_imageanddigest\" \u003e \"${SBOM_FILE_PATH}\"; then\n echo \"Unable to download sbom for arch $arch.\"\n continue\n fi\n\n \u003c \"${SBOM_FILE_PATH}\" jq -r '\n if .bomFormat == \"CycloneDX\" then\n .formulation[]?\n | .components[]?\n | select(any(.properties[]?; .name | test(\"^konflux:container:is_(base|builder)_image\")))\n | (\n .purl\n | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n ) as $matched\n | $matched.repository_url\n else\n .packages[]\n | select(any(.annotations[]?.comment; (fromjson?).name? | test(\"^konflux:container:is_(base|builder)_image\")?))\n | [.externalRefs[]? | select(.referenceType == \"purl\").referenceLocator] as $purls\n | (\n $purls | first\n | capture(\"^pkg:oci/.*?@(?\u003cdigest\u003e[a-z0-9]+:[a-f0-9]+)(?:\\\\?[^#]*repository_url=(?\u003crepository_url\u003e[^\u0026#]*))?\")\n ) as $matched\n | $matched.repository_url\n end\n ' \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n echo \"Detected base images from $arch SBOM:\"\n cat \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n echo \"\"\n\n digests_processed+=(\"\\\"$arch_sha\\\"\")\n done \u003c \u003c(echo \"$image_manifests\" | jq -r 'to_entries[] | \"\\(.key) \\(.value)\"')\nelse\n echo \"Failed to get image manifests from image \\\"$imageanddigest\\\"\"\n note=\"Task deprecated-image-check failed: Failed to get image manifests from image \\\"$imageanddigest\\\". For details, check Tekton task log.\"\n ERROR_OUTPUT=$(make_result_json -r \"ERROR\" -t \"$note\")\n echo \"${ERROR_OUTPUT}\" | tee \"/tekton/results/TEST_OUTPUT\"\n exit 0\nfi\n\n# If the image is an Image Index, also add the Image Index digest to the list.\nif [[ \"${digests_processed[*]}\" != *\"$IMAGE_DIGEST\"* ]]; then\n digests_processed+=(\"\\\"$IMAGE_DIGEST\\\"\")\nfi\n\ndigests_processed_string=$(IFS=,; echo \"${digests_processed[*]}\")\n\nif [ -n \"${BASE_IMAGES_DIGESTS}\" ];\nthen\n echo \"Base images passed by param BASE_IMAGES_DIGESTS: $BASE_IMAGES_DIGESTS\"\n # Get images from the parameter\n for IMAGE_WITH_TAG in $(echo -n \"$BASE_IMAGES_DIGESTS\" | sed 's/\\\\n/\\'$'\\n''/g' );\n do\n echo \"$IMAGE_WITH_TAG\" | cut -d \":\" -f1 \u003e\u003e \"${IMAGES_TO_BE_PROCESSED_PATH}\"\n done\nfi\n\n# we want to remove duplicated entries\nBASE_IMAGES=$(sort -u \"${IMAGES_TO_BE_PROCESSED_PATH}\")\n\necho \"Images to be checked:\"\necho \"$BASE_IMAGES\"\necho \"\"\n\nfor BASE_IMAGE in ${BASE_IMAGES};\ndo\n IFS=:'/' read -r IMAGE_REGISTRY IMAGE_REPOSITORY\u003c\u003c\u003c \"$BASE_IMAGE\"\n\n # Red Hat Catalog hack: registry.redhat.io must be queried as registry.access.redhat.com in Red Hat catalog\n IMAGE_REGISTRY_CATALOG=$(echo \"${IMAGE_REGISTRY}\" | sed 's/^registry.redhat.io$/registry.access.redhat.com/')\n\n export IMAGE_REPO_PATH=\"/tmp/${IMAGE_REPOSITORY}\"\n mkdir -p \"${IMAGE_REPO_PATH}\"\n echo \"Querying Red Hat Catalog for $BASE_IMAGE.\"\n http_code=$(curl -s -o \"${IMAGE_REPO_PATH}/repository_data.json\" -w '%{http_code}' \"https://catalog.redhat.com/api/containers/v1/repositories/registry/${IMAGE_REGISTRY_CATALOG}/repository/${IMAGE_REPOSITORY}\")\n\n if [ \"$http_code\" == \"200\" ];\n then\n echo \"Running conftest using $POLICY_DIR policy, $POLICY_NAMESPACE namespace.\"\n /usr/bin/conftest test --no-fail \"${IMAGE_REPO_PATH}/repository_data.json\" \\\n --policy \"$POLICY_DIR\" --namespace \"$POLICY_NAMESPACE\" \\\n --output=json | tee \"${IMAGE_REPO_PATH}/deprecated_image_check_output.json\"\n\n failures_num=$(jq -r '.[].failures|length' \"${IMAGE_REPO_PATH}/deprecated_image_check_output.json\")\n if [[ \"${failures_num}\" -gt 0 ]]; then\n echo \"[FAILURE] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} has been deprecated\"\n fi\n failure_counter=$((failure_counter+failures_num))\n\n successes_num=$(jq -r '.[].successes' \"${IMAGE_REPO_PATH}/deprecated_image_check_output.json\")\n if [[ \"${successes_num}\" -gt 0 ]]; then\n echo \"[SUCCESS] Image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} is valid\"\n fi\n success_counter=$((success_counter+successes_num))\n\n elif [ \"$http_code\" == \"404\" ];\n then\n echo \"[WARNING] Registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY} not found in Red Hat Catalog. Task cannot provide results if image is deprecated.\"\n warnings_counter=$((warnings_counter+1))\n else\n echo \"[ERROR] Unexpected error (HTTP code: ${http_code}) occurred for registry/image ${IMAGE_REGISTRY}/${IMAGE_REPOSITORY}.\"\n error_counter=$((error_counter+1))\n fi\ndone\n\nnote=\"Task deprecated-image-check failed: Command conftest failed. For details, check Tekton task log.\"\nERROR_OUTPUT=$(make_result_json -r ERROR -n \"$POLICY_NAMESPACE\" -t \"$note\")\n\nnote=\"Task deprecated-image-check completed: Check result for task result.\"\nif [[ \"$error_counter\" == 0 ]];\nthen\n if [[ \"${failure_counter}\" -gt 0 ]]; then\n RES=\"FAILURE\"\n elif [[ \"${warnings_counter}\" -gt 0 ]]; then\n RES=\"WARNING\"\n elif [[ \"${success_counter}\" -eq 0 ]]; then\n # when all counters are 0, there are no base images to check\n note=\"Task deprecated-image-check success: No base images to check.\"\n RES=\"SUCCESS\"\n else\n RES=\"SUCCESS\"\n fi\n TEST_OUTPUT=$(make_result_json \\\n -r \"${RES}\" -n \"$POLICY_NAMESPACE\" \\\n -s \"${success_counter}\" -f \"${failure_counter}\" -w \"${warnings_counter}\" -t \"$note\")\nfi\necho \"${TEST_OUTPUT:-${ERROR_OUTPUT}}\" | tee \"/tekton/results/TEST_OUTPUT\"\n\necho \"${images_processed_template/\\[%s]/[$digests_processed_string]}\" | tee \"/tekton/results/IMAGES_PROCESSED\"\n", "volumeMounts": [ { "mountPath": "/etc/pki/tls/certs/ca-custom-bundle.crt", "name": "trusted-ca", "readOnly": true, "subPath": "ca-bundle.crt" } ] } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "build.appstudio.openshift.io/repo": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-xuxeza/commit/654b7e6852c296e5035748c2c54ff8facc142986", "build.appstudio.redhat.com/commit_sha": "654b7e6852c296e5035748c2c54ff8facc142986", "build.appstudio.redhat.com/target_branch": "base-duskcs", "chains.tekton.dev/signed": "true", "pipeline.tekton.dev/release": "9db88e0", "pipelinesascode.tekton.dev/branch": "base-duskcs", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/controller-info": "{\"name\":\"default\",\"configmap\":\"pipelines-as-code\",\"secret\":\"pipelines-as-code-secret\", \"gRepo\": \"pipelines-as-code\"}", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/git-auth-secret": "pac-gitauth-ypfaxy", "pipelinesascode.tekton.dev/git-provider": "gitea", "pipelinesascode.tekton.dev/log-url": "https://localhost:9443/ns/build-e2e-esuy/pipelinerun/fj-test-custom-branch-wrotuf-on-push-5dkrx", "pipelinesascode.tekton.dev/max-keep-runs": "3", "pipelinesascode.tekton.dev/on-cel-expression": "event == \"push\" \u0026\u0026 target_branch == \"base-duskcs\"", "pipelinesascode.tekton.dev/original-prname": "fj-test-custom-branch-wrotuf-on-push", "pipelinesascode.tekton.dev/repo-url": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-xuxeza", "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-devfile-sample-hello-world-xuxeza", "pipelinesascode.tekton.dev/scm-reporting-plr-started": "true", "pipelinesascode.tekton.dev/sender": "konflux-ci-qe-bot", "pipelinesascode.tekton.dev/sha": "654b7e6852c296e5035748c2c54ff8facc142986", "pipelinesascode.tekton.dev/sha-title": "Merge pull request 'Konflux update fj-test-custom-branch-wrotuf' (#2) from konflux-fj-test-custom-branch-wrotuf into base-duskcs\n", "pipelinesascode.tekton.dev/sha-url": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-xuxeza/commit/654b7e6852c296e5035748c2c54ff8facc142986", "pipelinesascode.tekton.dev/source-branch": "refs/heads/base-duskcs", "pipelinesascode.tekton.dev/source-repo-url": "https://codeberg.org/konflux-qe/devfile-sample-hello-world-xuxeza", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-xuxeza", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "build-e2e-esuy/results/98d20e37-1e66-49a1-8d48-363ef180aa59/records/8366c583-be95-4e96-ba9b-b3b2eeb21af5", "results.tekton.dev/recordSummaryAnnotations": "{\"repo\":\"devfile-sample-hello-world-xuxeza\",\"commit\":\"654b7e6852c296e5035748c2c54ff8facc142986\",\"eventType\":\"push\"}", "results.tekton.dev/result": "build-e2e-esuy/results/98d20e37-1e66-49a1-8d48-363ef180aa59", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "image-build, konflux" }, "creationTimestamp": "2026-07-08T17:18:21Z", "deletionGracePeriodSeconds": 0, "deletionTimestamp": "2026-07-08T17:19:48Z", "finalizers": [ "results.tekton.dev/taskrun" ], "generation": 2, "labels": { "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev", "app.kubernetes.io/version": "v0.42.0", "appstudio.openshift.io/application": "build-suite-test-application-grvn", "appstudio.openshift.io/component": "fj-test-custom-branch-wrotuf", "build.appstudio.redhat.com/build_type": "docker", "pipelines.appstudio.openshift.io/type": "build", "pipelinesascode.tekton.dev/cancel-in-progress": "false", "pipelinesascode.tekton.dev/event-type": "push", "pipelinesascode.tekton.dev/original-prname": "fj-test-custom-branch-wrotuf-on-push", "pipelinesascode.tekton.dev/repository": "codeberg-org-konflux-qe-devfile-sample-hello-world-xuxeza", "pipelinesascode.tekton.dev/sha": "654b7e6852c296e5035748c2c54ff8facc142986", "pipelinesascode.tekton.dev/state": "started", "pipelinesascode.tekton.dev/url-org": "konflux-qe", "pipelinesascode.tekton.dev/url-repository": "devfile-sample-hello-world-xuxeza", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "fj-test-custom-branch-wrotuf-on-push-5dkrx", "tekton.dev/pipelineRun": "fj-test-custom-branch-wrotuf-on-push-5dkrx", "tekton.dev/pipelineRunUID": "98d20e37-1e66-49a1-8d48-363ef180aa59", "tekton.dev/pipelineTask": "build-image-index", "tekton.dev/task": "build-image-index-min" }, "name": "fj-test-custom-branch-wrotuf-on-push-5dkrx-build-image-index", "namespace": "build-e2e-esuy", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "fj-test-custom-branch-wrotuf-on-push-5dkrx", "uid": "98d20e37-1e66-49a1-8d48-363ef180aa59" } ], "resourceVersion": "25372", "uid": "8366c583-be95-4e96-ba9b-b3b2eeb21af5" }, "spec": { "params": [ { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/build-e2e-esuy/fj-test-custom-branch-wrotuf:654b7e6852c296e5035748c2c54ff8facc142986" }, { "name": "ALWAYS_BUILD_INDEX", "value": "false" }, { "name": "IMAGES", "value": [ "quay.io/redhat-appstudio-qe/build-e2e-esuy/fj-test-custom-branch-wrotuf:654b7e6852c296e5035748c2c54ff8facc142986@sha256:677aa96f8bf8e028089692b9ede3d774120928c7ea9fb09a01ee1f396891d312" ] }, { "name": "BUILDAH_FORMAT", "value": "docker" } ], "serviceAccountName": "build-pipeline-fj-test-custom-branch-wrotuf", "taskRef": { "params": [ { "name": "name", "value": "build-image-index-min" }, { "name": "bundle", "value": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min:0.3@sha256:fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e" }, { "name": "kind", "value": "task" } ], "resolver": "bundles" }, "timeout": "1h0m0s" }, "status": { "artifacts": {}, "completionTime": "2026-07-08T17:18:30Z", "conditions": [ { "lastTransitionTime": "2026-07-08T17:18:30Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "fj-test-custom-branch-wrotu0bf037fe7067feab8657b2c7bb13f648-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha256": "fbb362f21e559606f8941cde6a2c0507c8af6cfc8bee88ffc38032e8e80b4b7e" }, "entryPoint": "build-image-index-min", "uri": "quay.io/konflux-ci/tekton-catalog/task-build-image-index-min" } }, "results": [ { "name": "IMAGES", "type": "string", "value": "quay.io/redhat-appstudio-qe/build-e2e-esuy/fj-test-custom-branch-wrotuf@sha256:677aa96f8bf8e028089692b9ede3d774120928c7ea9fb09a01ee1f396891d312" }, { "name": "IMAGE_DIGEST", "type": "string", "value": "sha256:677aa96f8bf8e028089692b9ede3d774120928c7ea9fb09a01ee1f396891d312" }, { "name": "IMAGE_REF", "type": "string", "value": "quay.io/redhat-appstudio-qe/build-e2e-esuy/fj-test-custom-branch-wrotuf@sha256:677aa96f8bf8e028089692b9ede3d774120928c7ea9fb09a01ee1f396891d312" }, { "name": "IMAGE_URL", "type": "string", "value": "quay.io/redhat-appstudio-qe/build-e2e-esuy/fj-test-custom-branch-wrotuf:654b7e6852c296e5035748c2c54ff8facc142986" } ], "startTime": "2026-07-08T17:18:21Z", "steps": [ { "container": "step-build", "imageID": "quay.io/konflux-ci/konflux-build-cli@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae", "name": "build", "provenance": {}, "terminated": { "containerID": "containerd://e7bf1f4b3c76ae42840d7050609a39b850e2241a97b91c33b982c4fa89565c7a", "exitCode": 0, "finishedAt": "2026-07-08T17:18:26Z", "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-esuy/fj-test-custom-branch-wrotuf@sha256:677aa96f8bf8e028089692b9ede3d774120928c7ea9fb09a01ee1f396891d312\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:677aa96f8bf8e028089692b9ede3d774120928c7ea9fb09a01ee1f396891d312\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-esuy/fj-test-custom-branch-wrotuf@sha256:677aa96f8bf8e028089692b9ede3d774120928c7ea9fb09a01ee1f396891d312\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-esuy/fj-test-custom-branch-wrotuf:654b7e6852c296e5035748c2c54ff8facc142986\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-08T17:18:24Z" }, "terminationReason": "Completed" }, { "container": "step-create-sbom", "imageID": "quay.io/konflux-ci/mobster@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094", "name": "create-sbom", "provenance": {}, "terminated": { "containerID": "containerd://97e5a0a2bd84260cace892819149d2ee3dba21870e78a137c5a4cb84c75b77b2", "exitCode": 0, "finishedAt": "2026-07-08T17:18:27Z", "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-esuy/fj-test-custom-branch-wrotuf@sha256:677aa96f8bf8e028089692b9ede3d774120928c7ea9fb09a01ee1f396891d312\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:677aa96f8bf8e028089692b9ede3d774120928c7ea9fb09a01ee1f396891d312\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-esuy/fj-test-custom-branch-wrotuf@sha256:677aa96f8bf8e028089692b9ede3d774120928c7ea9fb09a01ee1f396891d312\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-esuy/fj-test-custom-branch-wrotuf:654b7e6852c296e5035748c2c54ff8facc142986\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-08T17:18:27Z" }, "terminationReason": "Completed" }, { "container": "step-upload-sbom", "imageID": "quay.io/konflux-ci/task-runner@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload-sbom", "provenance": {}, "terminated": { "containerID": "containerd://2334409e38b26577325f273558d39e7d33f602db2af4e25ccf90fc9d11b22ce7", "exitCode": 0, "finishedAt": "2026-07-08T17:18:29Z", "message": "[{\"key\":\"IMAGES\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-esuy/fj-test-custom-branch-wrotuf@sha256:677aa96f8bf8e028089692b9ede3d774120928c7ea9fb09a01ee1f396891d312\",\"type\":1},{\"key\":\"IMAGE_DIGEST\",\"value\":\"sha256:677aa96f8bf8e028089692b9ede3d774120928c7ea9fb09a01ee1f396891d312\",\"type\":1},{\"key\":\"IMAGE_REF\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-esuy/fj-test-custom-branch-wrotuf@sha256:677aa96f8bf8e028089692b9ede3d774120928c7ea9fb09a01ee1f396891d312\",\"type\":1},{\"key\":\"IMAGE_URL\",\"value\":\"quay.io/redhat-appstudio-qe/build-e2e-esuy/fj-test-custom-branch-wrotuf:654b7e6852c296e5035748c2c54ff8facc142986\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-07-08T17:18:27Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "This takes existing Image Manifests and combines them in an Image Index.", "params": [ { "description": "The target image and tag where the image will be pushed to.", "name": "IMAGE", "type": "string" }, { "default": "true", "description": "Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)", "name": "TLSVERIFY", "type": "string" }, { "description": "List of Image Manifests to be referenced by the Image Index", "name": "IMAGES", "type": "array" }, { "default": "true", "description": "Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.", "name": "ALWAYS_BUILD_INDEX", "type": "string" }, { "default": "vfs", "description": "Storage driver to configure for buildah", "name": "STORAGE_DRIVER", "type": "string" }, { "default": "oci", "description": "The format for the resulting image's mediaType. Valid values are oci (default) or docker.", "name": "BUILDAH_FORMAT", "type": "string" }, { "default": "false", "description": "Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.", "name": "SBOM_SKIP_VALIDATION", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data", "name": "caTrustConfigMapKey", "type": "string" } ], "results": [ { "description": "Digest of the image just built", "name": "IMAGE_DIGEST", "type": "string" }, { "description": "Image repository and tag where the built image was pushed", "name": "IMAGE_URL", "type": "string" }, { "description": "List of all referenced image manifests", "name": "IMAGES", "type": "string" }, { "description": "Image reference of the built image containing both the repository and the digest", "name": "IMAGE_REF", "type": "string" }, { "description": "Reference of SBOM blob digest to enable digest-based verification from provenance", "name": "SBOM_BLOB_URL", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "BUILDAH_FORMAT", "value": "docker" }, { "name": "IMAGE", "value": "quay.io/redhat-appstudio-qe/build-e2e-esuy/fj-test-custom-branch-wrotuf:654b7e6852c296e5035748c2c54ff8facc142986" }, { "name": "TLSVERIFY", "value": "true" }, { "name": "ALWAYS_BUILD_INDEX", "value": "false" }, { "name": "STORAGE_DRIVER", "value": "vfs" } ], "volumeMounts": [ { "mountPath": "/index-build-data", "name": "shared-dir" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ] }, "steps": [ { "args": [ "quay.io/redhat-appstudio-qe/build-e2e-esuy/fj-test-custom-branch-wrotuf:654b7e6852c296e5035748c2c54ff8facc142986@sha256:677aa96f8bf8e028089692b9ede3d774120928c7ea9fb09a01ee1f396891d312" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/konflux-ci/konflux-build-cli:latest@sha256:b296232c9b0d478c0bd1f48911ead97cd786eebdc737b877797564567fda8eae", "name": "build", "script": "#!/bin/bash\n# Fixing group permission on /var/lib/containers\nset -eu\nset -o pipefail\nchown root:root /var/lib/containers\n\nsed -i 's/^\\s*short-name-mode\\s*=\\s*.*/short-name-mode = \"disabled\"/' /etc/containers/registries.conf\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\n\necho \"Running konflux-build-cli\"\nif ! konflux-build-cli image build-image-index \\\n --image \"$IMAGE\" \\\n --tls-verify=\"$TLSVERIFY\" \\\n --buildah-format \"$BUILDAH_FORMAT\" \\\n --always-build-index=\"$ALWAYS_BUILD_INDEX\" \\\n --additional-tags \"fj-test-custom-branch-wrotuf-on-push-5dkrx-build-image-index\" \\\n --output-manifest-path \"$MANIFEST_DATA_FILE\" \\\n --result-path-image-digest \"/tekton/results/IMAGE_DIGEST\" \\\n --result-path-image-url \"/tekton/results/IMAGE_URL\" \\\n --result-path-image-ref \"/tekton/results/IMAGE_REF\" \\\n --result-path-images \"/tekton/results/IMAGES\" \\\n --images \"$@\"; then\n echo \"Failed to build image index\"\n exit 1\nfi\n", "securityContext": { "capabilities": { "add": [ "SETFCAP" ] }, "runAsUser": 0 } }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/konflux-ci/mobster:1.1.0-1770046049@sha256:7415f55121f5580ac79dc6e6567383574ee5f94f97736f235a141688f02e6094", "name": "create-sbom", "script": "#!/bin/bash\nset -e\n\nMANIFEST_DATA_FILE=\"/index-build-data/manifest_data.json\"\nif [ ! -f \"$MANIFEST_DATA_FILE\" ]; then\n echo \"The manifest_data.json file does not exist. Skipping the SBOM creation...\"\n exit 0\nfi\n\nIMAGE_URL=\"$(cat \"/tekton/results/IMAGE_URL\")\"\nIMAGE_DIGEST=\"$(cat \"/tekton/results/IMAGE_DIGEST\")\"\necho \"Creating SBOM result file...\"\nmobster_args=(generate --output /index-build-data/index.spdx.json)\n\nif [ \"${SBOM_SKIP_VALIDATION}\" == \"true\" ]; then\n echo \"Skipping SBOM validation\"\n mobster_args+=(--skip-validation)\nfi\n\nmobster_args+=(\n oci-index\n --index-image-pullspec \"$IMAGE_URL\"\n --index-image-digest \"$IMAGE_DIGEST\"\n --index-manifest-path \"$MANIFEST_DATA_FILE\"\n)\nmobster \"${mobster_args[@]}\"\n" }, { "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "100m", "memory": "256Mi" } }, "image": "quay.io/konflux-ci/task-runner:1.6.0@sha256:1abfe4e50d4e961d0fd9790202565f93ee650fe8dfc50932c94989acba10485f", "name": "upload-sbom", "script": "#!/bin/bash\nset -e\n\necho \"[$(date --utc -Ins)] Update CA trust\"\n\nca_bundle=/mnt/trusted-ca/ca-bundle.crt\nif [ -f \"$ca_bundle\" ]; then\n echo \"INFO: Using mounted CA bundle: $ca_bundle\"\n cp -vf $ca_bundle /etc/pki/ca-trust/source/anchors\n update-ca-trust\nfi\n\nSBOM_RESULT_FILE=\"/index-build-data/index.spdx.json\"\nif [ ! -f \"$SBOM_RESULT_FILE\" ]; then\n echo \"The index.spdx.json file does not exists. Skipping the SBOM upload...\"\n exit 0\nfi\n\n# Pre-select the correct credentials to work around cosign not supporting the containers-auth.json spec\nmkdir -p /tmp/auth \u0026\u0026 select-oci-auth \"$(cat \"/tekton/results/IMAGE_REF\")\" \u003e /tmp/auth/config.json\nexport DOCKER_CONFIG=/tmp/auth\n\necho \"Pushing sbom to registry\"\nif ! retry cosign attach sbom --sbom \"$SBOM_RESULT_FILE\" --type spdx \"$(cat \"/tekton/results/IMAGE_REF\")\"\nthen\n echo \"Failed to push sbom to registry\"\n exit 1\nfi\n\n# Remove tag from IMAGE while allowing registry to contain a port number.\nsbom_repo=\"${IMAGE%:*}\"\nsbom_digest=\"$(sha256sum \"$SBOM_RESULT_FILE\" | cut -d' ' -f1)\"\n# The SBOM_BLOB_URL is created by `cosign attach sbom`.\necho -n \"${sbom_repo}@sha256:${sbom_digest}\" | tee \"/tekton/results/SBOM_BLOB_URL\"\n", "securityContext": { "runAsNonRoot": false, "runAsUser": 0 } } ], "volumes": [ { "emptyDir": {}, "name": "shared-dir" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } } ], "kind": "List", "metadata": { "resourceVersion": "" } }